Malware
Android Malware Detection via Graphlet Sampling
In this paper, we extend the work done in Android Malware Detection via Graphlet Sampling (CNS 2016). Specifically, we analyze our system, App topologiCal signature through graphleT Sampling (ACTS), in terms of its performance against sampling space size, graph size bias, and sample bias, among other metrics.
ACTS: Extracting Android App Topological Signature Through Graphlet Sampling
In this paper, we propose a novel topological signature of Android apps based on the function call graphs (FCGs) extracted from their Android App PacKages (APKs). Specifically, by leveraging recent advances in graphlet sampling, the proposed method fully captures the invocator-invocatee relationship at local neighborhoods in an FCG without exponentially inflating the state space. Using real benign app and malware samples, we demonstrate that our method, ACTS (App topologiCal signature through graphleT Sampling), can detect malware and identify malware families robustly and efficiently. More importantly, we demonstrate that, without augmenting the FCG with any semantic features such as bytecode-based vertex typing, local topological information captured by ACTS alone can achieve a high malware detection accuracy. Since ACTS only uses structural features, which are orthogonal to semantic features, it is expected that combining them would give a greater improvement in malware detection accuracy than combining non-orthogonal semantic features.