Detecting and classifying method based on similarity matching of Android malware behavior with profile

Area of Science:

• Computer Science
• Cybersecurity
• Mobile Security

Background:

• Mobile security threats are rising with increased mobile technology use.
• Existing mobile malware detection methods (static, dynamic, on-device, off-device) have limitations like evasion, cost, or connectivity requirements.

Purpose of the Study:

• To introduce Andro-profiler, a hybrid behavior-based analysis and classification system for mobile malware.
• To enhance efficiency, scalability, and accuracy in mobile malware detection.

Main Methods:

• Andro-profiler extracts behavior profiles from integrated system logs, including system calls, using an emulator.
• It analyzes system logs to create human-readable behavior profiles.
• A weighted similarity matching technique compares application profiles against known malware family profiles.

Main Results:

• Andro-profiler demonstrates scalability and high performance in malware detection and classification.
• Achieved an accuracy rate exceeding 98%, surpassing current state-of-the-art techniques.
• Successfully identified 0-day mobile malware samples.

Conclusions:

• Andro-profiler offers an effective and efficient solution for mobile malware analysis and classification.
• The hybrid approach addresses shortcomings of existing methods, providing robust security.
• The system's accuracy and ability to detect novel threats make it a valuable tool in mobile security.