Three-phase Detection and Classification for Android Malware Based on Common Behaviors
碩士 === 國立交通大學 === 資訊科學與工程研究所 === 101 === Android is one of the most popular operating systems adopted in mobile devices. The popularity also turns it an attractive target for attackers. To detect and classify malicious Android applications, we propose an efficient and accurate behavior-based solutio...
Main Authors: | , |
---|---|
Other Authors: | |
Format: | Others |
Language: | en_US |
Published: |
2013
|
Online Access: | http://ndltd.ncl.edu.tw/handle/74059509958542780235 |
id |
ndltd-TW-101NCTU5394107 |
---|---|
record_format |
oai_dc |
spelling |
ndltd-TW-101NCTU53941072016-05-22T04:33:53Z http://ndltd.ncl.edu.tw/handle/74059509958542780235 Three-phase Detection and Classification for Android Malware Based on Common Behaviors 以共同行為為基礎之三階式Android惡意程式偵測與分類 Chang, Yu-Ni 張育妮 碩士 國立交通大學 資訊科學與工程研究所 101 Android is one of the most popular operating systems adopted in mobile devices. The popularity also turns it an attractive target for attackers. To detect and classify malicious Android applications, we propose an efficient and accurate behavior-based solution with three phases. The first two phases detects malicious applications and the last phase classifies the detected malware. The “faster” first phase quickly filters out applications with their requested permissions judged by the Bayes model and therefore reduces the number of samples passed to the “slower” second phase which detects malicious applications with their system call sequences matched by the longest common substring (LCS) or N-gram algorithm. Finally, we classify a malware into known or unknown type based on cosine similarity of behavior or permission vectors. Our experiments show that the two-phase detection approach works more accurately than a single phase approach. It has a TP rate and a FP rate of 97% and 3%, respectively, with LCS in the second phase. More than 98% of samples can be classified correctly into known or new types based on permission vectors. Lin, Ying-Dar 林盈達 2013 學位論文 ; thesis 33 en_US |
collection |
NDLTD |
language |
en_US |
format |
Others
|
sources |
NDLTD |
description |
碩士 === 國立交通大學 === 資訊科學與工程研究所 === 101 === Android is one of the most popular operating systems adopted in mobile devices. The popularity also turns it an attractive target for attackers. To detect and classify malicious Android applications, we propose an efficient and accurate behavior-based solution with three phases. The first two phases detects malicious applications and the last phase classifies the detected malware. The “faster” first phase quickly filters out applications with their requested permissions judged by the Bayes model and therefore reduces the number of samples passed to the “slower” second phase which detects malicious applications with their system call sequences matched by the longest common substring (LCS) or N-gram algorithm. Finally, we classify a malware into known or unknown type based on cosine similarity of behavior or permission vectors. Our experiments show that the two-phase detection approach works more accurately than a single phase approach. It has a TP rate and a FP rate of 97% and 3%, respectively, with LCS in the second phase. More than 98% of samples can be classified correctly into known or new types based on permission vectors.
|
author2 |
Lin, Ying-Dar |
author_facet |
Lin, Ying-Dar Chang, Yu-Ni 張育妮 |
author |
Chang, Yu-Ni 張育妮 |
spellingShingle |
Chang, Yu-Ni 張育妮 Three-phase Detection and Classification for Android Malware Based on Common Behaviors |
author_sort |
Chang, Yu-Ni |
title |
Three-phase Detection and Classification for Android Malware Based on Common Behaviors |
title_short |
Three-phase Detection and Classification for Android Malware Based on Common Behaviors |
title_full |
Three-phase Detection and Classification for Android Malware Based on Common Behaviors |
title_fullStr |
Three-phase Detection and Classification for Android Malware Based on Common Behaviors |
title_full_unstemmed |
Three-phase Detection and Classification for Android Malware Based on Common Behaviors |
title_sort |
three-phase detection and classification for android malware based on common behaviors |
publishDate |
2013 |
url |
http://ndltd.ncl.edu.tw/handle/74059509958542780235 |
work_keys_str_mv |
AT changyuni threephasedetectionandclassificationforandroidmalwarebasedoncommonbehaviors AT zhāngyùnī threephasedetectionandclassificationforandroidmalwarebasedoncommonbehaviors AT changyuni yǐgòngtóngxíngwèiwèijīchǔzhīsānjiēshìandroidèyìchéngshìzhēncèyǔfēnlèi AT zhāngyùnī yǐgòngtóngxíngwèiwèijīchǔzhīsānjiēshìandroidèyìchéngshìzhēncèyǔfēnlèi |
_version_ |
1718274765760757760 |