Skip to main content

Research Repository

Advanced Search

MAMADROID: Detecting Android Malware by Building Markov Chains of Behavioral Models

Mariconti, Enrico; Onwuzurike, Lucky; Andriotis, Panagiotis; De Cristofaro, Emiliano; Ross, Gordon; Stringhini, Gianluca


Enrico Mariconti

Lucky Onwuzurike

Profile Image

Dr Panos Andriotis
Senior Lecturer in Computer Forensics and Security

Emiliano De Cristofaro

Gordon Ross

Gianluca Stringhini


The rise in popularity of the Android platform has resulted in an explosion of malware threats targeting it. As both Android malware and the operating system itself constantly evolve, it is very challenging to design robust malware mitigation techniques that can operate for long periods of time without the need for modifications or costly re-training. In this paper, we present MAMADROID, an Android malware detection system that relies on app behavior. MAMADROID builds a behavioral model, in the form of a Markov chain, from the sequence of abstracted API calls performed by an app, and uses it to extract features and perform classification. By abstracting calls to their packages or families, MAMADROID maintains resilience to API changes and keeps the feature set size manageable. We evaluate its accuracy on a dataset of 8.5K benign and 35.5K malicious apps collected over a period of six years, showing that it not only effectively detects malware (with up to 99% F-measure), but also that the model built by the system keeps its detection capabilities for long periods of time (on average, 86% and 75% F-measure, respectively, one and two years after training). Finally, we compare against DROIDAPIMINER, a state-of-the-art system that relies on the frequency of API calls performed by apps, showing that MAMADROID significantly outperforms it.


Mariconti, E., Onwuzurike, L., Andriotis, P., De Cristofaro, E., Ross, G., & Stringhini, G. (2017, February). MAMADROID: Detecting Android Malware by Building Markov Chains of Behavioral Models. Paper presented at NDSS Symposium 2017

Presentation Conference Type Conference Paper (unpublished)
Conference Name NDSS Symposium 2017
Start Date Feb 26, 2017
End Date Mar 1, 2017
Acceptance Date Nov 13, 2016
Publication Date Feb 1, 2017
Peer Reviewed Peer Reviewed
Additional Information Title of Conference or Conference Proceedings : NDSS Symposium 2017