ATSDetector: An Android Trojan spyware detection approach with multi-features

• Published in: Computers & security 2025-03, Vol.150, p.104219, Article 104219
• Main Authors: Wang, Siyu, Wu, Haiyong, Lu, Ning, Shi, Wenbo, Liu, Zhiquan
• Format: Article
• Language: English
• Subjects: Android Trojan spyware; Behavioral features; Multi-input model; Software detection; Weight-size sharing
• ISSN: 0167-4048
• DOI: 10.1016/j.cose.2024.104219

With the widespread popularity of Android Trojan spyware, detection technology for Android Trojan spyware is very necessary to prevent financial loss. However, when considering the comprehensive behaviors of Android Trojan spyware, the existing approaches based on a single feature (static information, internal behavior, and external behavior) have low accuracy and even errors. In this paper, we propose a multi-features-based Android Trojan spyware detection approach (hereafter referred to as ATSDetector). Specifically, we first define a multi-channel detection algorithm supported by heterogeneous information. And then, devise a weight-size sharing mechanism to establish the correlation between different behavioral features. At last, we then conduct real-world experiments to prove the effectiveness and stability of ATSDetector. The results show that the assessment accuracy can achieve almost 96.81%, and its kappa coefficient is about 93.62%. [Display omitted] •A software detection approach for Android Trojan spyware.•Feature selection scheme for Android Trojan spyware using multiple behavioral features.•A multi-channel malware detection algorithm based on weight-size sharing.