AMDDLmodel: Android smartphones malware detection using deep learning model

Alongside the recognition of the android operating system (OS), android malware is on the increase. Cybercriminals are using different techniques to develop malware for android devices. In addition, malware authors are trying to make malicious android applications that severely undermine the potential of traditional malware detectors. The key purpose of the chapter is to analyze and have a different appearance at various techniques of Android malware detection in a variety of research articles. However, this chapter presents an analysis of varied android malware detection approaches and comparing them to supported various parameters like detection technique, analysis method, features extracted and so on. The experiments are based on substantial malware datasets, evaluation parameters and this study employ a wide variety of machine learning techniques, including decision trees and random forests, support vector machines, logistic model trees, and artificial neural networks, also Deep learning techniques. It is a comparative analysis that should be useful in this field for researchers. The analysis shows, based on simple criteria, the similarities and differences in essential published research in addition to the accuracy. Thus, this chapter aims to study various android malware detection techniques and to identify plausible research directions. The findings showed that machine learning, with greater detection accuracy, is a more promising method. In order to achieve improved accuracy, future researchers can pursue a deep learning approach with the use of a large dataset.

The increasing number of mobile devices using the Android operating system in the market makes these devices the first target for malicious applications. In recent years, several Android malware applications were developed to perform certain illegitimate activities and harmful actions on mobile devices. In response, specific tools and anti-virus programs used conventional signature-based methods in order to detect such Android malware applications. However, the most recent Android malware apps, such as zero-day, cannot be detected through conventional methods that are still based on fixed signatures or identifiers. Therefore, the most recently published research studies have suggested machine learning techniques as an alternative method to detect Android malware due to their ability to learn and use the existing information to detect the new Android malware apps. This paper presents the basic concepts of Android architecture, Android malware, and permission features utilized as effective malware predictors. Furthermore, a comprehensive review of the existing static, dynamic, and hybrid Android malware detection approaches is presented in this study. More significantly, this paper empirically discusses and compares the performances of six supervised machine learning algorithms, known as K-Nearest Neighbors (K-NN), Decision Tree (DT), Support Vector Machine (SVM), Random Forest (RF), Naïve Bayes (NB), and Logistic Regression (LR), which are commonly used in the literature for detecting malware apps.

With the growing popularity of autonomous vehicles, ensuring their safety has become a significant concern. Vehicle manufacturers have incorporated the Android operating system to enhance user convenience. However, the Android operating system's diversity and vulnerability may significantly impact autonomous vehicles because these natures lead to a critical threat in autonomous vehicle security: Android malware. The complex nature of multi‐data sources fusion in autonomous driving systems has resulted in low detection efficiency and accuracy for Android malware. Given the security requirements for autonomous‐driving systems, this article presents an Android malware classification method centered around the multifeature fusion and deep learning architecture designed to detect and classify Android malware within autonomous‐driving systems. The proposed MUDROID framework relies on the Android permission mechanism and behavioral feature to formulate a malware classification model. Comprising four essential components—feature extraction, representation, multifeature fusion, and classifier training, MUDROID leverages the advantages of CNN and GCN combination model and is adept at extracting and interpreting multidimensional features, consequently constructing a multifeature fusion classifier to amplify the efficiency and accuracy of Android malware detection and classification. The experiment results support MUDROID's superior classification performance, with an impressive Android malware detection accuracy rate of 98.69% and family classification (95.42%). The proposed method can detect and classify Android malware effectively, thus elevating the security and robustness of the self‐driving system. Additionally, the approach in this article also addresses feature representation issues in detecting malware variants, facilitating the recognition of Android malware variants across diverse platforms.

With the large number of Android applications being released, reliable Android malware classifier is required. In recent years, machine learning as well as deep learning have played important roles in Android malware detection, and various static and dynamic features have been extracted and combined with both machine learning algorithms and deep learning algorithms. Studies have shown that these models can detect malware that is not included in the training set, indicating potential abilities to capture zero-day malware samples. However, the use of obfuscation technology, which is originally aimed at optimizing code and protecting intellectual property, has become a kind of threat in this type of detection method because both static features and dynamic features might be influenced by obfuscation, which has a negative impact on efficacy of models based on these features. As a result, the trained models might be overfit. In this work, we propose a deep learning based Android malware detection method that uses obfuscation labels in training to force the deep learning model to learn features of obfuscation technologies and malware simultaneously from part of the input. The experimental results demonstrate that our method achieved 96.2%-99.6% accuracy on different datasets and suppressed overfitting compared to method that doesn’t use obfuscation labels.

