A framework for Android Malware detection and classification

The increasing number of mobile devices using the Android operating system in the market makes these devices the first target for malicious applications. In recent years, several Android malware applications were developed to perform certain illegitimate activities and harmful actions on mobile devices. In response, specific tools and anti-virus programs used conventional signature-based methods in order to detect such Android malware applications. However, the most recent Android malware apps, such as zero-day, cannot be detected through conventional methods that are still based on fixed signatures or identifiers. Therefore, the most recently published research studies have suggested machine learning techniques as an alternative method to detect Android malware due to their ability to learn and use the existing information to detect the new Android malware apps. This paper presents the basic concepts of Android architecture, Android malware, and permission features utilized as effective malware predictors. Furthermore, a comprehensive review of the existing static, dynamic, and hybrid Android malware detection approaches is presented in this study. More significantly, this paper empirically discusses and compares the performances of six supervised machine learning algorithms, known as K-Nearest Neighbors (K-NN), Decision Tree (DT), Support Vector Machine (SVM), Random Forest (RF), Naïve Bayes (NB), and Logistic Regression (LR), which are commonly used in the literature for detecting malware apps.

Student outcomes are of great importance in higher education institutions. Accreditation bodies focus on them as an indicator to measure the performance and effectiveness of the institution. Forecasting students’ academic performance is crucial for every educational establishment seeking to enhance performance and perseverance of its students and reduce the failure rate in the future. The main goal of this study is to predict the performance of undergraduate first-level students in the Computer Department during the years 2016 to 2021 to enhance their performance in future by discovering the best algorithm use to analyze the educational data to identify the students’ academic performance. The secondary data was collected by reviewing the Student Affairs Department at the Faculty of Specific Education at Damietta University, in addition to the Statistics Department at the university. The dataset contained 830 instances after excluding 139 instances of missing values, irrelevant rows, and outliers. The dataset was divided into train (577 instances (70%)), test (253 instances (30%)) and involved six features such year, midterm, practical exam, writing exam, final total degree, and grade. This paper use five machine learning (ML) algorithms which was selected according to the literature review and high accuracy in predicting educational data mining: For the purpose of comparison, a number of different machine learning algorithms, such as Random Forest, Decision Tree, Naive Bayes, Neural Network, and K-Nearest Neighbours, were utilized and evaluated with evaluation metrics such as confusion matrix, accuracy, precision, recall, and F-measure. The Random Forest and Decision Tree classifiers emerged as the top-performing algorithms, accurately categorizing 250 instances when predicting students' performance in the statistics course. This was determined based on the findings of the study. Out of a total of 253 instances that were included in the testing set, they only made three incorrect classifications.

The popularity of Android mobile phones has caused more cybercriminals to create malware applications that carry out various malicious activities. The attacks, which escalated after the COVID-19 pandemic, proved there is great importance in protecting Android mobile devices from malware attacks. Intelligent Mobile Malware Detection will teach users how to develop intelligent Android malware detection mechanisms by using various graph and stochastic models. The book begins with an introduction to the Android operating system accompanied by the limitations of the state-of-the-art static malware detection mechanisms as well as a detailed presentation of a hybrid malware detection mechanism. The text then presents four different system call-based dynamic Android malware detection mechanisms using graph centrality measures, graph signal processing and graph convolutional networks. Further, the text shows how most of the Android malware can be detected by checking the presence of a unique subsequence of system calls in its system call sequence. All the malware detection mechanisms presented in the book are based on the authors' recent research. The experiments are conducted with the latest Android malware samples, and the malware samples are collected from public repositories. The source codes are also provided for easy implementation of the mechanisms. This book will be highly useful to Android malware researchers, developers, students and cyber security professionals to explore and build defense mechanisms against the ever-evolving Android malware.

