An efficient Android malware detection method using Borutashap algorithm

The increasing number of mobile devices using the Android operating system in the market makes these devices the first target for malicious applications. In recent years, several Android malware applications were developed to perform certain illegitimate activities and harmful actions on mobile devices. In response, specific tools and anti-virus programs used conventional signature-based methods in order to detect such Android malware applications. However, the most recent Android malware apps, such as zero-day, cannot be detected through conventional methods that are still based on fixed signatures or identifiers. Therefore, the most recently published research studies have suggested machine learning techniques as an alternative method to detect Android malware due to their ability to learn and use the existing information to detect the new Android malware apps. This paper presents the basic concepts of Android architecture, Android malware, and permission features utilized as effective malware predictors. Furthermore, a comprehensive review of the existing static, dynamic, and hybrid Android malware detection approaches is presented in this study. More significantly, this paper empirically discusses and compares the performances of six supervised machine learning algorithms, known as K-Nearest Neighbors (K-NN), Decision Tree (DT), Support Vector Machine (SVM), Random Forest (RF), Naïve Bayes (NB), and Logistic Regression (LR), which are commonly used in the literature for detecting malware apps.

With the large number of Android applications being released, reliable Android malware classifier is required. In recent years, machine learning as well as deep learning have played important roles in Android malware detection, and various static and dynamic features have been extracted and combined with both machine learning algorithms and deep learning algorithms. Studies have shown that these models can detect malware that is not included in the training set, indicating potential abilities to capture zero-day malware samples. However, the use of obfuscation technology, which is originally aimed at optimizing code and protecting intellectual property, has become a kind of threat in this type of detection method because both static features and dynamic features might be influenced by obfuscation, which has a negative impact on efficacy of models based on these features. As a result, the trained models might be overfit. In this work, we propose a deep learning based Android malware detection method that uses obfuscation labels in training to force the deep learning model to learn features of obfuscation technologies and malware simultaneously from part of the input. The experimental results demonstrate that our method achieved 96.2%-99.6% accuracy on different datasets and suppressed overfitting compared to method that doesn’t use obfuscation labels.

Recently, security incidents such as sensitive data leakage and video/audio hardware control caused by Android malware have raised severe security issues that threaten Android users, so thus behavior analysis and detection research researches of malicious Android applications have become a hot topic. However, the behavioral portrait of Android malware that can depict the behavior of Android malware is not approached in previous literature. To fill this gap, we propose DroidPortrait, an Android malware multi-dimensional behavioral portrait construction approach. We take the behavior of Android malware as an entry point and extract an informative behavior dataset that includes static and dynamic behavior from Android malware. Next, aiming at Android malware that contains different kinds of behaviors, a behavioral tag is defined then combined with a machine learning (ML) algorithm to implement the correlation of these behavioral tags. Android malware behavioral portrait architecture based on behavior analysis and its design is investigated, as also an optimized random forest algorithm is conceived then combined with Android malware behavioral portrait to detect Android malware. The evaluation findings indicate the DroidPortrait can depict behavioral characteristics of Android malware comprehensive and detect them with high performance.

Nowadays, Android system is the most popular mobile smart operating system on the market. However, the number of Android malware has increased sharply and Android malware spreads quickly and has lots of variants. The existing traditional Android malware detection systems are mostly based on the explicit relationship between Android applications, and their detection accuracy and detection efficiency need to be improved. In this paper, we establish an heterogeneous information network to represent the structural and semantic relations between Android application entities. Then we combine relation matrices and meta-paths to get entity features, and we propose two aggregation operations to learn Android application features. Finally, we use the Multi-Layer Perception neural network to detect Android malware. Through testing on the real data sets, the results show that our system takes into account both accuracy and efficiency.

Over the past few years, Android Application is deemed as one of the fastest-growing technology areas. On the other hand, the rapid growth of android applications also increases the security threats for Android users in the form of malware. Malware hacks the personal information of a user and exploits it in different criminal activities. To date, various studies have been conducted for the detection of android malware. Some authors have preferred static analysis while others have performed dynamic analysis for android malware detection. In static analysis, researchers have only employed one feature of android application either intents or permissions. As best of our knowledge, there does not exist any technique that combines both intents and permissions. In this paper, we have performed static analysis for the detection of Android malware using android intents (both implicit and explicit), android permissions and combination of intents and permissions. Furthermore, the classification is performed to analyze the effectiveness of different machine learning algorithms for malware detection and to identify the best performing feature. Our experiment results show that combination of intents and permissions play a key role in the detection of android malware.

