An Analysis of Machine Learning-Based Android Malware Detection Approaches

With the growing popularity of autonomous vehicles, ensuring their safety has become a significant concern. Vehicle manufacturers have incorporated the Android operating system to enhance user convenience. However, the Android operating system's diversity and vulnerability may significantly impact autonomous vehicles because these natures lead to a critical threat in autonomous vehicle security: Android malware. The complex nature of multi‐data sources fusion in autonomous driving systems has resulted in low detection efficiency and accuracy for Android malware. Given the security requirements for autonomous‐driving systems, this article presents an Android malware classification method centered around the multifeature fusion and deep learning architecture designed to detect and classify Android malware within autonomous‐driving systems. The proposed MUDROID framework relies on the Android permission mechanism and behavioral feature to formulate a malware classification model. Comprising four essential components—feature extraction, representation, multifeature fusion, and classifier training, MUDROID leverages the advantages of CNN and GCN combination model and is adept at extracting and interpreting multidimensional features, consequently constructing a multifeature fusion classifier to amplify the efficiency and accuracy of Android malware detection and classification. The experiment results support MUDROID's superior classification performance, with an impressive Android malware detection accuracy rate of 98.69% and family classification (95.42%). The proposed method can detect and classify Android malware effectively, thus elevating the security and robustness of the self‐driving system. Additionally, the approach in this article also addresses feature representation issues in detecting malware variants, facilitating the recognition of Android malware variants across diverse platforms.

With the increase in the popularity of mobile devices, malicious applications targeting Android platform have greatly increased. Malware is coded so prudently that it has become very complicated to identify. The increase in the large amount of malware every day has made the manual approaches inadequate for detecting the malware. Nowadays, a new malware is characterized by sophisticated and complex obfuscation techniques. Thus, the static malware analysis alone is not enough for detecting it. However, dynamic malware analysis is appropriate to tackle evasion techniques but incapable to investigate all the execution paths and also it is very time consuming. So, for better detection and classification of Android malware, we propose a hybrid approach which integrates the features obtained after performing static and dynamic malware analysis. This approach tackles the problem of analyzing, detecting and classifying the Android malware in a more efficient manner. In this paper, we have used a robust set of features from static and dynamic malware analysis for creating two datasets i.e. binary and multiclass (family) classification datasets. These are made publically available on GitHub and Kaggle with the aim to help researchers and anti-malware tool creators for enhancing or developing new techniques and tools for detecting and classifying Android malware. Various machine learning algorithms are employed to detect and classify malware using the features extracted after performing static and dynamic malware analysis. The experimental outcomes indicate that hybrid approach enhances the accuracy of detection and classification of Android malware as compared to the case when static and dynamic features are considered alone.

The presence of malicious software (malware), for example, in Android applications (apps), has harmful or irreparable consequences to the user and/or the device. Despite the protections app stores provide to avoid malware, it keeps growing in sophistication and diffusion. In this paper, we explore the use of machine learning (ML) techniques to detect malware in Android apps. The focus is on the study of different data pre-processing, dimensionality reduction, and classification techniques, assessing the generalization ability of the learned models using public domain datasets and specifically developed apps. We find that the classifiers that achieve better performance for this task are support vector machines (SVM) and random forests (RF). We emphasize the use of feature selection (FS) techniques to reduce the data dimensionality and to identify the most relevant features in Android malware classification, leading to explainability on this task. Our approach can identify the most relevant features to classify an app as malware. Namely, we conclude that permissions play a prominent role in Android malware detection. The proposed approach reduces the data dimensionality while achieving high accuracy in identifying malware in Android apps.