The Android operating system has gained popularity and evolved rapidly since the previous decade. Traditional approaches such as static and dynamic malware identification techniques require a lot of human intervention and resources to design the malware classification model. The real challenge lies with the fact that inspecting all files of the application structure leads to high processing time, more storage, and manual effort. To solve these problems, optimization algorithms and deep learning has been recently tested for mitigating malware attacks. This manuscript proposes Summing of neurAl aRchitecture and VisualizatiOn Technology for Android Malware identification (SARVOTAM). The system converts the malware non-intuitive features into fingerprint images to extract the quality information. A fine-tuned Convolutional Neural Network (CNN) is used to automatically extract rich features from visualized malware thus eliminating the feature engineering and domain expert cost. The experiments were done using the DREBIN dataset. A total of fifteen different combinations of the Android malware image sections were used to identify and classify Android malware. The softmax layer of CNN was substituted with machine learning algorithms like K-Nearest Neighbor (KNN), Support Vector Machine (SVM), and Random Forest (RF) to analyze the grayscale malware images. It is observed that CNN-SVM model outperformed original CNN as well as CNN-KNN, and CNN-RF. The classification results showed that our method is able to achieve an accuracy of 92.59% using Android certificates and manifest malware images. This paper reveals the lightweight solution and much precise option for malware identification.

Mobile malware detection has attracted massive research effort in our community. A reliable and up-to-date malware dataset is critical to evaluate the effectiveness of malware detection approaches. Essentially, the malware ground truth should be manually verified by security experts, and their malicious behaviors should be carefully labelled. Although there are several widely-used malware benchmarks in our community (e.g., MalGenome, Drebin, Piggybacking and AMD, etc.), these benchmarks face several limitations including out-of-date, size, coverage, and reliability issues, etc. In this paper, we first make efforts to create MalRadar, a growing and up-to-date Android malware dataset using the most reliable way, i.e., by collecting malware based on the analysis reports of security experts. We have crawled all the mobile security related reports released by ten leading security companies, and used an automated approach to extract and label the useful ones describing new Android malware and containing Indicators of Compromise (IoC) information. We have successfully compiled MalRadar, a dataset that contains 4,534 unique Android malware samples (including both apks and metadata) released from 2014 to April 2021 by the time of this paper, all of which were manually verified by security experts with detailed behavior analysis. Then we characterize the MalRadar dataset from malware distribution channels, app installation methods, malware activation, malicious behaviors and anti-analysis techniques. We further investigate the malware evolution over the last decade. At last, we measure the effectiveness of commercial anti-virus engines and malware detection techniques on detecting malware in MalRadar. Our dataset can be served as the representative Android malware benchmark in the new era, and our observations can positively contribute to the community and boost a series of research studies on mobile security.

With the increase in the popularity of mobile devices, malicious applications targeting Android platform have greatly increased. Malware is coded so prudently that it has become very complicated to identify. The increase in the large amount of malware every day has made the manual approaches inadequate for detecting the malware. Nowadays, a new malware is characterized by sophisticated and complex obfuscation techniques. Thus, the static malware analysis alone is not enough for detecting it. However, dynamic malware analysis is appropriate to tackle evasion techniques but incapable to investigate all the execution paths and also it is very time consuming. So, for better detection and classification of Android malware, we propose a hybrid approach which integrates the features obtained after performing static and dynamic malware analysis. This approach tackles the problem of analyzing, detecting and classifying the Android malware in a more efficient manner. In this paper, we have used a robust set of features from static and dynamic malware analysis for creating two datasets i.e. binary and multiclass (family) classification datasets. These are made publically available on GitHub and Kaggle with the aim to help researchers and anti-malware tool creators for enhancing or developing new techniques and tools for detecting and classifying Android malware. Various machine learning algorithms are employed to detect and classify malware using the features extracted after performing static and dynamic malware analysis. The experimental outcomes indicate that hybrid approach enhances the accuracy of detection and classification of Android malware as compared to the case when static and dynamic features are considered alone.

In this technology world, smartphones are greatly adopted by people due to the need of personal communication, Internet and many more requirements. Users are attracted to use the android operating system due its availability for low-cost and millions of freely available applications. The popularity of android operating system is also welcomes the attackers. Statistics have shown that, the growth of android malware is becomes double by every year. Hence android platform is more vulnerable to malwares. Researchers are proposed various models. Some of these models are completely fail to detect unseen variants of malware, while remaining models are inefficient to detect new malware families. In this paper, we briefly explain about android architecture, structure of android application and also characterized android malware based on their installation, activation and payloads types. We proposed a hybrid model to detect the malware based on permission bit-vector and network traffic. We constructed a decision tree classifier to detect the android malware. Our results show that combination of permission bit-vector and network traffic analysis is highly efficient by achieved 95.56% of detection accuracy.

