RAX-ClaMal: Dynamic Android malware classification based on RAX register values

HIEN DO

15:17 06/01/2025

Detecting malware on Android remains a major challenge because malicious apps use sophisticated evasion techniques. This study presents RAX-ClaMal, a novel approach leveraging dynamic analysis of RAX (Register a Extended) register values for Android malware detection. By extracting and examining the RAX register in the data sections from Dalvik Executable (DEX) files, RAX-ClaMal monitors changes in RAX register values to identify malicious behavior. Employing the Jaccard similarity index for classification, the method achieved a precision of 95.38%, a false positive rate of 1.59%, and an average detection time of 9.54 s per sample on the CICMalDroid2020 dataset. These results underscore the potential of using register values as indicators of malicious activity within Android applications.

TIN LIÊN QUAN

A study on functionality validation for windows malware mutating using reinforcement learning

To keep pace with the rapid advancements in both the quality and complexity of malware, recent research has extensively employed machine learning (ML) and deep learning (DL) models to detect malicious software, particularly in the widely used Windows system. Despite demonstrating promising accuracy in identifying malware, these models remain vulnerable...

xPriMES: Explainable Reinforcement Learning-guided Mutation Strategy with Dual-Environment Interaction for Evading Black-box Malware Detectors

Malware continues to evolve, exposing weaknesses in conventional detectors and motivating realistic adversarial evaluations. Prior RL-based evasion methods often rely on partial model access or feature-level perturbations, limiting realism under strict black-box constraints. We propose xPriMES, a dual-environment reinforcement learning framework that generates functionality-preserving binary mutations for malware evasion in...

Android malware detection by using graph optimization of static features based on pre-trained language models

Android malware detection by using graph optimization of static features based on pre-trained language models