Abstract
This work shows an application of statistical learning methodologies in order to determine the important factors for malware detection. Support Vector Machines and Lasso Regression performed Malware classification with additional re-sampling methods. The results show that the Lasso Regression allows an efficient selection of relevant variables for the construction of the classifier, also the integration of support vector machines improves the efficiency of the classifier through the application of resampling methods. The model presented in this paper uses a statistical learning approach through the selection of variables, non-linear classification, and resampling methods.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Kaspersky Lab: Machine learning for malware detection. Kaspersky for Bussines (2019)
Gavrilut D., Cimpoesu M., Anton D., Ciortuz, L.: Malware detection using machine learning. In: Proceedings of the International Multiconference on Computer Science and Information Technology, pp. 735–741 (2009)
Aydogan, E., Sen, S.: Analysis of machine learning methods on malware detection. In: 22nd Signal Processing and Communications Applications Conference (2014)
Xiao, F., Lin, Z., Sun, Y., Ma, Y.: Malware detection based on deep learning of behavior graphs. Math. Prob. Eng. 2019, 10 (2019)
Amalina, F., Feizollah, A., Bradul, N., Gani, A.: Evaluation of machine learning classifiers for mobile malware detection. Soft Comput. 20(1), 343–357 (2016)
Rieck, K., Holz, T., Willems, C., Dussel, P., Laskov, P.: Learning and classification of malware behavior. In: International Conference on Detection of Intrusions and Malware, and Vulnerability Assesment (2008)
Santos, I., Nieves, J., Bringas, P.: Semi-supervised learning for unknown malware detection. In: Abraham, A., Corchado, J.M., González, S.R., De Paz Santana, J.F. (eds.) International Symposium on Distributed Computing and Artificial Intelligence. Advances in Intelligent and Soft Computing, vol. 91. Springer, Heidelberg (2011)
Hou, Y., Chang, Y., Chen, T., Laih, C., Chen, C.: Malicious web content detection by machine learning. Expert Syst. Appl. 37(1), 55–60 (2010)
Markel, Z., Bilzor, M.: Building a machine learning classifier for malware detection. In: Second Workshop on Anti-malware Testing Research (WATeR) (2014)
Martín, I., et al.: Android malware characterization using metadata and machine learning techniques. Secur. Commun. Networks 2018, 11 (2018)
Yerima, S., et al.: DroidFusion: A novel multilevel classifier fusion approach for android malware detection. IEEE Trans. Cybern. 49, 453–466 (2018)
Tibshirani, R.: Regression shrinkage and selection via the lasso. J. Roy. Stat. Soc. 58, 267–288 (1996)
Cortes, C., Vapnik, V.: Support vector networks. Mach. Learn. 20, 273 (1995)
Hastie, T., Tibshirani, R., Friedman, J.: The Elements of Statistical Learning. Springer Series in Statistics: EU (2008)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Appendices
Annex I. Variables
Variable | Description |
---|---|
transact | API call signature |
onServiceConnected | API call signature |
bindService | API call signature |
attachInterface | API call signature |
ServiceConnection | API call signature |
android.os.Binder | API call signature |
SEND_SMS | Manifest Permission |
