Enhancing malware detection for Android systems using a system call filtering and abstraction process
Bibliographic record
Abstract
Abstract Improving anomaly‐based malware detection techniques has been widely studied in recent years. Most of these efforts have focused on the dataset available for analysis and/or the algorithms used to distinguish between normal or abnormal behavior. These factors have major impacts on the accuracy performance of the detection techniques as well as on their time and space complexities. In this paper, we revisit a classical anomaly‐based malware detection approach (i.e., database of normal behavior) analyzing Android system calls with two conflicting objectives: reducing the time and space complexities of the selected approach without decreasing its accuracy performance. To achieve this goal, we introduce a filtering and abstraction process, which (i) removes irrelevant system calls to describe the main behavior of an Android application and (ii) unifies system calls having the same functionality but different names. This process is used to build a database describing a canonical normal behavior model of Android applications. This model is based on the 200 most popular free Android applications available in the Android market. It represents the last line of defense of an in‐depth protection strategy for smartphone systems. The results of our experimentations show that our filtering and abstraction process has positive impacts on the performance and the accuracy of the selected malware detection approach. Copyright © 2014 John Wiley & Sons, Ltd.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame machine prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. The Gemma side is a direct model label for every work in the frame, read from the title-only record. The Codex side is a classifier learned from the 10,348 direct Codex labels and calibrated to design-weighted sample rates; fields without enough sample support carry no Codex call. Candidate is the union of the two sides; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels.
Distilled classifier scores by category (both heads)
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.001 | 0.006 |
| Meta-epidemiology (narrow) | 0.001 | 0.000 |
| Meta-epidemiology (broad) | 0.001 | 0.001 |
| Bibliometrics | 0.003 | 0.001 |
| Science and technology studies | 0.001 | 0.000 |
| Scholarly communication | 0.001 | 0.001 |
| Open science | 0.001 | 0.001 |
| Research integrity | 0.001 | 0.001 |
| Insufficient payload (model declined to judge) | 0.001 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one source (direct Gemma or distilled Codex), not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".