Identifying Unknown Android Malware with Feature Extractions and Classification Techniques

Android malware unfortunately have little difficulty to sneak in marketplaces. While known malware and their variants are nowadays quite well detected by antivirus scanners, new unknown malware, which are fundamentally different from others (e.g. "0-day"), remain an issue. To discover such new malware, the SherlockDroid framework filters masses of applications and only keeps the most likely to be malicious for future inspection by antivirus teams. Apart from crawling applications from marketplaces, SherlockDroid extracts code-level features, and then classifies unknown applications with Alligator. Alligator is a classification tool that efficiently and automatically combines several classification algorithms. To demonstrate the efficiency of our approach, we have extracted properties and classified over 600,000 applications during two crawling campaigns in July 2014 and October 2014, with the detection of one new malware, Android/Odpa.A!tr.spy, and two new riskware. With other findings, this increases SherlockDroid's "Hall of Shame" to 9 totally unknown malware and potentially unwanted applications.

I. Introduction

With the plethora of monthly new Android applications (between 20,000 and 40,000 according to AppBrain), malware authors can easily sneak in malicious applications. Fortunately, several of these are detected by anti-virus products, which rely on malware ‘signatures’, or patterns that match several samples at a time [1]. Nevertheless, all anti-virus scanners face difficulties when it comes to detecting truly new malware (new families, 0-day…).