A Malware Behavior Detection System of Android Applications Based on Multi-Class Features
Hua Yang · Chinese Journal of Computers · 2014
At present,data mining algorithm is always used to detect unknown malicious applications of Android.While single data mining algorithm could not play the role of multi-class Android features in malware detection.For this problem,a Triple Hybrid Ensemble Algorithm(THEA)was first proposed,which considered multi-class Android features.First,we combined the static and dynamic methods to extract three classes of Android features,which could reflect malicious behavior effectively,such as components,function calls and system calls.Second,we designed THEA to build optimal classifier by handling three classes of features and then made a comprehensive judgment of unknown Android application.Finally,we implemented an automated tool named Androdect to detect 1126malicious and 2000non-malicious apps in real.The experimental results show that Androdect plays the role of multi-class Android features in unknown malware detection and it performs better than other related works on the availability,efficiency and accuracy.