Mining nested flow of dominant APIs for detecting android malware

Basit Öğe Kaydı
dc.authoridAlam, Shahid/0000-0002-4080-8042
dc.authoridAlharbi, Soltan/0000-0002-5694-1569
dc.authoridYILDIRIM, Serdar/0000-0003-3151-9916
dc.contributor.authorAlam, Shahid
dc.contributor.authorAlharbi, Soltan Abed
dc.contributor.authorYildirim, Serdar
dc.date.accessioned2025-01-06T17:36:21Z
dc.date.available2025-01-06T17:36:21Z
dc.date.issued2020
dc.description.abstractAccording to the Kaspersky Lab threat report, mobile malware attacks almost doubled in 2018. A study conducted in 2018 by Accenture found malware attacks to be the most expensive to resolve. Android Operating System (OS) is the most dominating platform on mobile devices. This makes Android OS susceptible to malware attacks. We need to develop new techniques and methods to stop this influx of malware attacks. In this paper, we propose a novel technique named DroidDomTree that mines the dominance tree of API (Application programming interface) calls to find similar patterns in Android applications for detecting malware. Dominance is a transitive relation. A dominance tree of API calls highlights a strong flow of path and identifies the nesting structure of APIs and hence emphasizes the importance of certain APIs in an application. It also helps in finding modules and their interaction in an application. If a malicious module is embedded in an application, then this provides strong evidence that the application contains malware. We use these properties and develop a nested model of the dominance tree of API calls and a new scheme for assigning weights to each node in the dominance tree for efficient feature selection. During 10-fold cross-validation, with eight different classifiers using real malware Android applications, DroidDomTree achieved detection rates in the range of 98.1%-99.3% and false positive rates in the range of 1.7%-0.4%. (C) 2019 Elsevier B.V. All rights reserved.
dc.identifier.doi10.1016/j.comnet.2019.107026
dc.identifier.issn1389-1286
dc.identifier.issn1872-7069
dc.identifier.scopus2-s2.0-85075573635
dc.identifier.scopusqualityQ1
dc.identifier.urihttps://doi.org/10.1016/j.comnet.2019.107026
dc.identifier.urihttps://hdl.handle.net/20.500.14669/1830
dc.identifier.volume167
dc.identifier.wosWOS:000510524600011
dc.identifier.wosqualityQ1
dc.indekslendigikaynakWeb of Science
dc.indekslendigikaynakScopus
dc.language.isoen
dc.publisherElsevier
dc.relation.ispartofComputer Networks
dc.relation.publicationcategoryMakale - Uluslararası Hakemli Dergi - Kurum Öğretim Elemanı
dc.rightsinfo:eu-repo/semantics/closedAccess
dc.snmzKA_20241211
dc.subjectAndroid
dc.subjectMalware analysis and detection
dc.subjectDominance tree
dc.subjectAPI Calls
dc.subjectMachine learning
dc.titleMining nested flow of dominant APIs for detecting android malware
dc.typeArticle

Dosyalar

Koleksiyon

WoS İndeksli Yayınlar Koleksiyonu
Scopus İndeksli Yayınlar Koleksiyonu