Visible to the public EntropLyzer: Android Malware Classification and Characterization Using Entropy Analysis of Dynamic Characteristics

TitleEntropLyzer: Android Malware Classification and Characterization Using Entropy Analysis of Dynamic Characteristics
Publication TypeConference Paper
Year of Publication2021
AuthorsKeyes, David Sean, Li, Beiqi, Kaur, Gurdip, Lashkari, Arash Habibi, Gagnon, Francois, Massicotte, Frédéric
Conference Name2021 Reconciling Data Analytics, Automation, Privacy, and Security: A Big Data Challenge (RDAAPS)
KeywordsAndroid malware, Automation, Batteries, Big Data, Data analysis, data privacy, Entropy, entropy analysis, Human Behavior, Malware, malware analysis, malware behavior, malware characterization, malware classification, Metrics, privacy, pubcrawl, resilience, Resiliency
AbstractThe unmatched threat of Android malware has tremendously increased the need for analyzing prominent malware samples. There are remarkable efforts in static and dynamic malware analysis using static features and API calls respectively. Nonetheless, there is a void to classify Android malware by analyzing its behavior using multiple dynamic characteristics. This paper proposes EntropLyzer, an entropy-based behavioral analysis technique for classifying the behavior of 12 eminent Android malware categories and 147 malware families taken from CCCS-CIC-AndMal2020 dataset. This work uses six classes of dynamic characteristics including memory, API, network, logcat, battery, and process to classify and characterize Android malware. Results reveal that the entropy-based analysis successfully determines the behavior of all malware categories and most of the malware families before and after rebooting the emulator.
DOI10.1109/RDAAPS48126.2021.9452002
Citation Keykeyes_entroplyzer_2021