Malware developers often use various obfuscation techniques to generate polymorphic and metamorphic versions of malicious programs. As a result, variants of a malware family generally exhibit resembling behavior, and most importantly, they possess certain common essential codes so to achieve the same designed purpose. Meantime, keeping up with new variants and generating signatures for each individual in a timely fashion has been costly and inefficient for anti-virus software companies. It motivates us the idea of no more dancing with variants. In this paper, we aim to find a malware family's main characteristic operations or activities directly related to its intent. We propose a novel automatic dynamic Android profiling system and malware family runtime behavior signature generation method called Runtime API sequence Motif Mining Algorithm (RasMMA) based on the analysis of the sensitive and permission-related execution traces of the threads and processes of a set of variant APKs of a malware family. We show the effectiveness of using the generated family signature to detect new variants using real-world dataset. Moreover, current anti-malware tools usually treat detection models as a black box for classification and offer little explanations on how malwares behave and how they proceed step by step to infiltrate targeted system and achieve the goal. We take malware family DroidKungFu as a case study to illustrate that the generated family signature indeed captures key malicious activities of the family.

This study presents a simple but high performance vector quantisation (VQ) codebook search algorithm for line spectral frequency quantisation in ITU‐T G.729 speech codec, designated as the binary search space‐structured VQ (BSS‐VQ) algorithm. This is done through a combined use of a fast locating technique and lookup tables, such that an input vector, ahead of VQ encoding, is assigned efficiently to a subspace where merely a small number of codeword searches are required to be performed. As a consequence, the computational load is reduced remarkably. A trade‐off can be made easy to meet a user's requirement when performing VQ encoding. It is experimentally validated that a search accuracy is well maintained at 99% approximately for a threshold of quantisation accuracy of 0.99. More importantly, with a full search algorithm as a benchmark for search load comparison, this proposal provides a 85% search load reduction, a figure far beyond 43% in multiple triangular inequality elimination approach, 47% in TIE with dynamic and intersection rules and 59% in quasi‐binary search VQ algorithm.