Android is the most popular operating system of the latest mobile smart devices. With this operating system, many Android applications have been developed and become an essential part of our daily lives. Unfortunately, different kinds of Android malware have also been generated with these applications’ endless stream and somehow installed during the API calls, permission granted and extra packages installation and badly affected the system security rules to harm the system. Therefore, it is compulsory to detect and classify the android malware to save the user’s privacy to avoid maximum damages. Many research has already been developed on the different techniques related to android malware detection and classification. In this work, we present AMDDLmodel a deep learning technique that consists of a convolutional neural network. This model works based on different parameters, filter sizes, number of epochs, learning rates, and layers to detect and classify the android malware. The Drebin dataset consisting of 215 features was used for this model evaluation. The model shows an accuracy value of 99.92%. The other statistical values are precision, recall, and F1-score. AMDDLmodel introduces innovative deep learning for Android malware detection, enhancing accuracy and practical user security through inventive feature engineering and comprehensive performance evaluation. The AMDDLmodel shows the highest accuracy values as compared to the existing techniques.

In this technology world, smartphones are greatly adopted by people due to the need of personal communication, Internet and many more requirements. Users are attracted to use the android operating system due its availability for low-cost and millions of freely available applications. The popularity of android operating system is also welcomes the attackers. Statistics have shown that, the growth of android malware is becomes double by every year. Hence android platform is more vulnerable to malwares. Researchers are proposed various models. Some of these models are completely fail to detect unseen variants of malware, while remaining models are inefficient to detect new malware families. In this paper, we briefly explain about android architecture, structure of android application and also characterized android malware based on their installation, activation and payloads types. We proposed a hybrid model to detect the malware based on permission bit-vector and network traffic. We constructed a decision tree classifier to detect the android malware. Our results show that combination of permission bit-vector and network traffic analysis is highly efficient by achieved 95.56% of detection accuracy.

Android malware can pose serious security threat to the mobile users. With the rapid growth in malware programs, categorical isolation of malware is no longer satisfactory for security risk management. It is more pragmatic to focus the limited resources on identifying the small fraction of malware programs of high security impact. In this paper, we define a new research issue of measuring and predicting the impact of the detected Android malware. To address this issue, we first propose two metrics to isolate the high impact Android malware programs from the low impact ones. With the proposed metrics, we created a new research dataset including high impact and low impact Android malware samples. The dataset allows us to empirically discover the driving factors for the high malware impact. To characterize the differences between high impact and low impact Android malware, we leverage features from two sources available in every Android application. (1) the readily available AndroidManifest.xml file and (2) the disassembled code from the compiled binary. From these characteristics, we trained a highly accurate classifier to identify high impact Android malware. The experimental results show that our proposed method is feasible and has great potential in predicting the impact of Android malware in general.

With the increase in the popularity of mobile devices, malicious applications targeting Android platform have greatly increased. Malware is coded so prudently that it has become very complicated to identify. The increase in the large amount of malware every day has made the manual approaches inadequate for detecting the malware. Nowadays, a new malware is characterized by sophisticated and complex obfuscation techniques. Thus, the static malware analysis alone is not enough for detecting it. However, dynamic malware analysis is appropriate to tackle evasion techniques but incapable to investigate all the execution paths and also it is very time consuming. So, for better detection and classification of Android malware, we propose a hybrid approach which integrates the features obtained after performing static and dynamic malware analysis. This approach tackles the problem of analyzing, detecting and classifying the Android malware in a more efficient manner. In this paper, we have used a robust set of features from static and dynamic malware analysis for creating two datasets i.e. binary and multiclass (family) classification datasets. These are made publically available on GitHub and Kaggle with the aim to help researchers and anti-malware tool creators for enhancing or developing new techniques and tools for detecting and classifying Android malware. Various machine learning algorithms are employed to detect and classify malware using the features extracted after performing static and dynamic malware analysis. The experimental outcomes indicate that hybrid approach enhances the accuracy of detection and classification of Android malware as compared to the case when static and dynamic features are considered alone.

