2014 · 406 citations · 27 references
ComputingComputer ScienceCybersecurityApplication SecurityMalware AnalysisMobile SecurityApplication Programming InterfacesApplication Security TestingBehavioral AnalysisMalware ClassificationMobile Application DevelopmentMobile Application VulnerabilitiesAndroid Application AnalysisAndroid Malware AnalysisAndroid Malware ClassificationApi Call AnalysisApplication Behavior MonitoringMalicious App DetectionMalicious Behavior AnalysisMobile Malware
How do we know a program does what it claims to do? After clustering Android apps by their description topics, we identify outliers in each cluster with respect to their API usage. A "weather" app that sends messages thus becomes an anomaly; likewise, a "messaging" app would typically not be expected to access the current location. Applied on a set of 22,500+ Android applications, our CHABADA prototype identified several anomalies; additionally, it flagged 56% of novel malware as such, without requiring any known malware patterns.
27
Estimating the Support of a High-Dimensional Distribution
Bernhard Schölkopf, John Platt, John Shawe‐Taylor et al. · Neural Computation · 2001 · 5.9K citations