International Journal On Cyber Situational Awareness (IJCSA)
ISSN: (Print) 2057-2182 ISSN: (Online) 2057-2182
Published Semi-annually. Est. 2014
Dr Cyril Onwubiko, Chair – Cyber Security & Intelligence, E-Security Group, Research Series, London, UK; IEEE UK & Ireland Section Secretary
Professor Frank Wang, Head of School / Professor of Future Computing, Chair IEEE Computer Society, UK&RI, School of Computing, University of Kent, Canterbury, UK
Dr Thomas Owens, Senior Lecturer & Director of Quality, Department of Electronic and Computer Engineering, Brunel University, London, UK
N-gram Opcode Analysis for Android Malware Detection
BooJoong Kang, Suleiman Y. Yerima, Sakir Sezer and Kieran McLaughlin
Android malware has been on the rise in recent years due to the increasing popularity of Android and the proliferation of third party application markets. Emerging Android malware families are increasingly adopting sophisticated detection avoidance techniques and this calls for more effective approaches for Android malware detection. Hence, in this paper we present and evaluate an n-gram opcode features based approach that utilizes machine learning to identify and categorize Android malware. This approach enables automated feature discovery without relying on prior expert or domain knowledge for pre-determined features. Furthermore, by using a data segmentation technique for feature selection, our analysis is able to scale up to 10-gram opcodes. Our experiments on a dataset of 2520 samples showed achieved an f-measure of 98% using the n-gram opcode based approach. We also provide empirical findings that illustrate factors that have probable impact on the overall n-gram opcodes performance trends.
Keyword: Android Malware, Malware Detection, Malware Categorization, Dalvik Bytecode, N-gram, Opcode, Feature Selection, Machine Learning.
Volume 1. No. 1
Date: Nov. 2016
Reference to this paper should be made as follows: Kang, B., Yerima, Y. S., Sezer, S. & McLaughlin, K. (2016). N-gram opcode analysis for Android malware detection. International Journal on Cyber Situational Awareness, Vol. 1, No. 1, pp231-255.