论文标题
使用系统调用对Android恶意软件的分析，检测和分类
Analysis, Detection, and Classification of Android Malware using System Calls
论文作者
论文摘要
在过去十年中Android的普及越来越多，Android在用户和攻击者中都受欢迎。大量的Android用户引起了对Android的攻击者的注意。由于Android恶意软件的多样性和攻击技术的不断发展，我们的检测方法也应需要更新。研究人员的大多数作品都是基于静态功能，很少关注动态功能。在本文中，我们通过使用系统调用来检测Android恶意软件来填补文献差距。我们正在使用模拟器来检测恶意软件的受监视和受控环境中运行恶意应用程序。在运行时，通过一些模拟事件激活恶意行为，以激活其敌对行为。分析了在应用程序运行时收集的日志，并将其馈送到不同的机器学习模型中，以进行恶意软件的检测和家庭分类。结果表明，k-nearthign和决策树分别在恶意软件检测和家庭分类方面具有最高的精度。
With the increasing popularity of Android in the last decade, Android is popular among users as well as attackers. The vast number of android users grabs the attention of attackers on android. Due to the continuous evolution of the variety and attacking techniques of android malware, our detection methods should need an update too. Most of the researcher's works are based on static features, and very few focus on dynamic features. In this paper, we are filling the literature gap by detecting android malware using System calls. We are running the malicious app in a monitored and controlled environment using an emulator to detect malware. Malicious behavior is activated with some simulated events during its runtime to activate its hostile behavior. Logs collected during the app's runtime are analyzed and fed to different machine learning models for Detection and Family classification of Malware. The result indicates that K-Nearest Neighbor and the Decision Tree gave the highest accuracy in malware detection and Family Classification respectively.
