A paper presents a new technique for the mobile malware detection based on the malware's network features analysis is proposed. It uses SVM for malicious programs detection. The novel approach provides the ability to detect malware in the mobile devices. As the inference engine for malware detection the support vector machine was used. The detection process is performed by taking into account the malware's features, captured in the mobile devices. Experimental research showed that the SVMs are able to produce the accurate classification results. Experiments demonstrated, that technique is able to detect different types of malware up to 98.21%.
Last year the threats against mobile devices in particular backdoors, malicious
cryptomining, banking trojans, especially during the second half of 2018, were growing
[
Today variety of approaches to identify of android malware is widely present on the literature.
A malware detection technique called Personal Mobile Malware Guard – PMMG
that classifies malwares based on the mobile user feedback is presented in [
Similar to above mentioned except permission, approach that use a combination of
permissions and intents supplemented with multiple stages of classifiers for malware
detection is proposed in [
In work [
In [
Another static approach for android malware detection that uses multiple features
to analyze is presented in [
Authors in [
The framework TriFlow that use a triage mechanism to rank applications
considering their potential risk is developed [
The literature review has shown that the problem of android malware detection is extremely actuals. However considered approaches have some common disadvantages which are manifested in ignoring packed malware and impossibility to protect the device from Zero Day attacks and malwares capable of modifying themselves.
In [
The mentioned above methods of the malware detection in the mobile devices have shown a high level of effectiveness, but also demonstrate high rate of false positives.
The common weakness of the aforementioned approaches is the requirement of large amounts of computing resources and the fact that they aren’t able to respond adaptively to known and unknown attacks performed by malware against the mobile devices. 3
The support vector machines (SVMs) are the high-potential approach for the object
classification. SVMs are the supervised learning models with associated learning
algorithms [
Basically, SVM performs classification by finding the hyperplane that maximizes the margin between two classes. Vectors (cases) that define the hyperplane are the support vectors. To define an optimal hyperplane we need to maximize the width of the margin: w x b 0, (1) plane, b is the basis and
|| w ||
the origin, with || w || the Euclidean norm of w [
is the perpendicular distance from the hyperplane to
Let be a mapping function which projects the training data into a Hilbert high dimensional space H, : Rq H . The data point x is represented in space H as (x) .
In the context of SVM, the kernel function defines the hypothesis space, and is defined as: where xi is a training data.
It leads to decision functions of the following form:
K (x, xi ) ( (x) (xi )),
r f (x) sgn i i K (x, xi ) b ,
i1 where i , i 1,..., r are Lagrange multipliers, the maximal magnitude of which is governed by C.
In order to compute the separating hyperplane without explicitly carrying out the
mapping into the feature space, different kernel functions can be used [
The linear kernel is the simplest kernel function. It is given by the inner product (x, xi ) plus an optional constant c:
K (x, xi ) xT xi c, c R.
K (x, xi ) e 21 2 ||(xxi )||2 , 0,
K (x, xi ) e 21 2 ||(x xi )||. (2) (3) (4) (5) (6) (7)
The polynomial kernel is a non-stationary kernel, where the adjustable parameters are the slope α, the constant term c and the polynomial degree p:
K (x, xi ) (xT xi c) p , R, c R, p N.
The Gaussian kernel is an example of radial basis function kernel: where σ is the parameter that controls the width of the Gaussian kernel.
The exponential kernel is closely related to the Gaussian kernel, with only the square of the norm left out. It is also a radial basis function kernel:
The B-Spline is a radial basis function kernel, and is defined on the interval
[
K (x, xi ) B2 p1(x xi ), where p N with Bi1 : Bi B0 (8)
In order to perform the multi-class classification, the ”one against all” and ”one
against one” SVM-based methods are used [
In order to perform the classification for xi , we use k decision functions, where k is the number of classes:
(wi )T (xi ) bi , where i 1,...,k, where – is the mapping function, : Rq H.
The data xi then belongs to class a, for which the above decision function has the
largest value:
(9)
(10)
a arg max xi1,...,k ((wi )T (xi ) bi ).
