Accurate mobile malware detection and classification in the cloud.

Area of Science:

• Computer Science
• Cybersecurity
• Mobile Security

Background:

• Android's market dominance attracts significant malware threats.
• Existing malware analysis systems struggle to keep pace with the rapid increase in Android malware types.
• There is a need for advanced detection systems that can identify both known and zero-day malware effectively.

Purpose of the Study:

• To propose a novel hybrid Android malware detection system.
• To leverage the strengths of anomaly detection for zero-day threats and signature detection for known malware.
• To utilize the CuckooDroid framework for dynamic and static analysis of Android malware.

Main Methods:

• Developed a hybrid detection system integrating anomaly detection (dynamic analysis) and signature detection (static and dynamic analysis).
• Utilized the open-source CuckooDroid framework, an extension of Cuckoo Sandbox, for malware analysis.
• Evaluated the system using a dataset of 5560 malware samples and 6000 benign samples.

Main Results:

• The anomaly detection engine achieved a low false negative rate (1.16%) and an acceptable false positive rate (1.30%) for zero-day malware detection.
• The signature detection engine demonstrated high accuracy in classifying known malware samples, with an average positive rate of 98.94%.
• The hybrid approach combines the benefits of both detection methods for comprehensive malware analysis.

Conclusions:

• The proposed hybrid system offers a robust solution for detecting and classifying Android malware, including zero-day threats.
• The system's effectiveness is validated by its low false positive and negative rates and high classification accuracy.
• Cloud-based deployment is recommended due to the intensive computational resources required for static and dynamic analysis, enabling accessibility for app stores and users.