Over the past few years, Android Application is deemed as one of the fastest-growing technology areas. On the other hand, the rapid growth of android applications also increases the security threats for Android users in the form of malware. Malware hacks the personal information of a user and exploits it in different criminal activities. To date, various studies have been conducted for the detection of android malware. Some authors have preferred static analysis while others have performed dynamic analysis for android malware detection. In static analysis, researchers have only employed one feature of android application either intents or permissions. As best of our knowledge, there does not exist any technique that combines both intents and permissions. In this paper, we have performed static analysis for the detection of Android malware using android intents (both implicit and explicit), android permissions and combination of intents and permissions. Furthermore, the classification is performed to analyze the effectiveness of different machine learning algorithms for malware detection and to identify the best performing feature. Our experiment results show that combination of intents and permissions play a key role in the detection of android malware.

The exponentially growing use and popularity of the Android Operating System made it more prone to malware attacks. Easy to use android smartphones attracted intruders which resulted in the need for a novel malware detection method. Several works are proposed which makes use of machine learning techniques to detect malign and benign applications. To provide the solution of addressed problem of detection of malware in android, in this paper, we have provided a decent approach based on static analysis of the android apk for feature extraction like API Calls, Intents, Permissions and Command signature. We have used the Drebin[2] [26] and Malgenome[35] datasets, both the datasets have a good amount of goodwares and malwares to train the machine learning classifier. After feature extraction from android APK (Android Package Kit), we performed various experiments taking into consideration all the combined extracted features as well as generated the twosome combination of permission. By taking all four extracted features our model achieved a high classification accuracy of 98.19% with Drebin Dataset and with the twosome permission combination it achieved an accuracy of 96.27% with the RF model. Additionally, in the case of Malgenome Dataset, we have an accuracy of 98.84% considering all four features and 97.63% in the case of permission twosome combination SVM with PCA (Principal Component Analysis). Both experiments have given a decent result compared to some of the existing work considering the same scenario in the android malware domain.

Android based Smartphones are nowadays getting more popular. While using Smartphone, user is always concerned about security and malicious attacks, cryptographic vulnerability of the applications. With increase in the number of Android mobiles, Android malwares are also increasing very rapidly. So the authors have proposed the “Identification of cryptographic vulnerability and malware detection in Android” system. They have designed a user friendly android application, through which user and developer can easily test the application whether it is benign or vulnerable. The application will be tested firstly using static analysis and then the dynamic analysis will be carried out. The authors have implemented static and dynamic analysis of android application for vulnerable and malicious app detection. They have also created a web page. User can either use the application or the web page.

Android OS is today the most used Operating System for mobile devices. However, it is susceptible to several malware attacks that may seriously compromise the privacy and security of individuals and organizations. This paper proposes an approach based on a static analysis of decompiled Android PacKages (APKs) to extract critical APIs and detect Android malware. The main contributions lie in the adoption of a graph-based data engineering schema to represent APIs taken from the Function Call Graphs of decompiled APKs and the formulation of a graph-based deep learning approach for explainable malware detection. In particular, the proposed approach, named , implements a Graph Neural Network (GNN) for binary classification (malware versus goodware), and integrates algorithm to disclose how specific API classes and control-flow edges between API calls influence malware alerts. The proposed approach was evaluated by considering 26,527 Android APKs. The results of an extensive and in-depth evaluation show that the presented GNN model achieves higher accuracy than deep neural models trained with traditional API call sequence representations and publicly available related methods. On the other hand, it produces decision explanations that yield interesting insights into the malicious patterns of APKs and support root cause analysis of missed malware alarms.

With the emergence of deep learning, recent years have witnessed a booming of artificial intelligence (AI) applications and services in many fields of modern society, ranging from face recognition to video surveillance to many recommendation systems. In addition, there is a tremendous increase in cyberattacks or data leakage which draws much attention from both the professional and the public due to the popularity of mobile devices like Android. Driving by this trend, many security approaches push AI or deep learning to Android malware detection to enhance the accuracy and capability of scanning or detecting systems. However, research on this field is still in the early stage since there is the diversity of deep learning models and a shortage of standardized Android datasets for evaluating the efficiency of each approach. To this end, we conduct a comparative study of famous deep learning models on one dataset to give an overview of their powers in providing the method of dissecting Android malware.

