Skip to Main content Skip to Navigation
Journal articles

On the Use of Artificial Malicious Patterns for Android Malware Detection

Abstract : Malware programs currently represent the most serious threat to computer information systems. Despite the performed efforts of researchers in this field, detection tools still have limitations for one main reason. Actually, malware developers usually use obfuscation techniques consisting in a set of transformations that make the code and/or its execution difficult to analyze by hindering both manual and automated inspections. These techniques allow the malware to escape the detection tools, and hence to be seen as a benign program. To solve the obfuscation issue, many researchers have proposed to extract frequent Application Programming Interface (API) call sequences from previously encountered malware programs using pattern mining techniques and hence, build a base of fraudulent behaviors. Based on this process, it is worth mentioning that the performance of the detection process heavily depends on the base of examples of malware behaviors; also called malware patterns. In order to deal with this shortcoming, a dynamic detection method called Artificial Malware-based Detection (AMD) is proposed in this paper. AMD makes use of not only extracted malware patterns but also artificially generated ones. The artificial malware patterns are generated using an evolutionary (genetic) algorithm. The latter evolves a population of API call sequences with the aim to find new malware behaviors following a set of well-defined evolution rules. The artificial fraudulent behaviors are subsequently inserted into the base of examples in order to enrich it with unseen malware patterns. The main motivation behind the proposed AMD approach is to diversify the base of malware examples in order to maximize the detection rate. AMD has been tested on different Android malware data sets and compared against recent prominent works using commonly employed performance metrics. The performance analysis of the obtained results shows the merits of our AMD novel approach.
Complete list of metadatas

Cited literature [54 references]  Display  Hide  Download

https://hal.inria.fr/hal-02464180
Contributor : Zaineb Chelly Dagdia <>
Submitted on : Monday, February 3, 2020 - 9:22:14 AM
Last modification on : Wednesday, October 28, 2020 - 10:04:02 AM
Long-term archiving on: : Monday, May 4, 2020 - 12:39:47 PM

File

paper.pdf
Files produced by the author(s)

Identifiers

Collections

Citation

Manel Jerbi, Zaineb Chelly Dagdia, Slim Bechikh, Mohamed Makhlouf, Lamjed Said. On the Use of Artificial Malicious Patterns for Android Malware Detection. Computers and Security, Elsevier, In press, 92, ⟨10.1016/j.cose.2020.101743⟩. ⟨hal-02464180⟩

Share

Metrics

Record views

309

Files downloads

980