CSCdroid: Accurately Detect Android Malware via Contribution-Level-Based System Call Categorization

The detection of the malicious application or malware on Android platform is a very concerned issue. Many studies have demonstrated their effect from static property analysis and dynamic analysis. However, their accuracy and efficacy still cannot satisfy the demand. In this paper, we propose CSCdroid, an accurate malware detection approach for Android via contribution-level-based system call (SC) categorization. Different from existing works, which use all SCs to construct feature vectors so as to determine the security of applications, CSCdroid first introduces a concept named contribution to quantitatively evaluate SCs relevance for malware identification. Based on the contribution level, CSCdroid can categorize SCs into two types, determinate SCs and normal SCs. Eventually, CSCdroid builds a Markov chain by replacing all normal SCs with one specific SC in the SC sequence. Then it constructs the target feature vector from the probability matrix and use the Support Vector Machine (SVM) to detect Android malware. Such way can effectively reduce the state number of Markov chains, and cut down the dimension of the feature vectors into the SVM classifier. Our evaluation confirms our approach possesses the malware detection ability with a high accuracy rate.