Risk Assessment Scheme for Mobile Applications Based on Tree Boosting

Abstract

In the forthcoming era of IoT, where everything will be connected, mobile devices will play a key role in providing data sharing and user-centric services between devices. In such a service environment, if a mobile application is vulnerable to security threats and exposed to malicious behavior, malware can spread to hundreds of millions of connected devices. In particular, it is important to isolate and respond quickly to malicious mobile code. This requires the prediction of malicious behavior. Currently, security risk assessment schemes based on the permission use the description of the application or user review, but these schemes mostly offer a subjective evaluation, which inevitably reduces accuracy. In this paper, we thus propose a scheme for assessing security risk of Android mobile applications by analyzing their application programming interfaces (APIs) using machine learning. The key idea of the proposed scheme is to extract the APIs from the execution code of the application with reverse engineering analysis, such that each API can be compared with the malicious API database built from the existing malware dataset. Instead of simply judging the applications as malicious or benign, our scheme shows their risk as a score. To do this quantitative evaluation, we use an ensemble of tree boosting machine learning algorithms. To prove the practicality of the proposed scheme, we experiment with a set of benign and malicious real world samples, and compare our results with existing schemes. Experimental results show better performance and accuracy than conventional schemes based on Naive Bayes and simple ensemble algorithms. Our proposed scheme is expected to significantly contribute in responding rapidly to ever-more-intelligent malware of the future.

Keywords

• Malware detection
• machine learning
• XGBoost
• risk assessment