With the growing popularity of autonomous vehicles, ensuring their safety has become a significant concern. Vehicle manufacturers have incorporated the Android operating system to enhance user convenience. However, the Android operating system's diversity and vulnerability may significantly impact autonomous vehicles because these natures lead to a critical threat in autonomous vehicle security: Android malware. The complex nature of multi‐data sources fusion in autonomous driving systems has resulted in low detection efficiency and accuracy for Android malware. Given the security requirements for autonomous‐driving systems, this article presents an Android malware classification method centered around the multifeature fusion and deep learning architecture designed to detect and classify Android malware within autonomous‐driving systems. The proposed MUDROID framework relies on the Android permission mechanism and behavioral feature to formulate a malware classification model. Comprising four essential components—feature extraction, representation, multifeature fusion, and classifier training, MUDROID leverages the advantages of CNN and GCN combination model and is adept at extracting and interpreting multidimensional features, consequently constructing a multifeature fusion classifier to amplify the efficiency and accuracy of Android malware detection and classification. The experiment results support MUDROID's superior classification performance, with an impressive Android malware detection accuracy rate of 98.69% and family classification (95.42%). The proposed method can detect and classify Android malware effectively, thus elevating the security and robustness of the self‐driving system. Additionally, the approach in this article also addresses feature representation issues in detecting malware variants, facilitating the recognition of Android malware variants across diverse platforms.

In this study, we investigated the features that could best represent EEG signals for brain computer interface systems and classifier accuracy was compared using different classification methods. EEG signals data set were taken from “BCI II Competition”. In this study, inadequate features that reduce classification accuracy were determined by using sequential forward selection algorithms and were extracted from real-dimensional feature matrix. The remaining active feature matrix and real-dimensional feature matrix were classified using k-nearest neighbor, subspace K-nearest neighbor, support vector machines, subspace discriminant and random forest decision tree algorithms. As a result of this study, the highest classification accuracy of real-dimensional feature matrix was obtained as 83.8% by random forest decision tree algorithm. In the other, the highest classification accuracy of dimention reductioned feature matrix with sequential forward selection algorthm was obtained as 96.4% by random forest decision tree algorithm.

In these years, deep learning methods are used to detect Android malware due to low efficient manual checking and increase in Android malware. Data set quality defines the performance of these models. Low quality of training data set will result in reduced performance. Manual checking guarantees the data set quality in real world. Trained model may cause failure by malicious applications in Google Play. Artificial bee colony (ABC) algorithm based on selective swarm intelligence technique is proposed to rectify this issue, and it is robust detection technique of Android malware. The data set quality will not affect the effectiveness of solution. Better component learner’s combination can be computed by genetic algorithm in proposed model, which will enhance the robustness of model. In same area, better robust performance is exhibited by the proposed technique than other methods.KeywordsReverse engineeringAndroid malware analysisGenetic algorithmFeature selectionArtificial bee colony (ABC) algorithmMachine learning

Predicting workplace injury using automated techniques opens newer possibilities in evidence-based research. This paper presents our preliminary research in a PhD project in predicting workplace incidents using machine learning algorithms. The analysis on the model performance using several mainstream machine learning algorithms including random forest, k-nearest neighbor and decision tree indicated that the general performance of the decision tree model was found to be statistically higher than that of the other two algorithms.

New technologies like Machine learning and Big data analytics have been proven to provide promising solutions to biomedical communities, healthcare problems, and patient care. They also help in early prediction of disease by accurate interpretation of medical data. Disease management strategies can further be improved by the detection of early signs of disease. This early prediction, moreover, can be helpful in controlling the symptoms of the disease as well as the proper treatment of disease. Machine learning approaches can be used in the prediction of chronic diseases, such as kidney and heart diseases, by developing the classification models. In this paper, we propose a preprocessing extensive approach to predict Coronary Heart Diseases (CHD). The approach involves replacing null values, resampling, standardization, normalization, classification, and prediction. This work aims to predict the risk of CHD using machine learning algorithms like Random Forest, Decision Trees, and K-Nearest Neighbours. Also, a comparative study among these algorithms on the basis of prediction accuracy is performed. Further, $K$ -fold Cross Validation is used to generate randomness in the data. These algorithms are experimented over “Framingham Heart Study” dataset, which is having 4240 records. In our experimental analysis, Random Forest, Decision Tree, and K-Nearest Neighbour achieved an accuracy of 96.8%, 92.7%, and 92.89% respectively. Therefore, by including our preprocessing steps, Random Forest classification gives more accurate results than other machine learning algorithms.