Ljava.lang.Class.getCanonicalName | API call signature |
Ljava.lang.Class.getMethods | API call signature |
Ljava.lang.Class.cast | API call signature |
Ljava.net.URLDecoder | API call signature |
android.content.pm.Signature | API call signature |
android.telephony.SmsManager | API call signature |
READ_PHONE_STATE | Manifest Permission |
getBinder | API call signature |
ClassLoader | API call signature |
Landroid.content.Context.registerReceiver | API call signature |
Ljava.lang.Class.getField | API call signature |
Landroid.content.Context.unregisterReceiver | API call signature |
GET_ACCOUNTS | Manifest Permission |
RECEIVE_SMS | Manifest Permission |
Ljava.lang.Class.getDeclaredField | API call signature |
READ_SMS | Manifest Permission |
getCallingUid | API call signature |
Ljavax.crypto.spec.SecretKeySpec | API call signature |
android.intent.action.BOOT_COMPLETED | Intent |
USE_CREDENTIALS | Manifest Permission |
MANAGE_ACCOUNTS | Manifest Permission |
android.content.pm.PackageInfo | API call signature |
KeySpec | API call signature |
TelephonyManager.getLine1Number | API call signature |
DexClassLoader | API call signature |
HttpGet.init | API call signature |
SecretKey | API call signature |
Ljava.lang.Class.getMethod | API call signature |
System.loadLibrary | API call signature |
android.intent.action.SEND | API call signature |
Ljavax.crypto.Cipher | API call signature |
WRITE_SMS | Manifest Permission |
READ_SYNC_SETTINGS | Manifest Permission |
AUTHENTICATE_ACCOUNTS | Manifest Permission |
android.telephony.gsm.SmsManager | API call signature |
WRITE_HISTORY_BOOKMARKS | Manifest Permission |
TelephonyManager.getSubscriberId | API call signature |
mount | Commands signature |
INSTALL_PACKAGES | Manifest Permission |
Runtime.getRuntime | API call signature |
CAMERA | Manifest Permission |
Ljava.lang.Object.getClass | API call signature |
WRITE_SYNC_SETTINGS | Manifest Permission |
READ_HISTORY_BOOKMARKS | Manifest Permission |
Ljava.lang.Class.forName | API call signature |
INTERNET | Manifest Permission |
android.intent.action.PACKAGE_REPLACED | Intent |
Binder | API call signature |
android.intent.action.SEND_MULTIPLE | Intent |
RECORD_AUDIO | Manifest Permission |
IBinder | API call signature |
android.os.IBinder | API call signature |
createSubprocess | API call signature |
NFC | Manifest Permission |
ACCESS_LOCATION_EXTRA_COMMANDS | Manifest Permission |
URLClassLoader | API call signature |
WRITE_APN_SETTINGS | Manifest Permission |
abortBroadcast | API call signature |
BIND_REMOTEVIEWS | Manifest Permission |
android.intent.action.TIME_SET | Intent |
READ_PROFILE | Manifest Permission |
TelephonyManager.getDeviceId | API call signature |
MODIFY_AUDIO_SETTINGS | Manifest Permission |
getCallingPid | API call signature |
READ_SYNC_STATS | Manifest Permission |
BROADCAST_STICKY | Manifest Permission |
android.intent.action.PACKAGE_REMOVED | Intent |
android.intent.action.TIMEZONE_CHANGED | Intent |
WAKE_LOCK | Manifest Permission |
RECEIVE_BOOT_COMPLETED | Manifest Permission |
RESTART_PACKAGES | Manifest Permission |
Ljava.lang.Class.getPackage | API call signature |
chmod | Commands signature |
Ljava.lang.Class.getDeclaredClasses | API call signature |
android.intent.action.ACTION_POWER_DISCONNECTED | Intent |
android.intent.action.PACKAGE_ADDED | Intent |
