Search

Android is the most preferred mobile operating system in the world. Applications are available from both official application repositories and other application stores. For these reasons, there has been a remarkable increase in malware for the Android operating system in recent years. In this study, a novel Android malware detection system is proposed by using filter-based feature selection methods. The proposed approach is static Android malware detection based on machine learning. Permissions extracted from application files are used as features in the developed system. Dimension reduction is carried out with eight different feature selection methods to enhance the running time and efficiency of machine learning algorithms. While four of these methods are used in Android malware detection systems, the remaining four methods are adapted from text classification studies. The adapted methods are compared in terms of both extracted features and classification results. When the results are examined, it is shown that the adapted methods improve the efficiency of the classification algorithms and can be used in this field. [ABSTRACT FROM AUTHOR]

In this paper, a novel combination of deep learning recurrent neural network and Lyapunov time is proposed to forecast the consumption of electricity load, in Greece, in normal/abrupt change value areas. Our method verifies the chaotic behavior of load time series through chaos time series analysis and with the application of deep learning recurrent neural networks produces predictions for 10 and 20 days ahead. Specifically, four different neural network models constructed (a) feed forward neural network, (b) gated recurrent unit (GRU) neural network, (c) long short-term memory (LSTM) recurrent and (d) bidirectional LSTM neural network to implement the prediction in a prediction horizon, produced through the extraction of maximum Lyapunov exponent. We constructed sequences of algorithms to feed the neural networks, creating three scenarios (a) 1-step, (b) 10-step and (c) 20-step sequences. For each neural network model, we used its predictions as inputs to predict steps forward, iteratively, to examine the accuracy of the proposed models, for horizons that are both inside and outside to that defined by Lyapunov time. The results show that the deep learning GRU neural network produces iterative predictions of high accuracy and stability, following the trend evolution of actual values, even outside the safe horizon for 1-step and 10-step cases. [ABSTRACT FROM AUTHOR]

Bayesian networks (BNs) encode conditional independence to avoid combinatorial explosion on the number of variables, but are subject to exponential growth of space and inference time on the number of causes per effect variable. Among space-efficient local models, we focus on the Non-Impeding Noisy-AND Tree (NIN-AND Tree or NAT) models, due to their multiple merits, and on NAT-modeled BNs, where each multi-parent variable family may be encoded as a NAT-model. Although BN inference is generally exponential on treewidth, the inference is tractable with NAT-modeled BNs of high treewidth and low density. In this work, we present the first study to learn NAT-modeled BNs from data. We apply the MDL principle to learning NAT-modeled BNs by developing a corresponding scoring function, and we couple it with heuristic structure search. We show that when data satisfy NAT causal independence, high treewidth, and low density structure, learning underlying NAT modeled BNs is feasible. [ABSTRACT FROM AUTHOR]

The widespread adoption of smartphones dramatically increases the risk of attacks and the spread of mobile malware, especially on the Android platform. Machine learning-based solutions have been already used as a tool to supersede signature-based anti-malware systems. However, malware authors leverage features from malicious and legitimate samples to estimate statistical difference in-order to create adversarial examples. Hence, to evaluate the vulnerability of machine learning algorithms in malware detection, we propose five different attack scenarios to perturb malicious applications (apps). By doing this, the classification algorithm inappropriately fits the discriminant function on the set of data points, eventually yielding a higher misclassification rate. Further, to distinguish the adversarial examples from benign samples, we propose two defense mechanisms to counter attacks. To validate our attacks and solutions, we test our model on three different benchmark datasets. We also test our methods using various classifier algorithms and compare them with the state-of-the-art data poisoning method using the Jacobian matrix. Promising results show that generated adversarial samples can evade detection with a very high probability. Additionally, evasive variants generated by our attack models when used to harden the developed anti-malware system improves the detection rate up to 50% when using the generative adversarial network (GAN) method. [ABSTRACT FROM AUTHOR]

