Frequent Subgraph Based Familial Classification of Android Malware

Ming Fan, Jun Liu, Xiapu Luo, Kai Chen, Tianyi Chen, Zhenzhou Tian, Xiaodong Zhang, Qinghua Zheng, Ting Liu

Research output: Chapter in book / Conference proceedingConference article published in proceeding or bookAcademic researchpeer-review

36 Citations (Scopus)

Abstract

The rapid growth of Android malware poses great challenges to anti-malware systems because the sheer number of malware samples overwhelm malware analysis systems. A promising approach for speeding up malware analysis is to classify malware samples into families so that the common features in malwares belonging to the same family can be exploited for malware detection and inspection. However, the accuracy of existing classification solutions is limited because of two reasons. First, since the majority of Android malware is constructed by inserting malicious components into popular apps, the malware's legitimate part may misguide the classification algorithms. Second, the polymorphic variants of Android malware could evade the detection by employing transformation attacks. In this paper, we propose a novel approach that constructs frequent subgraph (fregraph) to represent the common behaviors of malwares in the same family for familial classification of Android malware. Moreover, we propose and develop FalDroid, an automatic system for classifying Android malware according to fregraph, and apply it to 6,565 malware samples from 30 families. The experimental results show that FalDroid can correctly classify 94.5% malwares into their families using around 4.4s per app.
Original languageEnglish
Title of host publicationProceedings - 2016 IEEE 27th International Symposium on Software Reliability Engineering, ISSRE 2016
PublisherIEEE Computer Society
Pages24-35
Number of pages12
ISBN (Electronic)9781467390019
DOIs
Publication statusPublished - 5 Dec 2016
Event27th IEEE International Symposium on Software Reliability Engineering, ISSRE 2016 - Ottawa, United States
Duration: 23 Oct 201627 Oct 2016

Conference

Conference27th IEEE International Symposium on Software Reliability Engineering, ISSRE 2016
CountryUnited States
CityOttawa
Period23/10/1627/10/16

Keywords

  • Android malware
  • clustering
  • familial classification
  • frequent subgraph
  • sensitive API

ASJC Scopus subject areas

  • Software
  • Safety, Risk, Reliability and Quality

Cite this