O impacto da seleção de permissões na detecção de malwares Android

Abstract

The number of malicious apps is growing rapidly on the Android platform. Currently, many researches use predictive machine learning models to detect Android malware. To tackle the scalability challenge derived from this context, there are works that propose the use of a reduced number of permissions, as is the case with SigPID. In this work, we present a survey of the Android permissions most frequently used in machine learning methods and the performance of SigPID reproduction, including the 3 levels of permission selection and implementation and evaluation of the main learning methods. Unlike the original work, the reproduction was performed using a publicly available dataset. We compared the permissions at each selection level with the 32 permissions identified as the most recurring; the 113 from the chosen public dataset and the 22 permissions (contained in the dataset) considered dangerous by Google. Our initial study indicates that the number of permissions impacts training and execution time, as well as the accuracy of models. However, the execution time may not be significant enough to justify a smaller number of permissions for malware detection (e.g., reduction from 113 permissions to 27).