PathClassLoader | API call signature |
TelephonyManager.getSimSerialNumber | API call signature |
Runtime.load | API call signature |
TelephonyManager.getCallState | API call signature |
BLUETOOTH | Manifest Permission |
READ_CALENDAR | Manifest Permission |
READ_CALL_LOG | Manifest Permission |
SUBSCRIBED_FEEDS_WRITE | Manifest Permission |
READ_EXTERNAL_STORAGE | Manifest Permission |
TelephonyManager.getSimCountryIso | API call signature |
sendMultipartTextMessage | API call signature |
PackageInstaller | API call signature |
VIBRATE | Manifest Permission |
remount | Commands signature |
android.intent.action.ACTION_SHUTDOWN | Intent |
sendDataMessage | API call signature |
ACCESS_NETWORK_STATE | Manifest Permission |
chown | Commands signature |
HttpPost.init | API call signature |
Ljava.lang.Class.getClasses | API call signature |
SUBSCRIBED_FEEDS_READ | Manifest Permission |
TelephonyManager.isNetworkRoaming | API call signature |
CHANGE_WIFI_MULTICAST_STATE | Manifest Permission |
WRITE_CALENDAR | Manifest Permission |
android.intent.action.PACKAGE_DATA_CLEARED | Intent |
MASTER_CLEAR | Manifest Permission |
HttpUriRequest | API call signature |
UPDATE_DEVICE_STATS | Manifest Permission |
WRITE_CALL_LOG | Manifest Permission |
DELETE_PACKAGES | Manifest Permission |
GET_TASKS | Manifest Permission |
GLOBAL_SEARCH | Manifest Permission |
DELETE_CACHE_FILES | Manifest Permission |
WRITE_USER_DICTIONARY | Manifest Permission |
android.intent.action.PACKAGE_CHANGED | Intent |
android.intent.action.NEW_OUTGOING_CALL | Intent |
REORDER_TASKS | Manifest Permission |
WRITE_PROFILE | Manifest Permission |
SET_WALLPAPER | Manifest Permission |
BIND_INPUT_METHOD | Manifest Permission |
divideMessage | API call signature |
READ_SOCIAL_STREAM | Manifest Permission |
READ_USER_DICTIONARY | Manifest Permission |
PROCESS_OUTGOING_CALLS | Manifest Permission |
CALL_PRIVILEGED | Manifest Permission |
Runtime.exec | API call signature |
BIND_WALLPAPER | Manifest Permission |
RECEIVE_WAP_PUSH | Manifest Permission |
DUMP | Manifest Permission |
BATTERY_STATS | Manifest Permission |
ACCESS_COARSE_LOCATION | Manifest Permission |
SET_TIME | Manifest Permission |
android.intent.action.SENDTO | Intent |
WRITE_SOCIAL_STREAM | Manifest Permission |
WRITE_SETTINGS | Manifest Permission |
REBOOT | Manifest Permission |
BLUETOOTH_ADMIN | Manifest Permission |
TelephonyManager.getNetworkOperator | API call signature |
/system/bin | Commands signature |
MessengerService | API call signature |
BIND_DEVICE_ADMIN | Manifest Permission |
WRITE_GSERVICES | Manifest Permission |
IRemoteService | API call signature |
KILL_BACKGROUND_PROCESSES | Manifest Permission |
SET_ALARM | API call signature |
ACCOUNT_MANAGER | API call signature |
/system/app | Commands signature |
android.intent.action.CALL | Intent |
STATUS_BAR | Manifest Permission |
TelephonyManager.getSimOperator | API call signature |
PERSISTENT_ACTIVITY | Manifest Permission |
CHANGE_NETWORK_STATE | Manifest Permission |
onBind | API call signature |
Process.start | API call signature |
android.intent.action.SCREEN_ON | Intent |
Context.bindService | API call signature |
RECEIVE_MMS | Manifest Permission |
SET_TIME_ZONE | Manifest Permission |
android.intent.action.BATTERY_OKAY | Intent |