”One Against One” SVM Classifier. The proposed technique uses the ”one against
one” SVM classification method as well. Here, k (k 1) / 2 classifiers are to be
constructed for each pair of classes and the max-win strategy is to be followed.
Specifically, if sqn(w jl )T (xi ) b jl evaluates xi to be in j-th class, then the vote for the j-th
class is incremented by one, else that for the l-th class is increased by one. Finally, the
training data vector xi is predicted to belong to the class with maximum number of
votes [
Taking into account the advantages of the SVM, it can be used as the inference engine for the making the decision about the presence of the malware in the mobile devices. 4
We propose a new technique for the mobile malware detection. An approach presents the SVM-based system for malware detection with the ability to classify the malicious program and blocking them.
The proposed approach includes learning and detection stages. The learning stage consists of the following steps:
1. Knowledge formation based on the features that may indicate the mobile malware presence.
2. Presentation of the knowledge about the mobile malware behavior as a set of feature vectors.
3. Formation the set of mobile malware classes using SVM.
The monitoring stage consists of the following steps: 1. Gathering the features in the mobile device, which may indicate the mobile malware presence.
2. Construction of the feature vectors based on the obtained information. 3. The detecting stage involves the implementation of SVM classification of the obtained feature vectors in order to assign them to one of the mobile malware’s class. 4. The blocking of the malicious program execution.
Let us take a closer look at each step of the method. 4.1
Let us denote the set of malware’s classes as А ammNA1 , where a1 – the Trojans; a2
– the backdoors; a3 – the mobile botnets; a4 – the spammers; a5 – the spyware; a6
– smartphone trackers; a7 – the mobile proxy-servers; a8 – SMS malware; a9 – the
exploits; a10 – the rootkits; a11 – the Adware; a12 – the DDoS attackers, where N A –
the number of attacks, performed by DDoS botnets [
Let us denote the set of features, that may indicate mobile malware’s attacks against the device and are to be analyzed as B bj NjB1 , where N B – the number of features. The list of features is presented in Table 1. Let us denote the set of devices attacked by mobile malware as H hi iNH1 , where N H – the number of mobile devices. Thus, the function of the malware’s attack identifying f can be presented as: f : hi bj am . the global amount of anonymous mapping maps, i.e., the area of the virtual memory (all processes) not backed by any file the global amount of slab – a slab is the amount by which a cache can grow or shrink. the total amount of memory in swap and RAM the amount of application AUA memory shared with other processes, accounted in a way that the amount is divided evenly between the processes that share it the size portion of memory occupied by the application AUA that is held in RAM the set of pages that are unique for the application AUA the amount of information (expressed in kB) written on the storage by all the processes the amount of information (expressed in kB) read from storage by all the processes the number of bytes which are read from storage by the application AUA the number of bytes which are written into the storage by the application AUA the value represents the number of read I/O operations the value represents the number of write I/O operations the number of packets received by all the processes the number of packets transmitted by all the processes the number of bytes received by all the processes the number of bytes transmitted by all the processes the number of packets received by the application AUA the number of packets transmitted by the application AUA the number of bytes received by the application AUA the number of bytes transmitted by the application AUA the length of the domain name the number of unique characters in the domain name entropy of the domain name TTL-periods (mode, median, average value) the number of A-records corresponding to domain name in the incomig DNSmessage the number of IP-addresses concerned with the domain name the average distance between the IP-addresses concerned with domain name the average distance between the IP-addresses in the set of A-records for domain name in the incoming DNS-message number of unique IP-addresses in sets of A-records corresponding to the domain name in the DNS-messages FUR ER LP FS the average distance between unique IP-addresses in sets A-record corresponding to the domain name in the DNS-messages number of domain names that share IP-address corresponding to the domain name the sign of the usage of uncommon types of the DNS-records, or DNS-records that are not commonly used by a typical client entropy of the DNS-records, which are contained in the DNS-messages maximum size of the DNS-messages about domain name the sign of success of DNS-query 4.2
All the above-mentioned features are the base of the set of feature vectors X xk kNX1 , where each of feature vector xk describes the botnet’ attack and the legitimate traffic, N X – the number of the feature vectors. 4.3
The main task of the SVM-based inference engine is to assign feature vector xi to class at at, where xi X , at A, A {at }tNA1 , N A – is the number of classes, where each class corresponds to one specified type of attacks, performed by malware. The SVM-based inference engine makes a conclusion about the presence or absence of a malware in the mobile device and detects the possible type of the malware. 5
In order to evaluate the effectiveness of the malware detection based on proposed method, experimental studies were conducted.
