Android Malware Detector Based on Sequences of System Calls and Bidirectional Recurrent Networks

With the increasing popularity and wide-spread use of Android systems to empower a variety of devices including smart phones, tablets, watches, televisions, and cars, security becomes a more crucial issue, especially with the increasing level of attacks targeting vulnerabilities in these systems. Subsequently, new approaches need to be explored to detect more sophisticated malware designed to evade detection by installed anti-malware software. This paper presents a new methodology for behavioral analysis of sequences of system calls incurred by various applications to distinguish Android malware from benign applications. We model these sequences using two variants of bidirectional deep recurrent neural networks: Long Short Term Memory (LSTM) and Gated Recurrent Unit (GRU). The performance is evaluated and compared with other systems employing support vector machines and decision trees with traditional feature extraction methods.