book

Intelligent Mobile Malware Detection

Name: Intelligent Mobile Malware Detection
ISBN: 9781000824988

by Tony Thomas, Roopak Surendran, Teenu John, Mamoun Alazab

December 2022

Intermediate to advanced

190 pages

4h 56m

English

CRC Press

Read now

Unlock full access

Cover Page
Half-Title Page
Series Page
Title Page
Copyright Page
Contents
Preface
Acknowledgements
About the Authors
Symbols

1 Internet and Android OS
1.1 Android OS1.1.1 Linux kernel1.1.2 Native libraries1.1.3 Android runtime1.1.4 Application framework1.1.5 Application layer1.2 Android Application Development1.3 Google Playstore1.4 Intents and Intent Filters1.5 Android Security1.5.1 Permissions1.5.2 Application sandbox1.5.3 Application signature1.5.4 Data encryption1.6 Internet of Things1.6.1 Architecture of IoT1.6.1.1 Sensor layer1.6.1.2 Gateways and networks1.6.1.3 Management service layer1.6.1.4 Application layer1.7 Android Things1.8 IoT Security1.8.1 Malware Threats in IoT1.9 Conclusion
2 Android Malware
2.1 PC Malware vs. Android Malware2.2 Trends in Malware2.2.1 Trends in Windows malware2.2.2 Trends in Android malware2.3 Types of Malware Detection Mechanisms2.4 Malware Types2.5 Malware Attacks in Android2.5.1 Drive by download attack2.5.2 Update attack2.5.3 Repacking attack2.6 History of Malware Attacks in Android2.7 Conclusion
3 Static Malware Detection
3.1 Reverse Engineering and Static Analysis3.1.1 Reverse engineering using Apktool and Dex2jar3.1.2 Static malware analysis tools3.2 Components of Android Application3.3 API Call Analysis3.3.1 API's used by malware applications3.4 API Call-Based Static Detection3.4.1 Mechanisms using the independent occurrence of API3.4.2 Mechanisms Using API Call Graphs3.5 Permission and Intent-Based Static Detection3.5.1 Permission analysis3.5.1.1 Permissions used by the malware applications3.5.1.2 Component-based permission escalation attack3.5.2 Intent-based analysis3.5.2.1 Intents used for malware attacks3.5.2.2 Intent-based vulnerabilities3.5.3 Malware detection using permissions and intents3.6 Opcode-Based Static Detection3.6.1 Malware detection using opcodes3.7 Conclusion
4 Dynamic and Hybrid Malware Detection
4.1 Emulator-Based Dynamic Analysis4.2 Dynamic Malware Detection Mechanisms4.2.1 System metric and traffic analysis (Category 1)4.2.2 Network packet analysis (Category 2)4.2.3 Sensitive API call analysis (Category 3)4.2.4 System call analysis (Category 4)4.2.4.1 System call frequency or TF-IDF-based methods4.2.4.2 System call dependency graph or markov chain-based methods4.2.4.3 System call phylogeny-based methods4.2.4.4 System call behavior or sequence analysis-based methods4.3 Hybrid Analysis4.3.1 Hybrid detection based on a single classifier (Category 1)4.3.2 Hybrid detection based on ensemble classifiers (Category 2)4.4 Correlation Among Static and Dynamic Features4.4.1 Tree augmented Naive Bayes (TAN) model4.5 Hybrid Analysis with TAN Classifier4.5.1 Dependencies among API calls, permission and system calls4.5.2 Ridge regularized logistic regression (RRLR)4.5.3 Probability estimation4.5.4 Anomaly detection4.5.4.1 App permission analysis4.5.4.2 Static API function call analysis4.5.4.3 System call analysis4.5.5 Malware detection using TAN-based model4.6 Experiments and Analysis4.6.1 Training phase4.6.1.1 Estimation of threshold for L1,L2,L34.6.1.2 Conditional probability estimation4.6.2 Evaluation phase4.7 Conclusion
5 Detection Using Graph Centrality Measures
5.1 Digraph from System Call Sequence5.2 Centrality Measures from System Call Digraph5.3 Malware Detection Phase5.4 Experiments and Analysis5.4.1 Dataset5.4.2 Performance results5.5 Conclusion
6 Graph Convolutional Network for Detection
6.1 Introduction to GCN6.2 GCN-Based Malware Detection6.2.1 System call graph construction6.2.2 GCN for low dimensional feature representation6.2.3 Training of GCN6.2.4 System call graph classification using GCN6.3 Experiments and Analysis6.3.1 Implementation details6.4 Detection of Emerging Malware6.5 Conclusion
7 Graph Signal Processing-Based Detection
7.1 Graph Signal Processing and Its Applications7.2 Graph Signals from System Call Sequence7.3 Machine Learning Classification for Malware Detection7.3.1 Construction of low-dimensional feature vectors7.4 Experiments and Analysis7.4.1 Experimental setup7.4.2 Performance analysis with various ML classifiers7.5 Miscellaneous Operations on Graph Signals7.6 Conclusion
8 System Call Pattern-Based Detection
8.1 Extraction of Patterns From System Call Sequences8.1.1 Representing system call sequence as ergodic Markov chain8.1.2 Computation of information in system call sequence8.1.3 Identification of system call patterns8.2 System call patterns in Walkinwat trojan8.3 Malware Detection and Classification Based on System Call Patterns8.4 Experiments and Analysis8.5 Conclusion
9 Conclusions and Future Directions
9.1 Recent Malware Attacks9.2 Identifying Exploitation Attacks9.3 Mitigating Emulator Evasion and Code Coverage Problem9.4 Resilience to the Change in System Call Sequence9.5 Collusion Attack
Appendix
Bibliography
Index

Content preview from Intelligent Mobile Malware Detection

Symbols

α	Attenuation factor
β	Damping factor
γ	Penalty value
δ	Regression parameter
λ	Largest eigen value of the adjacency matrix
ϵ	Information distance value
μ	Stationary distribution
$P r (.)$	Probability
$H (.)$	Entropy
$A$	Permission-based feature vector
$B$	API call-based feature vector
$C$	System call frequency-based feature vector
$D$	Labeled dataset
$E$	Label of an application
$L_{1}$	API call classifier
$L_{2}$	Permission classifier
$L_{3}$	System call classifier
$T_{1}$	Threshold for $L_{1}$
$T_{2}$	Threshold for $L_{2}$
$T_{3}$	Threshold for $L_{3}$
$T$	Threshold for TAN model
$Z_{1}$	Output of $L_{1}$
$Z_{2}$	Output of $L_{2}$
$Z_{3}$	Output of $L_{3}$
$K (.)$	Katz centrality
$C_{1} (.)$	Eigen vector centrality
$P C_{2} (.)$	Betweenness centrality
$C_{3} (.)$	Closeness centrality
$P (.$

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Hardening Your Macs: Keeping Apple Computers Safe at the Hardware and Software Level

Publisher Resources

ISBN: 9781000824988

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Intelligent Mobile Malware Detection

by Tony Thomas, Roopak Surendran, Teenu John, Mamoun Alazab

Symbols

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.