Enhancements to Android security frameworks have been a focal point of the research community in the past few years due to Android's growing popularity. The Android permission framework performs a vital role in identifying the malicious behavior of an application. Most malware utilizes the wrong permission, given by an application that exploits device security and privacy. The focus point should be managing the permission given to an application at the very beginning, when installing the application. However, in this regard, the solutions given so far are user-centric. That means the user needs to decide whether permission should be given or not. A novice user usually ignores the warnings during installation of an app or accessing a resource. In this research, we introduce an enhanced Android permission framework that automatically decides for the user which permissions should be given to application at installation or when resources are accessed in the newer Android versions. We generated a large dataset of permissions and their ratings to generate a machine learning model. Finally, an incorporated machine learning model automatically decides on behalf of a user which permissions should be given to the user. Our results show high accuracy in the auto-selection of suggested permissions for the end user. [ABSTRACT FROM AUTHOR]

Recent years have witnessed huge growth in Android malware development. Colossal reliance on Android applications for day to day working and their massive development dictates for an automated mechanism to distinguish malicious applications from benign ones. A significant amount of research has been devoted to analyzing and mitigating this growing problem; however, attackers are using more complicated techniques to evade detection. This paper proposes a framework, AdDroid; for analyzing and detecting malicious behaviour in Android applications based on various combinations of artefacts called Rules. The artefacts represent actions of an Android application such as connecting to the Internet, uploading a file to a remote server or installing another package on the device etc. AdDroid employs an ensemble-based machine learning technique where Adaboost is combined with traditional classifiers in order to train a model founded on static analysis of Android applications that is capable of recognizing malicious applications. Feature selection and extraction techniques are used to get the most distinguishing Rules. The proposed model is created using a dataset comprising 1420 Android applications with 910 malicious and 510 benign applications. Our proposed system achieved an accuracy of 99.11% with 98.61% True Positive (TP) and 99.33% True Negative (TN) rate. The high TP and TN rates reflect the efficacy on both major and minor class. Since the proposed solution has exceptionally low computational complexity, therefore, making it possible to analyze applications in real-time. [ABSTRACT FROM AUTHOR]

Recently, people rely on mobile devices to conduct their daily fundamental activities. Simultaneously, most of the people prefer devices with Android operating system. As the demand expands, deceitful authors develop malware to compromise Android for private and money purposes. Consequently, security analysts have to conduct static and dynamic analyses to counter malware violation. In this paper, we adopt static analysis which only requests minimal resource consumption and rapid processing. However, finding a minimum set of features in the static analysis are vital because it removes irrelevant data, reduces the runtime of machine learning detection and reduces the dimensionality of datasets. Therefore, in this paper, we investigate three categories of features, which are permissions, directory path, and telephony. This investigation considers the features frequency as well as repeatedly used in each application. Subsequently, this study evaluates the proposed features in three bio-inspired machine learning classifiers in artificial neural network (ANN) category to signify the usefulness of ANN type in uncovering unknown malware. The classifiers are multilayer perceptron (MLP), voted perceptron (VP) and radial basis function network (RBFN). Among all these three classifiers, the outstanding outcomes acquire is the MLP, which achieves 90% in accuracy and 87% in true positive rate (TPR), as well as 97% accuracy in our Bio Analyzer prediction system. [ABSTRACT FROM AUTHOR]

Detecting whether a given activity in a device, corresponds to a legitimate device user or not, is usually carried out by looking for deviations in behavior against a normal usage baseline. One approach to this problem, called masquerade detection, uses the file system navigation information, comprised of the files, folders, and how the user navigates between them, to construct the normal usage baseline. Atop the file system navigation approach for masquerade detection, there is an alternate representation of file system usage which abstracts away a collection of interrelated files into a single symbol, denoting a task; thus, touching any of these files amounts to simply as executing a task. In this paper, we propose a refined notion of the task abstraction, which allows for a better characterization of the user. The improved abstraction makes possible to obtain a better Masquerade Detection System with increased efficiency, resulting in a faster detection of masqueraders. [ABSTRACT FROM AUTHOR]

