دانلود رایگان ترجمه مقاله رده بندی بدافزار اندروید با استفاده از الگوریتم خوشه بندی کی-میانگین (نشریه IOP 2017)

رده بندی بدافزار اندروید با استفاده از الگوریتم خوشه بندی کی-میانگین

Android Malware Classification Using K-Means Clustering Algorithm

Abstract

Malware was designed to gain access or damage a computer system without user notice. Besides, attacker exploits malware to commit crime or fraud. This paper proposed Android malware classification approach based on K-Means clustering algorithm. We evaluate the proposed model in terms of accuracy using machine learning algorithms. Two datasets were selected to demonstrate the practicing of K-Means clustering algorithms that are Virus Total and Malgenome dataset. We classify the Android malware into three clusters which are ransomware, scareware and goodware. Nine features were considered for each types of dataset such as Lock Detected, Text Detected, Text Score, Encryption Detected, Threat, Porn, Law, Copyright and Moneypak. We used IBM SPSS Statistic software for data classification and WEKA tools to evaluate the built cluster. The proposed K-Means clustering algorithm shows promising result with high accuracy when tested using Random Forest algorithm.

1 Introduction

Malware is developed to gain an access or damage computer without the user’s knowledge. There are many cases of malware such as spyware, key loggers, or viruses that affect organization data processor [1]. Malware continues to grow and evolve to bypass antivirus and other levels of protection, which makes it hard for security team to keep up. More than 4,000 ransomware attacks have occurred every day since year 2016 [18]. That is a 300% increase over year 2015, where 1,000 ransomware attacks were seen per day. Through malware, criminals are able to infect large numbers of victims at once by automating these attacks and extend the reach of their infections to multiple systems per victim. This can cause more damage and potential downtime which put more pressure on victims to resolve the issue quickly. Commonly, people stored important data on electronic devices such as laptop and mobile device without making any backup. Once the electronic devices being infected or attacked by Android malware, it is difficult to retrieve the data back.

There are two types of Android malware which are Ransomware and Scareware. Ransomware exploded into a billion-dollar industry in 2016 that create a gold-rush atmosphere for cyber criminals, with demand for and supply of new ransomware variants and delivery platforms [19]. Ransomware works through spam email which contains malicious attachment. The malicious attachment asked the user to open the attachment with a convincing appearance. Once infected, ransomware prohibits or limits the user from accessing the system either lock the computer’s screen or encrypt file that had been typeset with a password [6]. Then, ransom message is displayed which instruct the user to pay ransom money through payment system such as Ukash or Paysafecard [2] in order to have the access again. Conversely, scareware is known as fake anti-virus software which becomes the most common methods to deceive the victim’s money. Microsoft detected scareware approximately 52 million times in United States in year 2011 [7]. The scareware program looks similar with the legitimate security programs. Normally, the scareware claimed that it has detected a large number of nonexistent threats on the computer and then urge the victim to pay for full version of the software to remove the threats.

This paper focus on Android malware classification using K-Means clustering algorithm tested on two datasets extracted from ransom.mobi detector [3]. Virus Total dataset consists of 907 samples while Malgenome dataset consists of 1255 samples. Both datasets have nine types of features which include Lock Detected, Text Detected, Text Score, Encryption Detected, Threat, Porn, Law, Copyright and Moneypak. Then, the Android malware class which is build using K-Means clustering algorithm will be analysed using Random Forest algorithm [4]. The objectives of this paper are:

a) to design an Android malware classification model based on behaviour approach.

b) to classify the Android malware using K-Means clustering algorithm.

c) to evaluate the proposed model in terms of accuracy using machine learning algorithms.

The rest of the paper is organized as follows: Section 2 describes the related work on Android malware classification and K-Means clustering technique. Section 3 presents the proposed classification model for Android malware classification where each cluster prediction becomes elements of the cluster. The cluster constructed from rule-based clustering algorithm is then used to train the classifier algorithm. Section 4 shows the performance analysis evaluation methodologies and experimental results. Finally, Section 5 concludes the work and highlights a future research.