作者: Mykola Protsenko , Tilo Müller
DOI: 10.1007/978-3-319-09770-1_3
关键词: Source code 、 Test set 、 Computer science 、 Malware 、 False positive rate 、 Machine learning 、 Permission 、 Android (operating system) 、 Obfuscation 、 Artificial intelligence 、 Computer security 、 Cyclomatic complexity
摘要: In this paper, we propose a new approach for the static detection of Android malware by means machine learning that is based on software complexity metrics, such as McCabe’s Cyclomatic Complexity and Chidamber Kemerer Metrics Suite. The practical evaluation our approach, involving 20,703 benign 11,444 malicious apps, witnesses high classification quality proposed method, assess its resilience against common obfuscation transformations. With respect to large-scale test set more than 32,000 show true positive rate up 93% false 0.5% unobfuscated samples. For obfuscated samples, however, register significant drop rate, whereas permission-based schemes are immune program According these results, advocate method be useful detector samples within family sharing functionality source code. Our conservative classifications, might hence suitable an automated weighting e.g., Google Bouncer.