Building a dynamic malware classifier

In certain situations, there is a considerable advantage to being able to detect malware based on its behavior. In particular, it is much more difficult for a malware to hide its intentions when it is being analyzed in a dynamic situation. For this reason, classifiers that operate on dynamic information can be much more accurate than their static counterparts. In this section, we provide a recipe for a dynamic malware classifier. The dataset we use is part of a VirusShare repository from android applications. The dynamic analysis was performed by Johannes Thon on several LG Nexus 5 devices with Android API 23, (over 4,000 malicious apps were dynamically analyzed on the LG Nexus 5 device farm (API 23), and over 4,300 benign apps were dynamically analyzed on the LG Nexus 5 device farm (API 23) by goorax, used under CC BY / unmodified from the...