Research on data mining of permissions mode for Android malware detection

Android system uses a permission mechanism to allow users and developers to regulate access to private information and system resources required by Android applications (apps). Permissions can be behaviors and characteristics of an app, and widely used by Android malware detection. This paper designs a novel method to extract contrasting permission patterns for comparing the differences between Android benign apps and malware based on permissions, and use these differences to detect Android malware. Unlike existing works, this work first analyzes required and used permission. Then use support-based permission candidate method to mining unique required or used permission patterns, and use these patterns to detect Android malware. In experiment, this approach uses permission patterns from Androidmalware to detect a mixed Android app dataset. The results show that the proposed method can achieve 94% accuracy, 5% false positive, and 1% false negative.