Mining Android Apps for Anomalies

摘要: Abstract How do we know a program does what it claims to do? Our CHABADA prototype can cluster Android™ apps by their description topics and identify outliers in each with respect API usage. A “weather” app that sends messages thus becomes an anomaly; likewise, “messaging” would typically not be expected access the current location also identified. In this paper present new approach for anomaly detection improves classification results of our original [ 1 ]. Applied on set 22,500+ Android applications, now predict 74% novel malware as such, without requiring any known patterns, maintains false positive rate close 10%.