Source-linked AI summary
Detecting and Classifying Android Malware using Static Analysis along with Creator Information
Hyunjae Kang, Jae-wook Jang, Aziz Mohaisen, Huy Kang Kim
TL;DR
Android malware research had largely overlooked creator information despite evidence that a small number of certificates sign many malware samples. The paper combines certificate serial numbers with static behavioral and permission analysis, then uses similarity scoring for family classification, achieving 98% detection accuracy and 90% malware-family classification accuracy.
Problem
Prior Android malware detection and classification studies overlooked creator information, although only 4% of malware-associated certificates signed 70% of malware samples.
Method
The system uses certificate serial numbers with static analysis of suspicious APIs, behaviors, and permissions, and classifies malware through similarity scoring.
Results
98% detection accuracy and 90% accuracy classifying 20 malware families were achieved.
Takeaways & Limitations
The system supports fast Android malware detection and classification, processing malware in 72 seconds per megabyte.
Takeaways & Limitations
Classification performance was low for some families because overlapping malicious behaviors caused samples to be assigned to other families.
Abstract
from arXiv · showhide
Thousands of malicious applications targeting mobile devices, including the popular Android platform, are created every day. A large number of those applications are created by a small number of professional under-ground actors, however previous studies overlooked such information as a feature in detecting and classifying malware, and in attributing malware to creators. Guided by this insight, we propose a method to improve on the performance of Android malware detection by incorporating the creator's information as a feature and classify malicious applications into similar groups. We developed a system that implements this method in practice. Our system enables fast detection of malware by using creator information such as serial number of certificate. Additionally, it analyzes malicious be-haviors and permissions to increase detection accuracy. The system also can classify malware based on similarity scoring. Finally, we showed detection and classification performance with 98% and 90% accuracy respectively.
1 Introduction
Android malware is expanding rapidly, while prior detection and classification work largely overlooked creator information. The paper addresses this gap with certificate-based creator features combined with static behavioral and permission analysis, plus similarity-based family classification.
- 2.47 million new mobile malware samples were collected in 2013, bringing the total to 3.73 million, nearly 200% above 2012.
- Android is a primary malware target because it has the largest mobile user base and permits easy malware distribution or repackaging.
- Permission-only static analysis has accuracy limits, motivating analysis of additional features such as APIs alongside dynamic-analysis approaches.
- Only 4% of malware-associated certificates signed 70% of the malware samples, supporting creator information as a useful detection and attribution feature.
- The proposed system combines certificate serial numbers, static behavior and permission analysis, and similarity scoring to detect and group Android malware.
- 51,179 benign and 4,554 malware applications were evaluated; fewer than 1% were incorrectly determined, and malware-family classification reached 90% accuracy.
2 Related Works
Prior Android malware research uses static, dynamic, and hybrid analysis, but permission-based methods face accuracy limitations because Android's permission architecture permits unnecessary requests.
- Static analysis examines application code without execution, whereas dynamic analysis observes runtime behavior but may miss unexecuted code.
- Permission-based static methods assess requested resources and actions, including through predefined rules and risk-scoring models.
- Permission-based malware detection has low accuracy partly because Android permits developers to request unnecessary permissions, distorting permission distributions.
- Dynamic systems detect behaviors through exploit-code checks, monitoring, system-call logging, sensitive-API observation, and behavior profiling.
- Hybrid approaches combine permission-based behavioral footprints with heuristic filtering, including monitoring dynamic code loading for unknown families.
3.1 Android platform and malware
The paper profiles Android applications through their component structure, suspicious APIs, permissions, certificate metadata, and malware behavior categories. These features support static analysis and creator-oriented malware detection.
- Android applications consist of activities, services, broadcast receivers, and content providers that communicate through intents.Activities provide user interfaces, services run in the background, broadcast receivers respond to system signals, and content providers share data between applications.
- The system focuses on suspicious APIs associated with device or user information, websites, SMS operations, and application installation.
