Loading...

Detecting malicious applications using system services request behavior

Salehi, M ; Sharif University of Technology | 2019

471 Viewed
  1. Type of Document: Article
  2. DOI: 10.1145/3360774.3360805
  3. Publisher: Association for Computing Machinery , 2019
  4. Abstract:
  5. Widespread growth in Android malware stimulates security researchers to propose different methods for analyzing and detecting malicious behaviors in applications. Nevertheless, current solutions are ill-suited to extract the fine-grained behavior of Android applications accurately and efficiently. In this paper, we propose ServiceMonitor, a lightweight host-based detection system that dynamically detects malicious applications directly on mobile devices. ServiceMonitor reconstructs the fine-grained behavior of applications based on their interaction with system services (i.e. SMS manager, camera, wifi networking, etc). ServiceMonitor monitors the way applications request system services in order to build a statistical Markov chain model to represent what and how system services are used. Afterwards, we use this Markov chain as a feature vector to classify the application behavior into either malicious or benign using the Random Forests classification algorithm. We evaluated ServiceMonitor using a dataset of 8034 malware and 10024 benign applications and obtaining 96.7% of accuracy rate and negligible overhead and performance penalty. © 2019 Association for Computing Machinery
  6. Keywords:
  7. Android (operating system) ; Decision trees ; Malware ; Markov chains ; Random forests ; Ubiquitous computing ; Android ; Android applications ; Application behaviors ; Behavior detection ; Classification algorithm ; Detecting malicious behaviors ; Operating system ; Performance penalties ; Mobile security
  8. Source: 16th EAI International Conference on Mobile and Ubiquitous Systems: Computing, Networking and Services, MobiQuitous 2019, 12 November 2019 through 14 November 2019 ; 2019 , Pages 200-209 ; 9781450372831 (ISBN)
  9. URL: https://dl.acm.org/doi/abs/10.1145/3360774.3360805