ElMouatez Billah Karbab - Android Malware Detection using Machine Learning: Data-Driven Fingerprinting and Threat Intelligence: 86 (Advances in Information Security, 86)

Mobile apps have become essential in our life and work, as many of the services we use are provided to us through mobile apps. Moreover, Android OS has become the dominant platform not only for mobile phones and tablets but also for Internet of Things (IoT) devices [] and generate big amounts of data with highly sensitive information. The sophistication of mobile devices and the ubiquitousness of IoT objects help to build a smart world, but also unleash unprecedented potential for cyber-threats. Such threats could be committed by adversaries who might gain access to sensitive information and resources through Android malware apps. In this context, protecting Android devices from malicious apps is of paramount importance. This raises the need for security solutions to protect users from malicious apps, which exploit the sophistication and the sensitive content of smart devices.

The volume of malware is growing tremendously [ which emphasizes the importance of effective Android malware detection capability. The challenge relates to processing, analyzing, and fingerprinting new malware binaries to produce analytics in a limited time window. In this respect, the book aims at answering the following questions: (1) How can we efficiently fingerprint malware in a large binary corpus? (2) How can we effectively detect malware? (3) How can we group the detected samples into malware families?

There is a clear need for solutions that defend against malicious apps in mobile and IoT devices with specific requirements to overcome the limitations of existing Android malware detection systems. First, the Android malware detection system should ensure a high accuracy with minimum false alarms. Second, it should be able to operate at different deployment scales: (1) Server machines, (2) Personal computers, (3) Smartphones and tablets, and (4) IoT devices. Third, detecting that a given app is malicious may not be enough, as more information about the threat is required to prioritize the mitigation actions. Knowledge on the type of attack could be crucial to prevent the intended damage. Therefore, it is essential to have a solution that goes a step further and attributes the malware to a specific family, which defines the potential threat that infected system is exposed to. Finally, it is necessary to minimize manual human intervention as much as possible and make the detection dependent mainly on the app sample for automatic feature extraction and pattern recognition. As malicious apps are quickly getting stealthier, the security analyst should be able to catch up with this trend. In this respect, for every new malware family, a manual analysis of the samples is required to identify its pattern and features that distinguish it from benign apps.