Preprints‎ > ‎

Effectiveness of Opcode ngrams for Detection of Multi Family Android Malware by Gerardo Canfora, Andrea De Lorenzo, Eric Medvet, Francesco Mercaldo, Corrado Aaron Visaggio

pubblicato 20 giu 2015, 02:16 da Gerardo Canfora
With the wide diffusion of smartphones and their usage in a plethora of processes and activities, these devices have been handling an increasing variety of sensitive resources. Attackers are hence producing a large number of malware applications for Android (the most spread mobile platform), often by slightly modifying existing applications, which results in malware being organized in families.
Some works in the literature showed that opcodes are informative for detecting malware, not only in the An- droid platform. In this paper, we investigate if frequencies of ngrams of opcodes are effective in detecting Android malware and if there is some significant malware family for which they are more or less effective. To this end, we designed a method based on state-of-the-art classifiers applied to frequencies of opcodes ngrams. Then, we experi- mentally evaluated it on a recent dataset composed of 11120 applications, 5560 of which are malware belonging to several different families. Results show that an accuracy of 97% can be obtained on the average, whereas perfect detection rate is achieved for more than one malware family.
Proc of. the 4th International Workshop on Security of Mobile Applications - ARES 2015
Gerardo Canfora,
20 giu 2015, 02:16