Detecção de aplicativos maliciosos no sistema operacional android por meio de análise estática automatizada

Abstract

The mobile applications platform known as Android provides a wide an open environment of application development to all kinds of software, however this freedom can bring possible software security vulnerabilities that can be used unfortunately to create threats to the operation system. There are vulnerabilities that comes from software and hardware that allows the creation of threats called: spyware, diverse kinds of malware, and with raising popularity, the ransomware. In this case is necessary to build application analysis to find out threats that are increasing in size and complexity. To accomplish this task, this research proposes a technique that combines multiple strategies to orchestrate a new technique that can detect threats and vulnerabilities inside applications developed to the Android mobile operational system. The strategy combines automatic static analysis and threat profile identification by metadata from an external source. Using techniques like web crawling to collect metadata from application stores, we generated a data set with 1000 applications, which 500 are infected and 500 aren't, using balancing technique such as super sampling, extraction and selection of features like: TF-IDF, frequency of terms, feature conversion from nominal to binary and normalization. Using the generated data set to create classification models with the most used machine learning algorithms used by other researchers, we could provide precision metrics, false positives, and false negatives at acceptable rates, comparable to other researches that presents the same performance metrics.