Android malware is continuously evolving at an alarming rate due to the growing vulnerabilities. This demands more effective malware detection methods. This paper presents DynaMalDroid, a dynamic analysis-based framework to detect malicious applications in the Android platform. The proposed framework contains three modules: dynamic analysis, feature engineering, and detection. We utilized the well-known CICMalDroid2020 dataset, and the system calls of apps are extracted through dynamic analysis. We trained our proposed model to recognize malware by selecting features obtained through the feature engineering module. Further, with these selected features, the detection module applies different Machine Learning classifiers like Random Forest, Decision Tree, Logistic Regression, Support Vector Machine, Naïve-Bayes, K-Nearest Neighbour, and AdaBoost, to recognize whether an application is malicious or not. The experiments have shown that several classifiers have demonstrated excellent performance and have an accuracy of up to 99%. The models with Support Vector Machine and AdaBoost classifiers have provided better detection accuracy of 99.3% and 99.5%, respectively.

The disease may be an explicit status that negatively affects human health. Cardiopathy is one of the common deadly diseases that is attributed to unhealthy human habits compared to alternative diseases. With the help of machine learning (ML) algorithms, heart disease can be noticed in a short time as well as at a low cost. This study adopted four machine learning models, such as random forest (RF), decision tree (DT), AdaBoost (AB), and K-nearest neighbor (KNN), to detect heart disease. A generalized algorithm was constructed to analyze the strength of the relevant factors that contribute to heart disease prediction. The models were evaluated using the datasets Cleveland, Hungary, Switzerland, and Long Beach (CHSLB), and all were collected from Kaggle. Based on the CHSLB dataset, RF, DT, AB, and KNN models predicted an accuracy of 99.03%, 96.10%, 100%, and 100%, respectively. In the case of a single (Cleveland) dataset, only two models, namely RF and KNN, show good accuracy of 93.437% and 97.83%, respectively. Finally, the study used Streamlit, an internet-based cloud hosting platform, to develop a computer-aided smart system for disease prediction. It is expected that the proposed tool together with the ML algorithm will play a key role in diagnosing heart diseases in a very convenient manner. Above all, the study has made a substantial contribution to the computation of strength scores with significant predictors in the prognosis of heart disease.

Research efforts in the prediction of stroke and diabetes prioritize early detection in order to enhance patient outcomes. To achieve this, a variety of methodologies are integrated. Existing studies, on the other hand, are marred by imbalanced datasets, lack of diversity in their datasets, potential bias, and inadequate model comparisons; these flaws underscore the necessity for more comprehensive and inclusive research methodologies. This paper provides a thorough assessment of machine learning algorithms in the context of early detection and diagnosis of stroke and diabetes. The research employed widely used algorithms, including Logistic Regression, Decision Tree, Random Forest, K-Nearest Neighbors (KNN), and XGBoost Classifier, to examine medical data and derive significant findings. The XGBoost Classifier demonstrated superior performance, with an outstanding accuracy, precision, recall, and F1-score of 87.5%. The comparative examination of the algorithms indicated that the Decision Tree, Random Forest, and XGBoost classifiers consistently exhibited strong performance across all measures. The models demonstrated impressive discrimination capabilities, with the XGBoost Classifier and Random Forest reaching accuracy rates of roughly 87.5% and 86.5% respectively. The Decision Tree Classifier exhibited notable performance, with an accuracy rate of 83%. The overall accuracy of the models was evident in the F1-score, a metric that incorporates recall and precision, where the XGBoost model exhibited a marginal improvement of 2% over the Random Forest and Decision Tree models, and 4.25 percent over the last two. The aforementioned results underscore the effectiveness of the XGBoost Classifier, which will be employed as a predictive model in this study, alongside the Random Forest and Decision Tree models, for the accurate identification of stroke and diabetes. Furthermore, combining datasets improves model performance by utilizing relative features. This integrated dataset improves the model's efficiency and creates a resilient and comprehensive prediction model, improving healthcare outcomes. The findings of this research make a valuable contribution to the advancement of AI-driven diagnostic systems, hence enhancing the quality of healthcare decision-making.