Android Malware Similarity Clustering using Method based Opcode Sequence and Jaccard Index
Shinho Lee, Wookhyun Jung, Sangwon Kim, Eui Tak Kim · 2019
Recently, Android malicious code shows a trend to spread a large number of variants in a short time. This type of malicious code is mainly produced by reusing existing code, and the number of malicious codes has increased year by year despite the increased security of the OS. In this paper, we propose a clustering and classification method for Android malicious codes using a similarity algorithm in a lightweight manner. In this paper, among the APK internal files, Dex file is disassembled to extract Opcode Sequence in Method unit, and clustered similar Android malicious code with Jaccard Index using N-gram. Clustering results of Android malicious code collected in 1Q 2019 are presented and analyzed.