Paper Info
Title
DroidSieve: Fast and Accurate Classification of Obfuscated Android Malware.
Abstract
With more than two million applications, Android marketplaces require automatic and scalable methods to efficiently vet apps for the absence of malicious threats. Recent techniques have successfully relied on the extraction of lightweight syntactic features suitable for machine learning classification, but despite their promising results, the very nature of such features suggest they would unlikely--on their own--be suitable for detecting obfuscated Android malware. To address this challenge, we propose DroidSieve, an Android malware classifier based on static analysis that is fast, accurate, and resilient to obfuscation. For a given app, DroidSieve first decides whether the app is malicious and, if so, classifies it as belonging to a family of related malware. DroidSieve exploits obfuscation-invariant features and artifacts introduced by obfuscation mechanisms used in malware. At the same time, these purely static features are designed for processing at scale and can be extracted quickly. For malware detection, we achieve up to 99.82% accuracy with zero false positives; for family identification of obfuscated malware, we achieve 99.26% accuracy at a fraction of the computational cost of state-of-the-art techniques.
Year
DOI
Venue
2017
10.1145/3029806.3029825
CODASPY
Keywords
Field
DocType
Android Malware Detection, Malware Family Identification, Obfuscation, Native Code, Security, Machine Learning, Classification, Scalability
Cryptovirology,Internet privacy,Android (operating system),Computer security,Computer science,Static analysis,Machine code,Obfuscation,Statistical classification,Malware,False positive paradox
Conference
Citations 
PageRank 
References 
24
0.80
29
Authors
6
Name
Order
Citations
PageRank
Guillermo Suarez-Tangil118012.44
Santanu Kumar Dash2887.77
Mansour Ahmadi31045.54
Johannes Kinder446423.49
Giorgio Giacinto52196125.33
Lorenzo Cavallaro688652.85