A Visual Android Malware Detection Technique Based on Process Memory Dump Files
摘要
Android-based smartphones dominate the market, constituting approximately 70% of total smartphone usage. However, this popularity makes them prime targets for malware attacks due to the sensitive financial and personal data they store. Consequently, there's a pressing need for effective malware detection techniques to combat these threats. To address this challenge, we devised a novel visual malware detection method to process memory dump files. Previous research based on visual techniques does not consider Android process memory dump strings. In general, obtaining strings from the memory of Android processes can help with malware detection, analysis, and mitigation by offering essential insights into the functionality and dynamic behavior of the malware by uncovering obfuscated or encrypted Strings. Our approach entails converting Android process memory dump files into grayscale images. Each byte within these memory dump files is meticulously processed, transforming them into consistent binary representations. These binary sequences serve as the foundation for generating grayscale images. Subsequently, features such as color histograms, Hu moments, and Haralick textures are extracted from these grayscale images. Machine learning classifiers are trained to differentiate between benign and malicious Android applications using the abovementioned extracted features. We used four machine learning classifiers, i.e., Random Forest, SVM, KNN, and Logistic regression. The Random Forest proves to give best results among them.