A Surveillance Spyware Detection System Based on Data Mining Methods

TLDR

Spyware poses a serious threat that far exceeds common expectations. The paper proposes an integrated architecture that combines static and dynamic analyses to defend against surveillance spyware. The system extracts and ranks features from static and dynamic analyses, builds client‑specific SVM classifiers, and uses a server to collect reports, retrain, and redistribute updated classifiers. The SSDS achieves 97.9 % accuracy on known spyware and 96.4 % on unknown spyware.

Abstract

The problem of spyware is incredibly serious and exceeds anyone's imagination. Combining static and dynamic analyses, we propose an integrated architecture to defend against surveillance spyware in this paper. Features extracted from both static and dynamic analyses are ranked according to their information gains. Then using top significant features we construct a Support Vector Machine (SVM) classifier for each client. In order to keep the classifier update-to-date, there is a machine playing as server to collect reports from all clients, retrain, and redistribute the new classifier to each client. Our surveillance spyware detection system (SSDS) has an overall accuracy rate up to 97.9% for known surveillance spywares and 96.4% for unknown ones.