CONTROL_LOCATION_UPDATES | Manifest Permission |
BROADCAST_WAP_PUSH | Manifest Permission |
BIND_ACCESSIBILITY_SERVICE | Manifest Permission |
ADD_VOICEMAIL | Manifest Permission |
CALL_PHONE | Manifest Permission |
ProcessBuilder | API call signature |
BIND_APPWIDGET | Manifest Permission |
FLASHLIGHT | Manifest Permission |
READ_LOGS | Manifest Permission |
Ljava.lang.Class.getResource | API call signature |
defineClass | API call signature |
SET_PROCESS_LIMIT | Manifest Permission |
android.intent.action.PACKAGE_RESTARTED | Intent |
MOUNT_UNMOUNT_FILESYSTEMS | Manifest Permission |
BIND_TEXT_SERVICE | Manifest Permission |
INSTALL_LOCATION_PROVIDER | Manifest Permission |
android.intent.action.CALL_BUTTON | Intent |
android.intent.action.SCREEN_OFF | Intent |
findClass | API call signature |
SYSTEM_ALERT_WINDOW | Manifest Permission |
MOUNT_FORMAT_FILESYSTEMS | Manifest Permission |
CHANGE_CONFIGURATION | Manifest Permission |
CLEAR_APP_USER_DATA | Manifest Permission |
intent.action.RUN | Intent |
android.intent.action.SET_WALLPAPER | Intent |
CHANGE_WIFI_STATE | Manifest Permission |
READ_FRAME_BUFFER | Manifest Permission |
ACCESS_SURFACE_FLINGER | Manifest Permission |
Runtime.loadLibrary | API call signature |
BROADCAST_SMS | Manifest Permission |
EXPAND_STATUS_BAR | Manifest Permission |
INTERNAL_SYSTEM_WINDOW | Manifest Permission |
android.intent.action.BATTERY_LOW | Intent |
SET_ACTIVITY_WATCHER | Manifest Permission |
WRITE_CONTACTS | Manifest Permission |
android.intent.action.ACTION_POWER_CONNECTED | Intent |
BIND_VPN_SERVICE | Manifest Permission |
DISABLE_KEYGUARD | Manifest Permission |
ACCESS_MOCK_LOCATION | Manifest Permission |
GET_PACKAGE_SIZE | Manifest Permission |
MODIFY_PHONE_STATE | Manifest Permission |
CHANGE_COMPONENT_ENABLED_STATE | Manifest Permission |
CLEAR_APP_CACHE | Manifest Permission |
SET_ORIENTATION | Manifest Permission |
READ_CONTACTS | Manifest Permission |
DEVICE_POWER | Manifest Permission |
HARDWARE_TEST | Manifest Permission |
ACCESS_WIFI_STATE | Manifest Permission |
WRITE_EXTERNAL_STORAGE | Manifest Permission |
ACCESS_FINE_LOCATION | Manifest Permission |
SET_WALLPAPER_HINTS | Manifest Permission |
SET_PREFERRED_APPLICATIONS | Manifest Permission |
WRITE_SECURE_SETTINGS | Manifest Permission |
class | B = Benign |
Annex II. Coefficients of Lasso Regression
Variable | Coefficient |
---|---|
createSubprocess | 0.264244253 |
SEND_SMS | 0.258899979 |
INTERNET | 0.207230368 |
android.telephony.gsm.SmsManager | 0.202311101 |
android.telephony.SmsManager | 0.170603554 |
CONTROL_LOCATION_UPDATES | 0.167463464 |
chmod | 0.129396768 |
DELETE_CACHE_FILES | 0.128579622 |
SET_TIME | 0.126521959 |
READ_SMS | 0.124454019 |
READ_HISTORY_BOOKMARKS | 0.12137216 |
HttpUriRequest | 0.118544076 |
ACCESS_LOCATION_EXTRA_COMMANDS | 0.113866999 |
MODIFY_PHONE_STATE | 0.105379828 |
WRITE_SOCIAL_STREAM | 0.097755195 |
SUBSCRIBED_FEEDS_READ | 0.096845453 |
WRITE_PROFILE | 0.094601544 |
Runtime.exec | 0.086924025 |
DUMP | 0.083824425 |
READ_PHONE_STATE | 0.083395724 |
UPDATE_DEVICE_STATS | 0.083345931 |
TelephonyManager.getLine1Number | 0.079018974 |
SecretKey | 0.074446082 |
Ljava.lang.Class.getResource | 0.074278545 |
android.intent.action.PACKAGE_RESTARTED | 0.072230441 |
PERSISTENT_ACTIVITY | 0.070560713 |