- Android permissions inform users about application actions and resource access, and prior work identified 26 permissions risky to security and privacy.
- Application creators sign packages with private keys, while certificates contain unique serial numbers that can identify whether certificates are the same.
- Malware behavior categories include privilege escalation, remote control, financial charge, and information collection.
3.2 Detecting and classifying malware
The system combines certificate serial numbers, application behaviors, permissions, and extracted malware features to detect Android malware and classify detected samples by similarity.
- System architecture: The parser extracts certificate information, APIs, permissions, commands, and intents before detector and classifier modules analyze the application.Parsed data and module outputs are updated in a shared database.
- Serial number blacklist: 622 certificate serial numbers were observed, with 24 comprising 70% of samples and five signing 50% of malware samples.The analysis found that some serial numbers were reused across multiple malware families or variants.
- Serial number blacklist: The blacklist contained 136 serial numbers after excluding serial numbers associated with only one malware family or variant and a standard test key.Serial numbers associated with more than two malware families or variants were included.
- Likelihood ratio of permission: Permission likelihoods are calculated from critical permissions in benign and malicious samples, with Laplace estimation preventing zero conditional probabilities.The permission distribution is presented for requested and API-related permission categories.
- Malware detection: The detection algorithm checks blacklisted certificate serial numbers, suspicious APIs, malicious system commands, SMS-hiding behavior, sensitive-data access, and permission-based likelihoods.The certificate blacklist enables fast initial scanning, while additional behavioral and permission checks reduce over-detection and address permission-only limitations.
- Similarity scoring and malware classification: Malware similarity scoring combines suspicious API strings, malicious commands, and critical permissions, using equal weights and API-sequence alignment.Suspicious API strings are represented in parsed order, and their similarity is calculated with the Needleman-Wunsch algorithm.
4 Experiment Results and Discussion
The system was evaluated with five-fold cross-validation for serial-number analysis, malware detection, and family classification. It achieved high overall detection and classification performance, while classification errors remained concentrated among malware families with overlapping behaviors.
- Evaluation setup: Five-fold cross-validation divided samples into five equal subsamples and averaged the five test results to compute accuracy.Each fold used one subsample for testing while the remaining subsamples supported evaluation.
- Serial-number analysis: In 620 serial numbers, 484 generated one malware family or variant, while 136 generated multiple families or variants.The two excluded test keys could not indicate a specific malware creator.
- Detection results: 423 benign applications, or 0.83% of benign applications, were detected as malware, while only nine malicious samples were false negatives.The authors describe the detection rule as somewhat loose because it reduces false negatives while increasing false positives.
- Classification results: 98% total classification accuracy and 90% average malware classification accuracy were obtained across the evaluated categories.Some categories were classified accurately, whereas others were confused because malicious behaviors overlapped.
- Performance evaluation: Removing the serial-number blacklist retained 98% detection accuracy but increased analysis time from 400 to 579 seconds.The blacklist therefore made detection 30.9% faster with slightly enhanced accuracy.
- Performance evaluation: The system outperformed Crowdroid but had slightly lower accuracy than Andro-profiler, while operating at 72 seconds/MB compared with Andro-profiler’s 55 seconds/MB.The comparison used classification accuracy and processing speed.
5 Conclusion
The proposed static-analysis system uses certificate serial numbers alongside suspicious behaviors and permissions to detect and classify Android malware. It achieved 98% detection accuracy and 90% accuracy when classifying 20 malware families, while future work targets static-analysis limitations through dynamic analysis.
- 98% detection accuracy was achieved using certificate serial numbers, suspicious SMS-hiding behavior, malicious system commands, and suspicious permission requests.The system combines creator-related certificate information with behavioral and permission features.
- 90% accuracy was achieved when the classifier assigned samples to 20 kinds of malware families.The classifier is based on similarity among malware characteristics.
- The system detected and classified Android malware in 72 seconds/MB, supporting analysts’ responses in a reasonable time.
- Future work will add dynamic analysis to overcome the general drawback of a static-analysis-based system.