The increasing number of mobile devices using the Android operating system in the market makes these devices the first target for malicious applications. In recent years, several Android malware applications were developed to perform certain illegitimate activities and harmful actions on mobile devices. In response, specific tools and anti-virus programs used conventional signature-based methods in order to detect such Android malware applications. However, the most recent Android malware apps, such as zero-day, cannot be detected through conventional methods that are still based on fixed signatures or identifiers. Therefore, the most recently published research studies have suggested machine learning techniques as an alternative method to detect Android malware due to their ability to learn and use the existing information to detect the new Android malware apps. This paper presents the basic concepts of Android architecture, Android malware, and permission features utilized as effective malware predictors. Furthermore, a comprehensive review of the existing static, dynamic, and hybrid Android malware detection approaches is presented in this study. More significantly, this paper empirically discusses and compares the performances of six supervised machine learning algorithms, known as K-Nearest Neighbors (K-NN), Decision Tree (DT), Support Vector Machine (SVM), Random Forest (RF), Naïve Bayes (NB), and Logistic Regression (LR), which are commonly used in the literature for detecting malware apps.

With explosive growth of Android malware and due to the severity of its damages to smart phone users, the detection of Android malware has become increasingly important in cybersecurity. The increasing sophistication of Android malware calls for new defensive techniques that are capable against novel threats and harder to evade. In this paper, to detect Android malware, instead of using Application Programming Interface (API) calls only, we further analyze the different relationships between them and create higher-level semantics which require more effort for attackers to evade the detection. We represent the Android applications (apps), related APIs, and their rich relationships as a structured heterogeneous information network (HIN). Then we use a meta-path based approach to characterize the semantic relatedness of apps and APIs. We use each meta-path to formulate a similarity measure over Android apps, and aggregate different similarities using multi-kernel learning. Then each meta-path is automatically weighted by the learning algorithm to make predictions. To the best of our knowledge, this is the first work to use structured HIN for Android malware detection. Comprehensive experiments on real sample collections from Comodo Cloud Security Center are conducted to compare various malware detection approaches. Promising experimental results demonstrate that our developed system HinDroid outperforms other alternative Android malware detection techniques.

In today’s digital world, Android phones play a vital part in a variety of facets of both professionals and individuals’ personal and professional lives. Android phones are great for getting things done faster and more organized. The proportionate increase in the number of malicious applications has also been seen to be expanding. Since the play store offers millions of apps, detection of malware apps is challenging task. In this paper, a methodology is introduced for detecting malware in Android applications through the utilization of global image shape transform (GIST) features extracted from grayscale images of the applications. The dataset comprises samples of both malware and benign apps collected from the virus share website. After converting the apps into grayscale images, GIST features are extracted to capture their global spatial layout. Various machine learning (ML) algorithms, such as logistic regression (LR), k-nearest neighbour (KNN), AdaBoost, decision tree (DT), Naïve Bayes (NB), random forest (RF), support vector machine (SVM), extra tree classifier (ETC), and gradient boosting (GB), are employed to classify the applications according to their GIST features. Furthermore, a feed forward neural network (FFNN) is utilized as a deep learning (DL) technique to further improve the accuracy of classification. The performance of each algorithm is evaluated using metrics such as accuracy, precision and recall. The results demonstrated that the FFNN achieves superior accuracy compared to traditional ML classifiers, indicating its effectiveness in detecting malware in Android apps.

Alongside the recognition of the android operating system (OS), android malware is on the increase. Cybercriminals are using different techniques to develop malware for android devices. In addition, malware authors are trying to make malicious android applications that severely undermine the potential of traditional malware detectors. The key purpose of the chapter is to analyze and have a different appearance at various techniques of Android malware detection in a variety of research articles. However, this chapter presents an analysis of varied android malware detection approaches and comparing them to supported various parameters like detection technique, analysis method, features extracted and so on. The experiments are based on substantial malware datasets, evaluation parameters and this study employ a wide variety of machine learning techniques, including decision trees and random forests, support vector machines, logistic model trees, and artificial neural networks, also Deep learning techniques. It is a comparative analysis that should be useful in this field for researchers. The analysis shows, based on simple criteria, the similarities and differences in essential published research in addition to the accuracy. Thus, this chapter aims to study various android malware detection techniques and to identify plausible research directions. The findings showed that machine learning, with greater detection accuracy, is a more promising method. In order to achieve improved accuracy, future researchers can pursue a deep learning approach with the use of a large dataset.