android.intent.action.BOOT_COMPLETED | 0.066059447 |
TelephonyManager.getDeviceId | 0.065452464 |
CLEAR_APP_CACHE | 0.065119831 |
TelephonyManager.getSubscriberId | 0.064089987 |
WRITE_HISTORY_BOOKMARKS | 0.063187614 |
SET_ALARM | 0.062644562 |
BIND_WALLPAPER | 0.061718151 |
SET_ORIENTATION | 0.061584459 |
onBind | 0.057236584 |
remount | 0.052002868 |
SET_WALLPAPER | 0.050447888 |
GLOBAL_SEARCH | 0.050315561 |
divideMessage | 0.042985093 |
android.intent.action.BATTERY_LOW | 0.039620621 |
DexClassLoader | 0.038455601 |
X.system.bin | 0.037747743 |
mount | 0.037456259 |
android.intent.action.NEW_OUTGOING_CALL | 0.036929947 |
ACCESS_COARSE_LOCATION | 0.036554244 |
findClass | 0.036472269 |
ACCESS_WIFI_STATE | 0.035110756 |
SYSTEM_ALERT_WINDOW | 0.034679765 |
SET_WALLPAPER_HINTS | 0.032870177 |
PROCESS_OUTGOING_CALLS | 0.031816527 |
MANAGE_ACCOUNTS | 0.030118538 |
Ljava.lang.Class.getMethod | 0.029238659 |
AUTHENTICATE_ACCOUNTS | 0.029026365 |
android.intent.action.CALL_BUTTON | 0.028889754 |
defineClass | 0.028221046 |
READ_FRAME_BUFFER | 0.023514533 |
PackageInstaller | 0.018827645 |
KeySpec | 0.018161017 |
Ljava.lang.Class.getDeclaredField | 0.016860114 |
WRITE_APN_SETTINGS | 0.016567216 |
intent.action.RUN | 0.015230216 |
BLUETOOTH | 0.013431058 |
android.intent.action.BATTERY_OKAY | 0.013242983 |
android.intent.action.PACKAGE_ADDED | 0.010809145 |
HARDWARE_TEST | 0.010537673 |
Ljava.lang.Class.getPackage | 0.010420027 |
getCallingPid | 0.009211549 |
android.intent.action.PACKAGE_CHANGED | 0.008287811 |
Ljava.lang.Class.getClasses | 0.008147411 |
WRITE_EXTERNAL_STORAGE | 0.006609881 |
RECEIVE_WAP_PUSH | 0.006325588 |
PathClassLoader | 0.005271246 |
CHANGE_WIFI_STATE | 0.004566972 |
FLASHLIGHT | 0.004039508 |
Ljava.lang.Class.forName | 0.003478003 |
android.intent.action.TIMEZONE_CHANGED | 0.001800096 |
READ_SOCIAL_STREAM | 0.001715007 |
DISABLE_KEYGUARD | 0.000932628 |
BIND_INPUT_METHOD | 0.000500278 |
GET_TASKS | 0.000274389 |
BIND_ACCESSIBILITY_SERVICE | −0.00026438 |
RESTART_PACKAGES | −0.00148047 |
android.os.IBinder | −0.00279385 |
TelephonyManager.getSimCountryIso1 | −0.00288437 |
Ljava.lang.Class.getField | −0.00296154 |
IBinder | −0.00342076 |
BROADCAST_SMS | −0.00398095 |
SUBSCRIBED_FEEDS_WRITE | −0.00454201 |
ACCESS_NETWORK_STATE | −0.00459926 |
bindService | −0.00471922 |
READ_EXTERNAL_STORAGE | −0.00519205 |
android.intent.action.SENDTO | −0.00563882 |
Ljava.lang.Class.cast | −0.00718701 |
STATUS_BAR | −0.0093266 |
REBOOT | −0.00970475 |
NFC | −0.00980768 |
android.os.Binder | −0.01051688 |
CHANGE_CONFIGURATION | −0.01179464 |
RECEIVE_SMS | −0.01204579 |
BLUETOOTH_ADMIN | −0.0139069 |
android.intent.action.PACKAGE_DATA_CLEARED | −0.01435001 |
X.system.app | −0.01479621 |
BIND_APPWIDGET | −0.01481123 |
getBinder | −0.01611587 |
WAKE_LOCK | −0.01650988 |
TelephonyManager.getCallState | −0.01720881 |
BROADCAST_STICKY | −0.01764756 |
TelephonyManager.getNetworkOperator | −0.01889666 |
WRITE_SECURE_SETTINGS | −0.01918746 |
WRITE_USER_DICTIONARY | −0.01993922 |
KILL_BACKGROUND_PROCESSES | −0.02030457 |
android.intent.action.SEND | −0.02039022 |
READ_SYNC_SETTINGS | −0.0208841 |
android.content.pm.PackageInfo | −0.02119871 |
Landroid.content.Context.registerReceiver | −0.02174869 |
READ_CONTACTS | −0.02274993 |
CAMERA | −0.02403828 |
RECORD_AUDIO | −0.02466568 |
