Android Malware Detection Using Permission Analysis

Android applications are widely used by millions of users to perform many different activities. However, many applications have been reported to be malware performing activities not matching with their expected behaviors (e.g., sending SMS message to premium numbers). The existing relevant approaches that identify these applications (malware detection technique) suffer from performance issues where the occurrence of false negatives (FN) remain high. These approaches are not scalable and provides little flexibility to query based on a set of suspicious permission to identify a set of highly relevant known anomalous applications to examine further. This paper proposes a new approach to reduce the number of apps that must be sandboxed in order to determine if they are malicious. We first examine the source of applications to identify list of permissions and find a set of highly close and relevant applications from a given set. The identified most relevant application category's permission is then checked to find if there is significant overlapping or not to identify an application as suspected anomalous. We apply Latent Semantic Indexing (LSI) to identify malware application. Our initial evaluation results suggest that the proposed approach can identify malware applications accurately.