Modeling and Capturing Malicious Behavior to Detect Android Malware

The proliferation of Android devices worldwide has fostered an environment conducive to hackers, compelling them to direct their efforts toward Android mobile devices by deploying intricate and sophisticated malware. The malicious actors skillfully employ obfuscation techniques such as polymorphism and dynamic code loading to circumvent conventional malware detection mechanisms. In response to this challenge, our research presents a comprehensive framework to identify Android malware and categorize it into different families based on its run-time behaviors. Our proposed approach starts with parsing system call logs extracted from dynamic analyses of applications. This parsing facilitates the creation of Behavioral Call Graphs (BCGs) through an innovative methodology that accentuates the interrelationships among API calls. Leveraging representation learning algorithms, we represent the inherent characteristics embedded within these BCGs into feature vectors, eliminating the need for manual feature extraction. This work illustrates the efficacy of the framework in achieving highly accurate results in detecting malware and identifying compromised applications.