Feature Code Based Android Malware Detection Method

The fundamental principle of the feature code based Android malware detection method is to leverage unique feature codes associated with each app and compare them with the information stored in an existing database of malware feature codes. By doing so, the method determines whether the feature code of a given app matches any known malware feature codes. If a match is found, it indicates that the tested app is a piece of malicious software. Therefore, the construction of a comprehensive database of existing malware feature codes is particularly crucial for these types of methods. Based on whether they contain program semantic information, we can classify the existing malware feature codes into two categories: traditional feature codes (Enck et al. On lightweight mobile phone app certification. Proceedings of the 16th ACM conference on computer and communications security 235–245, 2009; Zhou et al. NDSS 25(4): 50–52, 2012; Seo et al. J Netw Comput Apps 38: 43–53, 2014; Zheng et al. Droid analytics: a signature-based analytic system to collect, extract, analyze, and associate android malware. 2013 12th IEEE international conference on trust, security, and privacy in computing and communications. IEEE, Piscataway 163–171, 2013; Feng et al. Apposcopy: semantics-based detection of android malware through static analysis. Proceedings of the 22nd ACM SIGSOFT international symposium on foundations of software engineering 576–587, 2014) and semantic feature codes (Feng et al. Apposcopy: Semantics-based detection of android malware through static analysis. Proceedings of the 22nd ACM SIGSOFT international symposium on foundations of software engineering 576–587, 2014; Feng et al. Automated synthesis of semantic malware signatures using maximum satisfiability. Preprint. arXiv:1608.06254, 2016).