ARP-miner: Mining risk patterns of android malware

Abstract

Android applications need to request permissions to access sensitive personal data and system resources. Certain permissions may be requested by Android malware to facilitate their malicious activities. In this paper, we present ARP-Miner, an algorithm based on association rule mining that can automatically extract Android Risk Patterns indicating possible malicious activities of apps. The experimental results show that ARP-Miner can efficiently discover risk rules associating permission request patterns with malicious activities. Examples to relate the extracted risk patterns with behaviors of typical malware families are presented. It is also shown that the extracted risk patterns can be used for malware detection.