N-Gram Opcode Analysis For Android Malware Detection

International Journal On Cyber Situational Awareness (IJCSA)

ISSN: (Print) 2057-2182 ISSN: (Online) 2057-2182

DOI: 10.22619/IJCSA

Published Semi-annually. Est. 2014

Editor-in-Chief:

Dr Cyril Onwubiko, Chair – Cyber Security & Intelligence, E-Security Group, Research Series, London, UK; IEEE UK & Ireland Section Secretary

Associate Editors:

Professor Frank Wang, Head of School / Professor of Future Computing, Chair IEEE Computer Society, UK&RI, School of Computing, University of Kent, Canterbury, UK

Dr Thomas Owens, Senior Lecturer & Director of Quality, Department of Electronic and Computer Engineering, Brunel University, London, UK

 

N-gram Opcode Analysis for Android Malware Detection

BooJoong Kang, Suleiman Y. Yerima, Sakir Sezer and Kieran McLaughlin

Abstract:

Android malware has been on the rise in recent years due to the increasing popularity of Android and the proliferation of third party application markets. Emerging Android malware families are increasingly adopting sophisticated detection avoidance techniques and this calls for more effective approaches for Android malware detection. Hence, in this paper we present and evaluate an n-gram opcode features based approach that utilizes machine learning to identify and categorize Android malware. This approach enables automated feature discovery without relying on prior expert or domain knowledge for pre-determined features. Furthermore, by using a data segmentation technique for feature selection, our analysis is able to scale up to 10-gram opcodes. Our experiments on a dataset of 2520 samples showed achieved an f-measure of 98% using the n-gram opcode based approach. We also provide empirical findings that illustrate factors that have probable impact on the overall n-gram opcodes performance trends.

Keyword: Android Malware, Malware Detection, Malware Categorization, Dalvik Bytecode, N-gram, Opcode, Feature Selection, Machine Learning.

ISSN: 2057-2182

Volume 1. No. 1

DOI: 10.22619/IJCSA.2016.1001011

Date: Nov. 2016

Reference to this paper should be made as follows: Kang, B., Yerima, Y. S., Sezer, S. & McLaughlin, K. (2016). N-gram opcode analysis for Android malware detection. International Journal on Cyber Situational Awareness, Vol. 1, No. 1, pp231-255.

PDF Download