SAMADroid: A Novel 3-Level Hybrid Malware Detection Model for Android Operating System

• Published in: IEEE access 2018-01, Vol.6, p.4321-4339
• Main Authors: Arshad, Saba, Shah, Munam A., Wahid, Abdul, Mehmood, Amjad, Song, Houbing, Yu, Hongnian
• Format: Article
• Language: English
• Subjects: Accuracy; android operating system; Androids; Applications programs; dynamic analysis; efficiency; Electronic devices; Feature extraction; Humanoid robots; hybrid malware detection; Machine learning; Malware; memory usage; Mobile operating systems; Multilayers; Operating systems; performance overhead; Power consumption; Runtime; static analysis
• ISSN: 2169-3536; 2169-3536
• DOI: 10.1109/ACCESS.2018.2792941

For the last few years, Android is known to be the most widely used operating system and this rapidly increasing popularity has attracted the malware developer's attention. Android allows downloading and installation of apps from other unofficial market places. This gives malware developers an opportunity to put repackaged malicious applications in third-party app-stores and attack the Android devices. A large number of malware analysis and detection systems have been developed which uses static analysis, dynamic analysis, or hybrid analysis to keep Android devices secure from malware. However, the existing research clearly lags in detecting malware efficiently and accurately. For accurate malware detection, multilayer analysis is required which consumes large amount of hardware resources of resource constrained mobile devices. This research proposes an efficient and accurate solution to this problem, named SAMADroid, which is a novel 3-level hybrid malware detection model for Android operating systems. The research contribution includes multiple folds. First, many of the existing Android malware detection techniques are thoroughly investigated and categorized on the basis of their detection methods. Also, their benefits along with limitations are deduced. A novel 3-level hybrid malware detection model for Android operating systems is developed, that can provide high detection accuracy by combining the benefits of the three different levels: 1) Static and Dynamic Analysis; 2) Local and Remote Host; and 3) Machine Learning Intelligence. Experimental results show that SAMADroid achieves high malware detection accuracy by ensuring the efficiency in terms of power and storage consumption.