Malicious Code Detection on Android Operating Systems by using Byte-Code Analysis

Abstract

- This research presents a model for malware detection on mobile operating system based on machine learning technique. The objective is to reduce the risk of installing harmful application when the user did not update the anti-virus program in time. The proposed model is different to other anti-virus is that most of anti-virus software used virus signature to identify malware. However, the virus signature-based detection approach requires frequent updates of the virus signature dictionary. The signature-based approaches are not effective against new, unknown viruses while the proposed model based on machine learning can detect new malware even some parts of the code have been modified. The research processes are as follows: (1) achieving of both malicious and benign codes on android operating system, (2) Extracting features based on the distribution of n-grams frequency, and (3) constructing a model for classification the malicious codes using the extracted features for both malicious and benign codes. In the experiment, 500 malicious codes, 400 benign codes and 100 system files were used to construct the model. The experiment shows that the model achieved more than 88.9% accuracy. For the sensitivity and specificity, the model achieved 95.0% and 82.8%, respectively.