[Paper Review] MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models

Enrico Mariconti, Lucky Onwuzurike+4 more|arXiv (Cornell University)|Dec 13, 2016

Advanced Malware Detection Techniques4 citations

TL;DR

MaMaDroid is a behavioral Android malware detection system that models app execution sequences using Markov chains over abstracted API calls (by package or family), achieving up to 99% F-measure in malware detection and maintaining 87% and 73% F-measure after one and two years, respectively, demonstrating strong long-term robustness against API evolution and superior resilience compared to state-of-the-art systems like DroidAPIMiner.

ABSTRACT

The rise in popularity of the Android platform has resulted in an explosion of malware threats targeting it. As both Android malware and the operating system itself constantly evolve, it is very challenging to design robust malware mitigation techniques that can operate for long periods of time without the need for modifications or costly re-training. In this paper, we present MaMaDroid, an Android malware detection system that relies on app behavior. MaMaDroid builds a behavioral model, in the form of a Markov chain, from the sequence of abstracted API calls performed by an app, and uses it to extract features and perform classification. By abstracting calls to their packages or families, MaMaDroid maintains resilience to API changes and keeps the feature set size manageable. We evaluate its accuracy on a dataset of 8.5K benign and 35.5K malicious apps collected over a period of six years, showing that it not only effectively detects malware (with up to 99% F-measure), but also that the model built by the system keeps its detection capabilities for long periods of time (on average, 86% and 75% F-measure, respectively, one and two years after training). Finally, we compare against DroidAPIMiner, a state-of-the-art system that relies on the frequency of API calls performed by apps, showing that MaMaDroid significantly outperforms it.

Motivation & Objective

• To address the challenge of detecting evolving Android malware that bypasses traditional signature-based and permission-based detection methods.
• To develop a malware detection system resilient to Android API changes and long-term evolution of malware behavior.
• To improve detection accuracy and longevity of models by modeling behavioral sequences rather than relying on static API call frequencies or permissions.
• To evaluate the system on a large-scale dataset of 44K apps spanning six years to ensure real-world applicability and robustness.

Proposed method

• Abstracts Android API calls to either their package name or family (e.g., android, java) to reduce sensitivity to individual API changes.
• Constructs a Markov chain model from the sequence of abstracted API calls to capture behavioral patterns of apps.
• Uses the Markov chain to extract statistical features representing transition probabilities between API call families or packages.
• Performs binary classification (benign vs. malicious) using the extracted features, with two abstraction granularities: family-level and package-level.
• Employs static analysis to extract API call sequences from Android apps without requiring runtime execution.
• Trains a classifier on a dataset of 8.5K benign and 35.5K malicious apps collected from 2010 to 2016 to evaluate long-term performance.

Experimental results

Research questions

• RQ1 Can modeling sequences of abstracted API calls via Markov chains effectively distinguish between benign and malicious Android apps?
• RQ2 How does MaMaDroid’s detection performance degrade over time, particularly with evolving Android APIs and malware variants?
• RQ3 How does MaMaDroid compare in accuracy and robustness to DroidAPIMiner, a state-of-the-art system based on frequent API call patterns?
• RQ4 To what extent does abstraction of API calls to families or packages improve resilience to Android framework evolution?

Key findings

• MaMaDroid achieves a peak F-measure of 99% in detecting Android malware on a dataset of 43,989 apps, including 35,500 malicious samples.
• After one year from training, the system maintains an F-measure of 87%, and after two years, it retains 73%, demonstrating strong long-term detection stability.
• MaMaDroid significantly outperforms DroidAPIMiner in both initial detection accuracy and long-term robustness, particularly due to its abstraction-based resilience to API changes.
• The system’s behavioral modeling approach is more resilient to Android API evolution than frequency-based methods, reducing the need for frequent retraining.
• The use of Markov chains over abstracted API call sequences captures meaningful behavioral patterns that distinguish malware from benign apps, even when malware uses non-standard or deprecated APIs.
• The dataset used in the evaluation, comprising 43,989 apps over six years, is the largest ever used in a research paper for Android malware detection.