Driven by the popularity of the Android system, Android app markets enjoy a booming prosperity in recent years. One critical problem for modern Android app markets is how to prevent apps that are going to receive low ratings from reaching end users. For this purpose, traditional approaches have to publish an app first and then collect enough user ratings and reviews so as to determine whether the app is favored by end users or not. In this way, however, the reputation of the app market has already been damaged. To address this problem, we propose a novel technique, i.e., Sextant , to detect low rating Android apps based on the .apk files.With our proposed technique, an Android app market can prevent from risking its reputation on exposing low rating apps to users. Sextant is developed based on novel static analysis techniques as well as machine learning techniques. In our study, our proposed approach can achieve on average 90.50 precision and 94.31 recall.
@cite_17: The drastic increase of Android malware has led to a strong interest in developing methods to automate the malware analysis process. Existing automated Android malware detection and classification methods fall into two general categories: 1) signature-based and 2) machine learning-based. Signature-based approaches can be easily evaded by bytecode-level transformation attacks. Prior learning-based works extract features from application syntax, rather than program semantics, and are also subject to evasion. In this paper, we propose a novel semantic-based approach that classifies Android malware via dependency graphs. To battle transformation attacks, we extract a weighted contextual API dependency graph as program semantics to construct feature sets. To fight against malware variants and zero-day malware, we introduce graph similarity metrics to uncover homogeneous application behaviors while tolerating minor implementation differences. We implement a prototype system, DroidSIFT, in 23 thousand lines of Java code. We evaluate our system using 2200 malware samples and 13500 benign samples. Experiments show that our signature detection can correctly label 93 of malware instances; our anomaly detector is capable of detecting zero-day malware with a low false negative rate (2 ) and an acceptable false positive rate (5.15 ) for a vetting purpose.
Mu and colleagues proposed a machine learning based technique, DroidSIFT, to detect malwares @cite_17 . This approach builds the API dependency pattern database from benign and malicious Android apps. Then it encodes new apps based on its similarities to the API dependency patterns in the databases. Finally, it detects malwares by learning a model from the app encodings. The limitation of this work is that it encodes apps based on the dependency graph for each API. It is very expensive to build the dependency graph for all APIs used by an app. For malware classification, this problem can be alleviated by focusing on a small set of permission related APIs. However, for detecting low rating apps, people cannot only analyze a small set of APIs. In this case, DroidSIFT will encounter the scalability issue.