ºÝºÝߣ

ºÝºÝߣShare a Scribd company logo

Droid swan

•
•
P
Phani Reddy

This document discusses the development of DroidSwan, a machine learning model for detecting Android malware. It begins with background on the prevalence of Android malware and need for detection techniques. It then outlines the process used to build DroidSwan, including collecting a dataset of malware and benign apps, extracting relevant features, deriving an optimal feature set, and building and testing the classifier model. Key features for detection included suspicious permissions, permission combinations, API calls, and manifest violations. The document concludes by presenting DroidSwan's performance based on metrics like ROC curve, recall rate, and detection rate.

1 of 32
Download to read offline
Droid swan
Presentation Structure 01 Why DroidSwan? 02 Android and Malware 03 Building DroidSwan 05 Extracting Features 06 Deriving Feature set 07 DroidSwan Working 04 Identifying Features 08 DroidSwan Performance
Why DroidSwan? Of all mobile malware applications target Android platform 98%
Why DroidSwan? Of all mobile malware applications target Android platform Decrease in Number of Malware samples removed from PlayStore 98% 60%
Why DroidSwan? 338% Of all mobile malware applications target Android platform Decrease in Number of Malware samples removed from PlayStore Increase in Number of Malware samples on Google’s PlayStore 98% 60%
Malware and Android
Malware and Android Surveillance
Malware and Android Surveillance Data Theft
Malware and Android Surveillance Data Theft Privacy Invasion
Malware and Android Surveillance Data Theft Botnet Activity Privacy Invasion
Malware and Android Surveillance Impersonation Data Theft Botnet Activity Privacy Invasion
Building DroidSwan Collecting Malware and Benign data set Updating classifier with new data Feature set efficiency analysis Building classifier model Deriving feature set Identifying crucial features
Identifying Features Features Suspicious Permissions
Identifying Features Features Suspicious Permissions Suspicious Permission Combinations
Permissions Usage Trends in Malware Samples
Identifying Features Features Suspicious Permissions Suspicious Permission Combinations Suspicious API Combinations
Identifying Features Features Suspicious Permissions Suspicious Permission Combinations Suspicious API Combinations Presence of Executables
Identifying Features Features Suspicious Permissions Suspicious Permission Combinations Suspicious API Combinations Manifest Violation Presence of Executables
Features Suspicious Permissions Suspicious Permission Combinations Suspicious API Combinations Suspicious Content URI Manifest Violation Presence of Executables Identifying Features
80.57% Content URI Usage Trends in Malware Samples 40% 78.8% 18%
Extracting Features APK APK Parser Suspicious Permissions Suspicious permission Combinations
Extracting Features APK APK Parser Dexdump Suspicious Permissions Suspicious permission Combinations Suspicious API Combinations Suspicious Content URI Manifest Violation
Extracting Features APK APK Parser Dexdump Jar Disassembler Executables in resources Suspicious Permissions Suspicious permission Combinations Suspicious API Combinations Suspicious Content URI Manifest Violation
Deriving Feature Set Three variations of feature set considered : •Weighted feature set with ED as a feature •Weighted feature set without ED as a feature •Non-Weighted feature set
Deriving Feature Set
Deriving Feature Set
DroidSwan Working
DroidSwan Performance ROC curve
DroidSwan Performance Recall Rate
DroidSwan Performance Detection Rate
Babu Rajesh V has been working for three years in the field of mobile security and malware analysis. His areas of interests include mobile security and embedded security Himanshu Pareek has around six years of experience in developing and design of security solutions related to small sized networks. He has research papers published on topics like malware detection based on behaviour and application modelling Mahesh U Patil received master degree in electronics and communication. Presently he is working as Principal Technical Officer at CDAC. His research interests include Mobile Security and Embedded Systems Phaninder Reddy has been working for two years in the field of mobile security and malware analysis. His areas of interests include machine learning and data analytics Our Team
Droid swan

More Related Content

Droid swan