The proliferation of IoT technologies has increased Android-based consumer electronics software, while these applications are susceptible to malware attacks. Applying network traffic for Android malware detection is being extensively developed. Existing approaches primarily focus on statistical features or visualized features of network traffic to detect malware. However, they require labeled data to maintain the detection accuracy. To further enhance detection accuracy and reduce the labeling rate of data, NFNI-MGATMg is proposed to detect Android malware and classify malware categories. First, the Network Flow Node Interaction Graph (NFNI) is introduced to convert the network traffic into the graph. Subsequently, the line graph principle is employed to transform the edges of NFNI into nodes, and both the node graphs and edge-node graphs are fed into the Multi-layer Graph Attention Network Merger (MGATMg) model to aggregate neighbor nodes for effective Android malware detection with limited labeled data. By leveraging MGATMg, it is possible to effectively capture both structural features and statistical features of network traffic, thereby enhancing the accuracy of malware detection. Finally, comprehensive experiments are designed to verify the effectiveness of our framework; the F1-scores of our model reached 98.83% and 91.7% for malware detection and malware category classification, respectively.

With the large number of Android applications being released, reliable Android malware classifier is required. In recent years, machine learning as well as deep learning have played important roles in Android malware detection, and various static and dynamic features have been extracted and combined with both machine learning algorithms and deep learning algorithms. Studies have shown that these models can detect malware that is not included in the training set, indicating potential abilities to capture zero-day malware samples. However, the use of obfuscation technology, which is originally aimed at optimizing code and protecting intellectual property, has become a kind of threat in this type of detection method because both static features and dynamic features might be influenced by obfuscation, which has a negative impact on efficacy of models based on these features. As a result, the trained models might be overfit. In this work, we propose a deep learning based Android malware detection method that uses obfuscation labels in training to force the deep learning model to learn features of obfuscation technologies and malware simultaneously from part of the input. The experimental results demonstrate that our method achieved 96.2%-99.6% accuracy on different datasets and suppressed overfitting compared to method that doesn’t use obfuscation labels.

As the use of smartphones increases, Android, as a Linux-based open source mobile operating system (OS), has become the most popular mobile OS in time. Due to the widespread use of Android, malware developers mostly target Android devices and users. Malware detection systems to be developed for Android devices are important for this reason. Machine learning methods are being increasingly used for detection and analysis of Android malware. This study presents a method for detecting Android malware using feature selection with genetic algorithm (GA). Three different classifier methods with different feature subsets that were selected using GA were implemented for detecting and analyzing Android malware comparatively. A combination of Support Vector Machines and a GA yielded the best accuracy result of 98.45% with the 16 selected permissions using the dataset of 1740 samples consisting of 1119 malwares and 621 benign samples.

With the widespread popularity of Internet of Things (IoT) devices based on the Android system, the amount of Android malware targeting IoT devices continues to increase, causing great economic losses. Accordingly, efficient and accurate Android malware detection methods are particularly important. Recently, many Android malware detection and classification methods have been proposed, but most of them ignore the deep relationships among software. In this article, we propose a graph compression algorithm with reachability relationship extraction (GCRR) and design an Android malware detection and classification method called GCDroid based on this algorithm. A theoretical analysis shows that GCRR can reasonably extract the reachability relationships among APKs and compress a large heterogeneous APK–API relationship graph into a homogeneous APKs graph. Experiments show that GCDroid based on GCRR greatly reduces the required time consumption while improving detection accuracy. Compared with the existing excellent static Android malware detection methods, GCDroid improves upon their detection accuracies by 1.53%–39.13% on different data sets and outperforms the benchmark methods in terms of Android malware classification. Furthermore, compared with those of the baseline methods that are similar to GCDroid, GCDroid’s time consumption for model training and other aspects is only one-tenth as high or even less.