The experimental part of the study involved the solving of the following tasks: - to investigate the applicability of SVM for making decisions about the presence of malware in the mobile device;
- to evaluate the detection efficiency of the malware detection in the mobile devices. 5.1
In order to evaluate the technique’s, a detection accuracy tests using malware’s
samples were conducted. For this purpose, a mobile malware datasets [
To retrieve information about the CPU consumption the top tool, which is able to provide an overview of the CPU activity in real time, was used.
To extract the features concerning the memory resource usage, system monitoring tool vmstat and procrank tool were used.
Since the tracking of the input-output activity information is disabled by default to retrieve it the modification of the specific configuration file (depending on the kernel and on the architecture of the device) was perfected and the kernel was recompiled. With purpose of the collection of input-output activity information the iostat command was used. To extract the features related to the use of the network, the means of open source tool Android Device Monitor was used.
Support vector machine was implemented using Matlab [
The experimental results were estimated via standard sensitivity (SN), specificity (SP), and overall accuracy (Q) performance measures, taking into account the quantity measures of True Positives (TP), True Negatives (TN), False Positives (FP), False Negatives (FN):
SN
TP (TP FN ) , SP
TN (TN FP) , Q
TP TN TP TN FP FN .
(11)
In order to investigate the SVM-based inference engine efficiency we used different SVM kernel functions. Examples of classification results using linear, polynomial, Gaussian, exponential, and B-Spline kernels are presented in Fig. 1.
The process of classification is divided into several iterations.
In the first iteration, the classification objects are divided into two classes: malicious behavior and the benign one. Then classifiers divide objects into other two classes, for instance: malicious behavior and spam bot. The next iterations separate malicious behavior and other classes of malware and so on until all of them are totally divided.
Fig. 1 presents the placement of the classification objects on the 2-D plane and the objects’ separation into two classes.
Experimental results of different SVM classifiers elucidated that the linear and polynomial classifiers had provided the worst results (Table 2). They were characterized by longer execution times, and higher rates of the overall classification accuracy.
Non-linear classifiers demonstrated better results, where B-Spline provided better results than others did.
For an experimental evaluation samples, the most effective classifier using the
SVM was the B-spline since it provided the greatest distance between hyperplanes,
the shortest time of evaluation, and the best accuracy of the classification. Given that,
it was employed as a basic kernel function in the SVM-based inference engine of the
proposed technique.
This subsection presents overall results of technique’s efficiency, taking into account
sensitivity, specificity, and the overall accuracy. Employing the datasets [
In order to increase the classification accuracy the SVM prediction may be further improved by using different classification kernels, as well as the SVM optimization procedure and new mobile malware classes (and its feature vector selection) may also be improved.
Results of the experiments demonstrated, that the technique achieves the best results for detection of such mobile malware as DDoS, spyware, SMS malware, botnets, etc.
At the same time, the efficiency of the system concerning rootkits is rather lower. This is because the behavior of some malware is very similar to users’ ones and some of malware’s features weren’t taken into account for the detection process. 7
A new technique for the mobile malware detection based on the malware’s network features analysis is proposed. It uses SVM for malicious programs detection. The novel approach provides the ability to detect malware in the mobile devices.
As the inference engine for malware detection the support vector machine was used. The detection process is performed by taking into account the malware’s features, captured in the mobile devices.
Experimental research showed that the SVMs are able to produce the accurate classification results. Implementation of the SVM-based inference engine into the mobile malware’s detection process allowed to obtain its mean detection accuracy up to 98.01%. Experiments demonstrated, that technique is able to detect different types of malware in the range from 90.28 to 98.21%, while false positives is about 5%. 8