MalScan: Fast MarketWide Mobile Malware Scanning by SocialNetwork Centrality Analysis Malware scanning of an app market is expected to be scalable and effective. However, existing approaches use either syntaxbased features which can be evaded by transformation attacks or semanticbased features which are usually extracted by performing expensive program analysis. Therefor, in this paper, we propose a lightweight graphbased approach to perform Android malware detection. Instead of traditional heavyweight static analysis, we treat function call graphs of apps as social networks and perform socialnetworkbased centrality analysis to represent the semantic features of the graphs. Our key insight is that centrality provides a succinct and faulttolerant representation of graph semantics, especially for graphs with certain amount of inaccurate information (e.g., inaccurate call graphs). We implement a prototype system, MalScan, and evaluate it on datasets of 15,285 benign samples and 15,430 malicious samples. Experimental results show that MalScan is capable of detecting Android malware with up to 98% accuracy under one second which is more than 100 times faster than two stateoftheart approaches, namely MaMaDroid and Drebin. We also demonstrate the feasibility of MalScan on marketwide malware scanning by performing a statistical study on over 3 million apps. Finally, in a corpus of dataset collected from GooglePlay app market, MalScan is able to identify 18 zeroday malware including malware samples that can evade detection of existing tools.

KerTSDroid: Detecting Android Malware at Scale through Kernel Task Structures The explosive growth of data makes static and dynamic analysis in an individual machine difficult to detect Android malware. Hence many popular opensource frameworks for largescale data processing have been used to deal with iterative machine learning tasks due to the efficient parallel computation and the inmemory abstraction. In this paper we first propose KerTSDroid, a novel Android malware detection framework, to predict the malicious applications in parallel through kernel task structures in Android kernel layer. Then a data provider is orchestrated and implemented to construct the realworld dataset of 112 kernel features from 12,750 Android applications. A parallel predictor is also provided to identify Android malicious applications. Our experiments demonstrate that a Decision Tree method of KerTSDroid can achieve the best precision rate (96%99%) with a lower overhead on average, the other three methods (Naive Bayes, Logistic Regression, and Support Vector Machine) lead to lower precision rate while discriminating abnormal behaviors with the inmemory paralleldata.