This paper evaluates performance of two clustering algorithms, namely k-means and mini batch k-means, in the Android malware detection. Network traffic generated by the Android applications, normal and malicious, is analyzed for detection purpose. We have used MalGenome data sample for this work to build the dataset. We chose 800 samples out of 1260 Android malware samples. In addition, we collected numerous normal applications from the official Android market. The results show that mini batch k-means algorithm performs better than k-means algorithm in the Android malware detection.

As the use of smartphones increases, Android, as a Linux-based open source mobile operating system (OS), has become the most popular mobile OS in time. Due to the widespread use of Android, malware developers mostly target Android devices and users. Malware detection systems to be developed for Android devices are important for this reason. Machine learning methods are being increasingly used for detection and analysis of Android malware. This study presents a method for detecting Android malware using feature selection with genetic algorithm (GA). Three different classifier methods with different feature subsets that were selected using GA were implemented for detecting and analyzing Android malware comparatively. A combination of Support Vector Machines and a GA yielded the best accuracy result of 98.45% with the 16 selected permissions using the dataset of 1740 samples consisting of 1119 malwares and 621 benign samples.

With explosive growth of Android malware and due to the severity of its damages to smart phone users, the detection of Android malware has become increasingly important in cybersecurity. The increasing sophistication of Android malware calls for new defensive techniques that are capable against novel threats and harder to evade. In this paper, to detect Android malware, instead of using Application Programming Interface (API) calls only, we further analyze the different relationships between them and create higher-level semantics which require more effort for attackers to evade the detection. We represent the Android applications (apps), related APIs, and their rich relationships as a structured heterogeneous information network (HIN). Then we use a meta-path based approach to characterize the semantic relatedness of apps and APIs. We use each meta-path to formulate a similarity measure over Android apps, and aggregate different similarities using multi-kernel learning. Then each meta-path is automatically weighted by the learning algorithm to make predictions. To the best of our knowledge, this is the first work to use structured HIN for Android malware detection. Comprehensive experiments on real sample collections from Comodo Cloud Security Center are conducted to compare various malware detection approaches. Promising experimental results demonstrate that our developed system HinDroid outperforms other alternative Android malware detection techniques.

With the widespread popularity of Internet of Things (IoT) devices based on the Android system, the amount of Android malware targeting IoT devices continues to increase, causing great economic losses. Accordingly, efficient and accurate Android malware detection methods are particularly important. Recently, many Android malware detection and classification methods have been proposed, but most of them ignore the deep relationships among software. In this article, we propose a graph compression algorithm with reachability relationship extraction (GCRR) and design an Android malware detection and classification method called GCDroid based on this algorithm. A theoretical analysis shows that GCRR can reasonably extract the reachability relationships among APKs and compress a large heterogeneous APK–API relationship graph into a homogeneous APKs graph. Experiments show that GCDroid based on GCRR greatly reduces the required time consumption while improving detection accuracy. Compared with the existing excellent static Android malware detection methods, GCDroid improves upon their detection accuracies by 1.53%–39.13% on different data sets and outperforms the benchmark methods in terms of Android malware classification. Furthermore, compared with those of the baseline methods that are similar to GCDroid, GCDroid’s time consumption for model training and other aspects is only one-tenth as high or even less.

EfficientNet convolutional neural networks-based Android malware detection

The pervasive spread of Android malware poses significant threats to users and systems worldwide. In most existing studies, differences in feature importance are often overlooked, and the calculation of feature weights is conducted independently of the classification model. In this paper, we propose an Android malware detection method, Leveraging Extraction Method and Soft Voting classification (LEMSOFT). This approach includes a novel preprocessing module, lexical occurrence ratio-based filtering (LORF), and an improved Soft Voting mechanism optimized through genetic algorithms. We introduce LORF to evaluate and enhance the significance of permissions, API calls, and opcodes. Each type of feature is then independently classified using tailored machine learning models. To integrate the outputs of these classifiers, this paper proposes an innovative soft voting mechanism that improves prediction accuracy for encountered applications by assigning weights through a genetic algorithm. Our solution outperforms the baseline methods we studied, as evidenced by the evaluation of 5560 malicious and 8340 benign applications, with an average accuracy of 99.89%. The efficacy of our methodology is demonstrated through extensive experiments, showcasing significant improvements in detection rates compared to state-of-the-art (SOTA) methods.