Machine learning-based dynamic analysis of Android apps with improved code coverage

摘要: This paper investigates the impact of code coverage on machine learning-based dynamic analysis Android malware. In order to maximize coverage, typically requires generation events trigger user interface and discovery run-time behavioral features. The commonly used event approach in most existing systems is random-based implemented with Monkey tool that comes SDK. utilized popular platforms like AASandbox, vetDroid, MobileSandbox, TraceDroid, Andrubis, ANANAS, DynaLog, HADM. this paper, we propose investigate approaches based stateful compare their capabilities state-of-the-practice approach. two proposed are state-based method (implemented DroidBot) a hybrid combines methods. We three different input methods real devices, terms ability log behavior features various learning algorithms utilize for malware detection. Experiments performed using 17,444 applications show overall, provide much better which turn leads more accurate detection compared state-of- the- art