HashDroid:Extraction of malicious features of Android applications based on function call graph pruning

With the Android system becoming the most popular operating system for mobile smart terminals, it is more likely to be targeted by malware. Therefore, many researches of malicous detection have emerged. Most of the features extracted of current malicious detection are discrete, such as single permission, single API, single component, API sequences and so on. These features can only detect the maliciousness of Android applications, but cannot characterize the malicious behavior of Android applications through these features. In this paper,we propose a method to automatically mine malicious features by pruning the function call graph(FCG) of Android applications. These extracted features not only have a good representation for the malicious behavior of Android applications, but also can efficiently detect the malicious. The method uses simhash to characterize the pruned subgraphs of FCG, and selects the subgraphs which play a decisive role in determining maliciousness as malicious features. These malicious features are then used for malicious detection of Android applications. The verification on public datasets shows that our method has a good effect of more than 97% in malicous detection of Android applications.