TelephonyManager.getSimSerialNumber | −0.02478753 |
chown | −0.02591173 |
abortBroadcast | −0.02719413 |
Ljava.lang.Class.getCanonicalName | −0.0271965 |
Ljava.lang.Class.getMethods | −0.02771707 |
IRemoteService | −0.02791817 |
CALL_PHONE | −0.03090892 |
android.intent.action.SCREEN_ON | −0.03210006 |
BROADCAST_WAP_PUSH | −0.03226206 |
HttpPost.init | −0.03234517 |
WRITE_SMS | −0.0324788 |
TelephonyManager.getSimOperator | −0.03469507 |
android.intent.action.ACTION_POWER_DISCONNECTED | −0.03616017 |
BATTERY_STATS | −0.0364922 |
android.intent.action.SCREEN_OFF | −0.03728614 |
INSTALL_LOCATION_PROVIDER | −0.03791462 |
READ_SYNC_STATS | −0.03810809 |
attachInterface | −0.03829324 |
Ljavax.crypto.Cipher | −0.03949882 |
INSTALL_PACKAGES | −0.03961002 |
android.intent.action.SET_WALLPAPER | −0.04164843 |
MASTER_CLEAR | −0.04187666 |
onServiceConnected | −0.04191473 |
Process.start | −0.04247342 |
transact | −0.04265317 |
ProcessBuilder | −0.04321857 |
GET_PACKAGE_SIZE | −0.04354681 |
USE_CREDENTIALS | −0.04364622 |
android.intent.action.PACKAGE_REMOVED | −0.04367305 |
Landroid.content.Context.unregisterReceiver | −0.04397466 |
WRITE_CALL_LOG | −0.04446323 |
CALL_PRIVILEGED | −0.04503315 |
READ_LOGS | −0.04560355 |
WRITE_CONTACTS | −0.04869014 |
ACCOUNT_MANAGER | −0.05009465 |
Ljava.lang.Class.getDeclaredClasses | −0.05091621 |
Ljava.lang.Object.getClass | −0.0509497 |
android.intent.action.PACKAGE_REPLACED | −0.05162474 |
WRITE_SETTINGS | −0.05171949 |
CLEAR_APP_USER_DATA | −0.05230378 |
GET_ACCOUNTS | −0.05414448 |
WRITE_CALENDAR | −0.05974735 |
System.loadLibrary | −0.06144877 |
MODIFY_AUDIO_SETTINGS | −0.06205213 |
ADD_VOICEMAIL | −0.06566482 |
TelephonyManager.isNetworkRoaming | −0.06653053 |
READ_PROFILE | −0.06791394 |
ACCESS_MOCK_LOCATION | −0.06795926 |
Binder | −0.06942009 |
CHANGE_NETWORK_STATE | −0.07220123 |
RECEIVE_MMS | −0.0792903 |
URLClassLoader | −0.07967425 |
Ljavax.crypto.spec.SecretKeySpec | −0.08006777 |
android.intent.action.ACTION_SHUTDOWN | −0.08283051 |
WRITE_GSERVICES | −0.08450157 |
MOUNT_UNMOUNT_FILESYSTEMS | −0.08603744 |
android.intent.action.TIME_SET | −0.08665047 |
Context.bindService | −0.08838194 |
CHANGE_WIFI_MULTICAST_STATE | −0.08942738 |
HttpGet.init | −0.09067209 |
ClassLoader | −0.09084002 |
CHANGE_COMPONENT_ENABLED_STATE | −0.10764022 |
Ljava.net.URLDecoder | −0.10774214 |
Runtime.load | −0.10884032 |
ACCESS_SURFACE_FLINGER | −0.11486367 |
READ_CALL_LOG | −0.12663504 |
BIND_DEVICE_ADMIN | −0.13304341 |
SET_ACTIVITY_WATCHER | −0.15191197 |
SET_TIME_ZONE | −0.18878256 |
SET_PROCESS_LIMIT | −0.19163698 |
sendMultipartTextMessage | −0.34691918 |
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Rodriguez-Aguilar, R., Marmolejo-Saucedo, J.A. (2020). Statistical Learning Applied to Malware Detection. In: Hemanth, D., Kose, U. (eds) Artificial Intelligence and Applied Mathematics in Engineering Problems. ICAIAME 2019. Lecture Notes on Data Engineering and Communications Technologies, vol 43. Springer, Cham. https://doi.org/10.1007/978-3-030-36178-5_22
Download citation
DOI: https://doi.org/10.1007/978-3-030-36178-5_22
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-36177-8
Online ISBN: 978-3-030-36178-5
eBook Packages: Intelligent Technologies and RoboticsIntelligent Technologies and Robotics (R0)