Identifying Android malware using machine learning based upon both static and dynamic features

Abstract

A recent report showed that more than half (51.6%) of total phone shipments were smartphones. These devices are as powerful as laptop computers from only a few years ago and are used to browse the Internet, send/receive emails, transfer files, watch, create and transmit multimedia and install applications that add new functionality. As of Q1 2011, the Android smartphone operating system (OS) is the most widely sold operating system worldwide. Unfortunately, the Android malware threat has continuously increased since the first Android malware was reported in 2010. This thesis describes an approach to identify Android malware using a mix of static and dynamic features. The static features are the permissions requested by the application and are obtained from the application itself. Whereas, the dynamic features are extracted from the application at runtime by instrumenting the binary code and executing it in a emulator. This instrumentation approach was developed as part of the work for this thesis. We evaluate the use of the features with a range of machine learning binary classifiers in order to classify an unknown application as either benign or malware.