Abstract:
Android has now become the most widely used operating system for smartphones in the world. This rapid increase in the use of Android both for smartphones and tablets along with its open source nature has motivated malware authors to write highly sophisticated malware for Android operating system. A lot of work has been carried out by security researchers to counter the effect caused by growing amount of malware.
In this research, a new algorithm for static analysis of Android applications has been proposed that checks an application for maliciousness on the basis of application features and not signatures, as the latter is inefficient in detecting zero day malware. Various features of an Android application, e.g. sending SMS, accessing internet, uploading files, accessing Wi-Fi, have been found out which when occur in different combinations along with other features aid in constituting malicious rules. Hence a rule is combination of multiple features which if exist in an application, tend to show malicious behavior. A set of 958 malicious and 816 benign applications were analyzed against all rules and only those rules were selected for the algorithm whose probability of occurrence was significantly higher in malicious applications than in benign. The Least significant difference between the probabilities of occurrence in malicious and benign applications was computed and Gaussian distribution with 5% level of significance was used to accept rules whose arithmetic difference was greater than the least significance distance. The algorithm has also been supported with a proof of concept application written in C language supported with a Graphical User interface written in Microsoft Foundation Class Library.
The proposed algorithm has been tested on another 247 malicious and 768 benign applications and yields the accuracy of 98.32% and specificity of 99.6% with low false positive ratio. The algorithm shows better results than other related algorithms for countering Android malware. The computational complexity of the algorithm is exceptionally low, thus making it suitable for analyzing applications.
