Detecting Android Malware by Combining System Call Sequence Relationships with Local Feature Calculation

Android, the most popular operating system in the mobile market, is the main target of hackers. The dynamic analysis in malware analysis is not affected by obfuscation and dynamic loading attacks. Therefore, this study uses a dynamic detection approach and uses system calls as a feature to represent the behaviour of an application. The TF-IDF feature processing method can assign different weights to the system call features according to the number of occurrences and the overall relationship, but this method uses one system call as a unit and therefore does not calculate the pre- and post- sequence relationships, which are important in system call sequences. This study uses the concept of n-grams to form system call groups combined with local TF-IDF to allow sequence-based data to be characterised by the pre-post relationship and importance of the sequences, and to analyse Android applications on a deep learning model that has shown excellent classification results in the field of malware detection. In this study, it is shown that this method improves the accuracy of multiple classification of apps by more than 3% and 11% for the unknown 2019 dataset.