Abstract
Android is the most popular widely accessible smartphone operating system, yet its permission declaration and access control systems cannot detect malicious activities. Advanced malware uses cutting-edge obfuscation techniques to mask its true intentions from scanning engines, and traditional malware detection approaches are no longer effective in such cases. In this paper we propose DyBAnd, an Android malware detection approach based on Multilayer Perceptron, a neural network-based model for recognising dynamic malware activity. DyBAnd makes use of behavioural characteristics gleaned via dynamic analysis of a program running in an emulated environment, allowing it to detect malicious code in real time environment. The proposed system is tested against 17,341 contemporary applications from various domains, including Banking, Riskware, Adware, SMS, and Benign. Experimental results show that DyBAnd detects malware with a 98.98% accuracy and a false positive rate of 1.02%, significantly higher than Linear Programming. DyBAnd also outperforms conventional machine learning techniques.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
- 2.
https://purplesec.us/resources/cyber-security-statistics/ [June 12, 2022].
- 3.
https://developer.android.com/studio/test/monkey.html [June 12, 2022].
- 4.
https://github.com/honeynet/droidbot [June 12, 2022].
- 5.
https://www.unb.ca/cic/datasets/maldroid-2020.html [June 12, 2022].
References
Sihag, V., Prakash, S., Choudhary, G., Dragoni, N., You, I.: DIMDA: deep learning and image-based malware detection for Android. In: Singh, P.K., Wierzchoń, S.T., Chhabra, J.K., Tanwar, S. (eds.) FTNCT 2021. LNEE, vol. 936, pp. 895–906. Springer, Singapore (2022). https://doi.org/10.1007/978-981-19-5037-7_64
Bacci, A., Bartoli, A., Martinelli, F., Medvet, E., Mercaldo, F.: Detection of obfuscation techniques in Android applications. In: Proceedings of the 13th International Conference on Availability, Reliability and Security, pp. 1–9 (2018)
Sihag, V., Vardhan, M., Singh, P.: BLADE: robust malware detection against obfuscation in Android. Forensic Sci. Int. Digit. Invest. 38, 301176 (2021)
Sihag, V., Choudhary, G., Vardhan, M., Singh, P., Seo, J.T.: PICAndro: packet inspection-based Android malware detection. Secur. Commun. Netw. 2021 (2021)
Borana, P., Sihag, V., Choudhary, G., Vardhan, M., Singh, P.: An assistive tool for fileless malware detection. In: 2021 World Automation Congress (WAC), pp. 21–25. IEEE (2021)
Gyamfi, N.K., Goranin, N., Čeponis, D., Čenys, A.: Malware detection using convolutional neural network, a deep learning framework: comparative analysis. J. Internet Serv. Inf. Secur. 12(4), 102–115 (2022)
Park, J., Shim, H., Vu, L.N., Jung, S.: Android adware detection using soot and CFG. J. Wirel. Mob. Netw. Ubiquit. Comput. Dependable Appl. (JoWUA) (4), 94–104 (2022)
Yuan, Z., Lu, Y., Wang, Z., Xue, Y.: Droid-Sec: deep learning in Android malware detection. In: Proceedings of the 2014 ACM Conference on SIGCOMM, pp. 371–372 (2014)
Hou, S., Saas, A., Ye, Y., Chen, L.: DroidDelver: an Android malware detection system using deep belief network based on API call blocks. In: Song, S., Tong, Y. (eds.) WAIM 2016. LNCS, vol. 9998, pp. 54–66. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-47121-1_5
Xiao, X., Zhang, S., Mercaldo, F., Hu, G., Sangaiah, A.K.: Android malware detection based on system call sequences and LSTM. Multimed. Tools Appl. 78(4), 3979–3999 (2019). https://doi.org/10.1007/s11042-017-5104-0
Alzaylaee, M.K., Yerima, S.Y., Sezer, S.: DL-Droid: deep learning based Android malware detection using real devices. Comput. Secur. 89, 101663 (2020)
Mahdavifar, S., Ghorbani, A.A.: Application of deep learning to cybersecurity: a survey. Neurocomputing 347, 149–176 (2019)
Sihag, V., Vardhan, M., Singh, P., Choudhary, G., Son, S.: De-LADY: deep learning based Android malware detection using dynamic features. J. Internet Serv. Inf. Secur. 11(2), 34–45 (2021)
Machiry, A., Tahiliani, R., Naik, M.: Dynodroid: an input generation system for Android apps. In: Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering, pp. 224–234 (2013)
Anand, S., Naik, M., Harrold, M.J., Yang, H.: Automated concolic testing of smartphone apps. In: Proceedings of the ACM SIGSOFT 20th International Symposium on the Foundations of Software Engineering, pp. 1–11 (2012)
Hao, S., Liu, B., Nath, S., Halfond, W.G.J., Govindan, R.: PUMA: programmable UI-automation for large-scale dynamic analysis of mobile apps. In: Proceedings of the 12th Annual International Conference on Mobile Systems, Applications, and Services, pp. 204–217 (2014)
Cai, H., Meng, N., Ryder, B., Yao, D.: DroidCat: effective Android malware detection and categorization via app-level profiling. IEEE Trans. Inf. Forensics Secur. 14(6), 1455–1470 (2018)
Sihag, V., Swami, A., Vardhan, M., Singh, P.: Signature based malicious behavior detection in Android. In: Chaubey, N., Parikh, S., Amin, K. (eds.) COMS2 2020. CCIS, vol. 1235, pp. 251–262. Springer, Singapore (2020). https://doi.org/10.1007/978-981-15-6648-6_20
Tam, K., Fattori, A., Khan, S., Cavallaro, L.: CopperDroid: automatic reconstruction of Android malware behaviors. In: NDSS Symposium 2015, pp. 1–15 (2015)
Acknowledgement
This work has been supported by project TRANSACT funded under H2020-EU.2.1.1. - INDUSTRIAL LEADERSHIP - Leadership in enabling and industrial technologies - Information and Communication Technologies (grant agreement ID: 101007260).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2023 The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.
About this paper
Cite this paper
Jaiswal, S., Sihag, V., Choudhary, G., Dragoni, N. (2023). DyBAnd: Dynamic Behavior Based Android Malware Detection. In: You, I., Kim, H., Angin, P. (eds) Mobile Internet Security. MobiSec 2022. Communications in Computer and Information Science, vol 1644. Springer, Singapore. https://doi.org/10.1007/978-981-99-4430-9_15
Download citation
DOI: https://doi.org/10.1007/978-981-99-4430-9_15
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-99-4429-3
Online ISBN: 978-981-99-4430-9
eBook Packages: Computer ScienceComputer Science (R0)