@inproceedings{fc0970b872ed48938e87eb313acf39c8,
title = "Applying behavioral detection on android-based devices",
abstract = "We present Andromaly - a behavioral-based detection framework for Android-powered mobile devices. The proposed framework realizes a Host-based Intrusion Detection System (HIDS) that continuously monitors various features and events obtained from the mobile device, and then applies Machine Learning methods to classify the collected data as normal (benign) or abnormal (malicious). Since no malicious applications are yet available for Android, we evaluated Andromaly's ability to differentiate between game and tool applications. Successful differentiation between games and tools is expected to provide a positive indication about the ability of such methods to learn and model the behavior of an Android application and potentially detect malicious applications. Several combinations of classification algorithms, feature selections and the number of top features were evaluated. Empirical results suggest that the proposed detection framework is effective in detecting types of applications having similar behavior, which is an indication for the ability to detect unknown malware in the Android framework.",
keywords = "Android, Intrusion detection, Machine learning, Malware, Mobile devices, Security",
author = "Asaf Shabtai and Yuval Elovici",
year = "2010",
month = dec,
day = "1",
doi = "10.1007/978-3-642-17758-3_17",
language = "English",
isbn = "3642177573",
series = "Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering",
pages = "235--249",
booktitle = "Mobile Wireless Middleware, Operating Systems, and Applications - Third International Conference, Mobilware 2010, Revised Selected Papers",
note = "3rd International Conference on Mobile Wireless Middleware, Operating Systems, and Applications, Mobilware 2010 ; Conference date: 30-06-2010 Through 02-07-2010",
}