Over the past few years, Android Application is deemed as one of the fastest-growing technology areas. On the other hand, the rapid growth of android applications also increases the security threats for Android users in the form of malware. Malware hacks the personal information of a user and exploits it in different criminal activities. To date, various studies have been conducted for the detection of android malware. Some authors have preferred static analysis while others have performed dynamic analysis for android malware detection. In static analysis, researchers have only employed one feature of android application either intents or permissions. As best of our knowledge, there does not exist any technique that combines both intents and permissions. In this paper, we have performed static analysis for the detection of Android malware using android intents (both implicit and explicit), android permissions and combination of intents and permissions. Furthermore, the classification is performed to analyze the effectiveness of different machine learning algorithms for malware detection and to identify the best performing feature. Our experiment results show that combination of intents and permissions play a key role in the detection of android malware.

Recently, security incidents such as sensitive data leakage and video/audio hardware control caused by Android malware have raised severe security issues that threaten Android users, so thus behavior analysis and detection research researches of malicious Android applications have become a hot topic. However, the behavioral portrait of Android malware that can depict the behavior of Android malware is not approached in previous literature. To fill this gap, we propose DroidPortrait, an Android malware multi-dimensional behavioral portrait construction approach. We take the behavior of Android malware as an entry point and extract an informative behavior dataset that includes static and dynamic behavior from Android malware. Next, aiming at Android malware that contains different kinds of behaviors, a behavioral tag is defined then combined with a machine learning (ML) algorithm to implement the correlation of these behavioral tags. Android malware behavioral portrait architecture based on behavior analysis and its design is investigated, as also an optimized random forest algorithm is conceived then combined with Android malware behavioral portrait to detect Android malware. The evaluation findings indicate the DroidPortrait can depict behavioral characteristics of Android malware comprehensive and detect them with high performance.

Android, being the most widely used mobile operating system of choice, also poses a security risk of mass privacy intrusion and sensitive data theft. Hence, as a mitigation effort, it is imperative to identify robust methods in identifying android malwares. In this paper, we extend our previous research work titled “Anatomizing Android Malwares” [20] and bring forward a novel method of identifying malicious android apps using object-oriented software metrics and supervised machine learning techniques. Initially, we retrieve object-oriented software metrics from the decompiled android app, and then this metrics tuple is tagged either as benign or malware using VirusTotal service. Finally, the set of metrics tuple acts as input features in machine learning algorithms. We evaluated the performance and stability of our forty-eight different machine-learned models against 5774 android apps collected from AndroZoo [1]. The discriminatory power of every machine-learned model is measured using its area under ROC curve (AUC), accuracy and F-measure values. Our method yields AUC, accuracy and F-measure of 1.0, 100% and 1.0, respectively.

The pervasive spread of Android malware poses significant threats to users and systems worldwide. In most existing studies, differences in feature importance are often overlooked, and the calculation of feature weights is conducted independently of the classification model. In this paper, we propose an Android malware detection method, Leveraging Extraction Method and Soft Voting classification (LEMSOFT). This approach includes a novel preprocessing module, lexical occurrence ratio-based filtering (LORF), and an improved Soft Voting mechanism optimized through genetic algorithms. We introduce LORF to evaluate and enhance the significance of permissions, API calls, and opcodes. Each type of feature is then independently classified using tailored machine learning models. To integrate the outputs of these classifiers, this paper proposes an innovative soft voting mechanism that improves prediction accuracy for encountered applications by assigning weights through a genetic algorithm. Our solution outperforms the baseline methods we studied, as evidenced by the evaluation of 5560 malicious and 8340 benign applications, with an average accuracy of 99.89%. The efficacy of our methodology is demonstrated through extensive experiments, showcasing significant improvements in detection rates compared to state-of-the-art (SOTA) methods.