N-opcode analysis for android malware classification and categorization

BooJoong Kang; Suleiman Y. Yerima; Kieran McLaughlin; Sakir Sezer

doi:10.1109/CyberSecPODS.2016.7502343

N-opcode analysis for android malware classification and categorization

BooJoong Kang, Suleiman Y. Yerima, Kieran McLaughlin, Sakir Sezer

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

91 Citations (Scopus)

511 Downloads (Pure)

Abstract

Malware detection is a growing problem particularly on the Android mobile platform due to its increasing popularity and accessibility to numerous third party app markets. This has also been made worse by the increasingly sophisticated detection avoidance techniques employed by emerging malware families. This calls for more effective techniques for detection and classification of Android malware. Hence, in this paper we present an n-opcode analysis based approach that utilizes machine learning to classify and categorize Android malware. This approach enables automated feature discovery that eliminates the need for applying expert or domain knowledge to define the needed features. Our experiments on 2520 samples that were performed using up to 10-gram opcode features showed that an f-measure of 98% is achievable using this approach.

Original language	English
Title of host publication	Cyber Security: Proceedings of the 2016 International Conference on Cyber Security and Protection of Digital Services
Place of Publication	United Kingdom
Publisher	Institute of Electrical and Electronics Engineers Inc.
Number of pages	7
ISBN (Electronic)	978-1-5090-0709-7
ISBN (Print)	978-1-5090-0710-3
DOIs	https://doi.org/10.1109/CyberSecPODS.2016.7502343
Publication status	Published - 11 Jul 2016
Event	Cyber Security and Protection of Digital Services - London, United Kingdom Duration: 13 Jun 2016 → 14 Jun 2016

Conference

Conference	Cyber Security and Protection of Digital Services
Abbreviated title	Cyber Security
Country/Territory	United Kingdom
City	London
Period	13/06/2016 → 14/06/2016

Access to Document

10.1109/CyberSecPODS.2016.7502343Licence: Unspecified

N-opcode Analysis for Android Malware Classification and Categorization
© 2016 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
Accepted author manuscript, 381 KBLicence: Unspecified

Cite this

@inproceedings{6fe45281f3024df89ccc2acfe0059b38,

title = "N-opcode analysis for android malware classification and categorization",

abstract = "Malware detection is a growing problem particularly on the Android mobile platform due to its increasing popularity and accessibility to numerous third party app markets. This has also been made worse by the increasingly sophisticated detection avoidance techniques employed by emerging malware families. This calls for more effective techniques for detection and classification of Android malware. Hence, in this paper we present an n-opcode analysis based approach that utilizes machine learning to classify and categorize Android malware. This approach enables automated feature discovery that eliminates the need for applying expert or domain knowledge to define the needed features. Our experiments on 2520 samples that were performed using up to 10-gram opcode features showed that an f-measure of 98% is achievable using this approach.",

author = "BooJoong Kang and Yerima, {Suleiman Y.} and Kieran McLaughlin and Sakir Sezer",

year = "2016",

month = jul,

day = "11",

doi = "10.1109/CyberSecPODS.2016.7502343",

language = "English",

isbn = "978-1-5090-0710-3",

booktitle = "Cyber Security: Proceedings of the 2016 International Conference on Cyber Security and Protection of Digital Services",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

address = "United States",

note = "Cyber Security and Protection of Digital Services, Cyber Security ; Conference date: 13-06-2016 Through 14-06-2016",

}

Kang, B, Yerima, SY, McLaughlin, K & Sezer, S 2016, N-opcode analysis for android malware classification and categorization. in Cyber Security: Proceedings of the 2016 International Conference on Cyber Security and Protection of Digital Services. Institute of Electrical and Electronics Engineers Inc., United Kingdom, Cyber Security and Protection of Digital Services, London, United Kingdom, 13/06/2016. https://doi.org/10.1109/CyberSecPODS.2016.7502343

N-opcode analysis for android malware classification and categorization. / Kang, BooJoong; Yerima, Suleiman Y.; McLaughlin, Kieran et al.
Cyber Security: Proceedings of the 2016 International Conference on Cyber Security and Protection of Digital Services. United Kingdom: Institute of Electrical and Electronics Engineers Inc., 2016.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - N-opcode analysis for android malware classification and categorization

AU - Kang, BooJoong

AU - Yerima, Suleiman Y.

AU - McLaughlin, Kieran

AU - Sezer, Sakir

PY - 2016/7/11

Y1 - 2016/7/11

N2 - Malware detection is a growing problem particularly on the Android mobile platform due to its increasing popularity and accessibility to numerous third party app markets. This has also been made worse by the increasingly sophisticated detection avoidance techniques employed by emerging malware families. This calls for more effective techniques for detection and classification of Android malware. Hence, in this paper we present an n-opcode analysis based approach that utilizes machine learning to classify and categorize Android malware. This approach enables automated feature discovery that eliminates the need for applying expert or domain knowledge to define the needed features. Our experiments on 2520 samples that were performed using up to 10-gram opcode features showed that an f-measure of 98% is achievable using this approach.

AB - Malware detection is a growing problem particularly on the Android mobile platform due to its increasing popularity and accessibility to numerous third party app markets. This has also been made worse by the increasingly sophisticated detection avoidance techniques employed by emerging malware families. This calls for more effective techniques for detection and classification of Android malware. Hence, in this paper we present an n-opcode analysis based approach that utilizes machine learning to classify and categorize Android malware. This approach enables automated feature discovery that eliminates the need for applying expert or domain knowledge to define the needed features. Our experiments on 2520 samples that were performed using up to 10-gram opcode features showed that an f-measure of 98% is achievable using this approach.

U2 - 10.1109/CyberSecPODS.2016.7502343

DO - 10.1109/CyberSecPODS.2016.7502343

M3 - Conference contribution

SN - 978-1-5090-0710-3

BT - Cyber Security: Proceedings of the 2016 International Conference on Cyber Security and Protection of Digital Services

PB - Institute of Electrical and Electronics Engineers Inc.

CY - United Kingdom

T2 - Cyber Security and Protection of Digital Services

Y2 - 13 June 2016 through 14 June 2016

ER -

N-opcode analysis for android malware classification and categorization

Abstract

Conference

Access to Document

Fingerprint

Cite this