Cross-device behavioral consistency: Benchmarking and implications for effective android malware detection

Research output: Journal PublicationArticlepeer-review

Abstract

Most of the proposed solutions using dynamic features for Android malware detection collect and test their systems using a single and particular data collection device, either a real device or an emulator. The results obtained using these particular devices are then generalized to any Android platform. This extensive generalization is based on the assumption of consistent behavior of apps across devices. This study performs an extensive benchmarking of this assumption for system calls, executing Android malware and benign samples under the same conditions in 9 different collection devices, including real and virtual devices. The results indicate the existence of significant differences between real devices and emulators in system calls usage and, consequently, in the collected behavioral profiles obtained from running the same set of applications on different devices. Furthermore, the impact of these differences on machine learning-based malware detection models is evaluated. In this regard, a significant degenerative effect on the detection performance of the model is produced when data collected on different devices are used in the training and testing sets. Therefore, the empirical findings do not support the assumption of cross-device consistent behavior of Android apps when system calls are used as descriptive features.
Original languageEnglish
Article number100357
Number of pages15
JournalMachine Learning with Applications
Volume9
DOIs
Publication statusPublished - 15 Sept 2022
Externally publishedYes

Keywords

  • Android emulator
  • Android malware
  • Benchmark
  • Malware behavior
  • Malware detection
  • Real device
  • System calls

Fingerprint

Dive into the research topics of 'Cross-device behavioral consistency: Benchmarking and implications for effective android malware detection'. Together they form a unique fingerprint.

Cite this