Skip to the content

M0Droid : an android behavioral-based malware detection model

Damshenas, M, Dehghantanha, A, Choo, KR and Mahmud, R 2015, 'M0Droid : an android behavioral-based malware detection model' , Journal of Information Privacy and Security, 11 (3) , pp. 141-157.

[img] PDF - Published Version
Restricted to Repository staff only

Download (716kB) | Request a copy

Abstract

Anti-mobile malware has attracted the attention of the research and security community in recent years due to the increasing threat of mobile malware and the significant increase in the number of mobile devices. M0Droid, a novel Android behavioral-based malware detection technique comprising a lightweight client agent and a server analyzer, is proposed here. The server analyzer generates a signature for every application (app) based on the system call requests of the app (termed app behavior) and normalizes the generated signature to improve accuracy. The analyzer then uses Spearman’s rank correlation coefficient to identify malware with similar behavior signatures in a previously generated blacklist of malwares signatures. The main contribution of this research is the proposed method to generate standardized mobile malware signatures based on their behavior and a method for comparing generated signatures. Preliminary experiments running M0Droid against Genome dataset and APK submissions of Android client agent or developers indicate a detection rate of 60.16% with 39.43% false-positives and 0.4% false-negatives at a threshold value of 0.90. Increasing or decreasing the threshold value can adjust the strictness of M0Droid. As the threshold value increases, the false-negative rate will also increase, and as the threshold value decreases, the detection and false-positive rates will also decrease. The authors hope that this research will contribute towards Android malware detection techniques.

Item Type: Article
Themes: Media, Digital Technology and the Creative Economy
Subjects outside of the University Themes
Schools: Schools > School of Computing, Science and Engineering > Salford Innovation Research Centre (SIRC)
Journal or Publication Title: Journal of Information Privacy and Security
Publisher: Taylor & Francis
Refereed: Yes
ISSN: 1553-6548
Related URLs:
Funders: 625402- FP7-PEOPLE, Research University Grant Scheme (RUGS)–University Putra
Depositing User: Dr. Ali Dehghantanha
Date Deposited: 01 Oct 2015 10:42
Last Modified: 29 Oct 2015 00:09
URI: http://usir.salford.ac.uk/id/eprint/36751

Actions (login required)

Edit record (repository staff only) Edit record (repository staff only)

Downloads

Downloads per month over past year