An Android Malware Detection Method Using Deep Learning Based on API Calls

With the in-depth development of the Internet industry, the mobile Internet has been effectively integrated into daily work. However, Android has many extremely serious security issues. In our work, we apply text classification technology to the detection of Android malware, based on the deep learning. We extract the Android malware API sequence based on the Cuckoo sandbox, and use the text processing technology to solve the detection problem of Android malware. To evaluating the performance of our system, we compared it with Dalvik based on the Bi-LSTM. The accuracy of API extraction method using Cuckoo is higher than Dalvik, reaching the accuracy of 96.74%. To further verify the effects of different models, we compared it with GRU, BGRU and LSTM using Cuckoo Sandbox as API extraction method. The result demonstrate the Bi-LSTM has the highest accuracy.

I. Introduction

With the in-depth development of the Internet industry, the mobile Internet has been effectively integrated into daily work. Mobile applications are mainly distributed through the application market. The open source feature has made the Android application scale grow at an alarming rate^[1]. It has gradually surpassed competitors such as IOS, Blackberry and Windows Mobile, and has become the mainstream platform for mobile applications^[2]. However, it is this open source feature that allows Android devices to allow applications to be installed from unauthenticated third-party sources, and the number of malware increases dramatically.