Mobile devices have become a significant part of people's lives, leading to an increasing number of users involved with such technology. The rising number of users invites hackers to generate malicious applications. Besides, the security of sensitive data available on mobile devices is taken lightly. Relying on currently developed approaches is not sufficient, given that intelligent malware keeps modifying rapidly and as a result becomes more difficult to detect. In this paper, we propose an alternative solution to evaluating malware detection using the anomaly-based approach with machine learning classifiers. Among the various network traffic features, the four categories selected are basic information, content based, time based and connection based. The evaluation utilizes two datasets: public (i.e. MalGenome) and private (i.e. self-collected). Based on the evaluation results, both the Bayes network and random forest classifiers produced more accurate readings, with a 99.97 % true-positive rate (TPR) as opposed to the multi-layer perceptron with only 93.03 % on the MalGenome dataset. However, this experiment revealed that the k-nearest neighbor classifier efficiently detected the latest Android malware with an 84.57 % true-positive rate higher than other classifiers. [ABSTRACT FROM AUTHOR]

Smartphones in general and Android in particular are increasingly shifting into the focus of cyber criminals. For understanding the threat to security and privacy, it is important for security researchers to analyze malicious software written for these systems. The exploding number of Android malware calls for automation in the analysis. In this paper, we present Mobile-Sandbox, a system designed to automatically analyze Android applications in novel ways: First, it combines static and dynamic analysis, i.e., results of static analysis are used to guide dynamic analysis and extend coverage of executed code. Additionally, it uses specific techniques to log calls to native (i.e., 'non-Java') APIs, and last but not least it combines these results with machine-learning techniques to cluster the analyzed samples into benign and malicious ones. We evaluated the system on more than 69,000 applications from Asian third-party mobile markets and found that about 21 % of them actually use native calls in their code. [ABSTRACT FROM AUTHOR]

This paper investigates the impact of code coverage on machine learning-based dynamic analysis of Android malware. In order to maximize the code coverage, dynamic analysis on Android typically requires the generation of events to trigger the user interface and maximize the discovery of the run-time behavioral features. The commonly used event generation approach in most existing Android dynamic analysis systems is the random-based approach implemented with the Monkey tool that comes with the Android SDK. Monkey is utilized in popular dynamic analysis platforms like AASandbox, vetDroid, MobileSandbox, TraceDroid, Andrubis, ANANAS, DynaLog, and HADM. In this paper, we propose and investigate approaches based on stateful event generation and compare their code coverage capabilities with the state-of-the-practice random-based Monkey approach. The two proposed approaches are the state-based method (implemented with DroidBot) and a hybrid approach that combines the state-based and random-based methods. We compare the three different input generation methods on real devices, in terms of their ability to log dynamic behavior features and the impact on various machine learning algorithms that utilize the behavioral features for malware detection. Experiments performed using 17,444 applications show that overall, the proposed methods provide much better code coverage which in turn leads to more accurate machine learning-based malware detection compared to the state-of- the- art approach. [ABSTRACT FROM AUTHOR]

The increasing demand for Android mobile devices and blockchain has motivated malware creators to develop mobile malware to compromise the blockchain. Although the blockchain is secure, attackers have managed to gain access into the blockchain as legal users, thereby comprising important and crucial information. Examples of mobile malware include root exploit, botnets, and Trojans and root exploit is one of the most dangerous malware. It compromises the operating system kernel in order to gain root privileges which are then used by attackers to bypass the security mechanisms, to gain complete control of the operating system, to install other possible types of malware to the devices, and finally, to steal victims’ private keys linked to the blockchain. For the purpose of maximizing the security of the blockchain-based medical data management (BMDM), it is crucial to investigate the novel features and approaches contained in root exploit malware. This study proposes to use the bio-inspired method of practical swarm optimization (PSO) which automatically select the exclusive features that contain the novel android debug bridge (ADB). This study also adopts boosting (adaboost, realadaboost, logitboost, and multiboost) to enhance the machine learning prediction that detects unknown root exploit, and scrutinized three categories of features including (1) system command, (2) directory path and (3) code-based. The evaluation gathered from this study suggests a marked accuracy value of 93% with Logitboost in the simulation. Logitboost also helped to predicted all the root exploit samples in our developed system, the root exploit detection system (RODS). [ABSTRACT FROM AUTHOR]