Drebin: Effective and Explainable Detection of Android Malware in Your Pocket

TLDR

Malicious Android applications threaten platform security, and their growing diversity renders conventional defenses largely ineffective, leaving smartphones vulnerable to novel malware. The paper proposes DREBIN, a lightweight method to detect Android malware directly on smartphones. DREBIN conducts broad static analysis to extract many app features, embeds them in a joint vector space, and automatically identifies malware patterns while providing explanations. Evaluated on 123,453 apps and 5,560 malware samples, DREBIN detects 94 % of malware with few false alarms, outperforms related methods, and runs in about 10 seconds on popular smartphones, enabling on‑device checks.

Abstract

Malicious applications pose a threat to the security of the Android platform. The growing amount and diversity of these applications render conventional defenses largely ineffective and thus Android smartphones often remain unprotected from novel malware. In this paper, we propose DREBIN, a lightweight method for detection of Android malware that enables identifying malicious applications directly on the smartphone. As the limited resources impede monitoring applications at run-time, DREBIN performs a broad static analysis, gathering as many features of an application as possible. These features are embedded in a joint vector space, such that typical patterns indicative for malware can be automatically identified and used for explaining the decisions of our method. In an evaluation with 123,453 applications and 5,560 malware samples DREBIN outperforms several related approaches and detects 94% of the malware with few false alarms, where the explanations provided for each detection reveal relevant properties of the detected malware. On five popular smartphones, the method requires 10 seconds for an analysis on average, rendering it suitable for checking downloaded applications directly on the device.