The widespread usage of mobile devices and their seamless adaptation to each user’s needs through useful applications (apps) makes them a prime target for malware developers. Malware is software built to harm the user, e.g., to access sensitive user data, such as banking details, or to hold data hostage and block user access. These apps are distributed in marketplaces that host millions and therefore have their forms of automated malware detection in place to deter malware developers and keep their app store (and reputation) trustworthy. Nevertheless, a non-negligible number of apps can bypass these detectors and remain available in the marketplace for any user to download and install on their device. Current malware detection strategies rely on using static or dynamic app extracted features (or a combination of both) to scale the detection and cover the growing number of apps submitted to the marketplace. In this paper, the main focus is on the apps that bypass the malware detectors and stay in the marketplace long enough to receive user feedback. This paper uses real-world data provided by an app store. The quantitative ratings and potential alert flags assigned to the apps by the users were used as features to train machine learning classifiers that successfully classify malware that evaded previous detection attempts. These results present reasonable accuracy and thus work to help to maintain a user-safe environment.

This work is part of the AppSentinel project, co-funded by Lisboa2020/ Portugal2020/EU in the context of the Portuguese Sistema de Incentivos à I&DT—Projetos em Copromoção (project 33953). The authors would like to thank Aptoide for all the collaboration.

Machine learning,Malware detection,Mobilie security

• Ciências da Computação e da Informação - Ciências Naturais
• Engenharia Eletrotécnica, Eletrónica e Informática - Engenharia e Tecnologia