With the growing popularity of autonomous vehicles, ensuring their safety has become a significant concern. Vehicle manufacturers have incorporated the Android operating system to enhance user convenience. However, the Android operating system's diversity and vulnerability may significantly impact autonomous vehicles because these natures lead to a critical threat in autonomous vehicle security: Android malware. The complex nature of multi‐data sources fusion in autonomous driving systems has resulted in low detection efficiency and accuracy for Android malware. Given the security requirements for autonomous‐driving systems, this article presents an Android malware classification method centered around the multifeature fusion and deep learning architecture designed to detect and classify Android malware within autonomous‐driving systems. The proposed MUDROID framework relies on the Android permission mechanism and behavioral feature to formulate a malware classification model. Comprising four essential components—feature extraction, representation, multifeature fusion, and classifier training, MUDROID leverages the advantages of CNN and GCN combination model and is adept at extracting and interpreting multidimensional features, consequently constructing a multifeature fusion classifier to amplify the efficiency and accuracy of Android malware detection and classification. The experiment results support MUDROID's superior classification performance, with an impressive Android malware detection accuracy rate of 98.69% and family classification (95.42%). The proposed method can detect and classify Android malware effectively, thus elevating the security and robustness of the self‐driving system. Additionally, the approach in this article also addresses feature representation issues in detecting malware variants, facilitating the recognition of Android malware variants across diverse platforms.

Android based Smartphones are nowadays getting more popular. While using Smartphone, user is always concerned about security and malicious attacks, cryptographic vulnerability of the applications. With increase in the number of Android mobiles, Android malwares are also increasing very rapidly. So the authors have proposed the “Identification of cryptographic vulnerability and malware detection in Android” system. They have designed a user friendly android application, through which user and developer can easily test the application whether it is benign or vulnerable. The application will be tested firstly using static analysis and then the dynamic analysis will be carried out. The authors have implemented static and dynamic analysis of android application for vulnerable and malicious app detection. They have also created a web page. User can either use the application or the web page.

The popularity of the Android operating system has been rising ever since its initial release in 2008. This is due to two major reasons. The first is that Android is open-source, due to which a lot of mobile manufacturing companies use some form of modified Android OS for their devices. The second reason is that a wide variety of applications with different designs and utility can be built with ease for Android devices. With this much popularity, gaining unwanted attention of cybercriminals is inevitable. Hence, there has been a huge rise in the number of malware being developed for Android devices. To address this problem, we present ADAM (Automatic Detection of Android Malware), an Android application that uses machine learning (ML) for automatic detection of malware in Android applications. ADAM is trained with CICMalDroid 2020 Android Malware dataset and tested for both CICMalDroid 2020 and CICMalDroid 2017 dataset. The experiment analysis showed that it achieves more than 98.5% accuracy. ADAM considers only static analysis, so becomes easy to deploy in smart phone to alert the user. ADAM is deployed over android mobile phone.KeywordsSecurityMalware detectionAndroidMachine learning

Currently the android platform is that the quickest growing hand-held OS package. And it’s become the foremost desirable and viable objective of malevolent applications. Android malware growth has been increasing dramatically in conjunction with increasing the variety and guiltiness of their developing techniques. Mobile malware is therefore pernicious and, on the increase, consequently having a quick and reliable detection system is important for the users. Subtle Android malware use detection shunning techniques so as to cover their malicious activities from analysis tools. During this analysis, a brand-new detection and characterization system for investigation significant deviations within the network behaviour of a smart-phone application is planned. The most goal of the planned system is to guard mobile device users and cellular infrastructure corporations from malicious applications simply nine traffic feature measurements. The planned system isn’t solely ready to observe the malicious or masquerading apps, however may also determine them as general malware or specific malware (i.e. adware) on a mobile device. The planned methodology showed the common accuracy 94% for 5 classifiers namely; Random Forest (RF), K-Nearest Neighbour (KNN), decision Tree (DT), Random Tree (RT) and Regression (R) etc. We have a tendency to conjointly provide a tagged dataset of mobile malware traffic with a lot of applications includes benign and twelve completely different families of each adware and general malware. Recent substantial analysis on machine learning algorithms analyse options from mischievous application and use those preferences to catalogue and discover unknown malicious applications. This study condenses the progression of malware detection techniques supported machine learning algorithms centred on the Android Operating systems.

This paper evaluates performance of two clustering algorithms, namely k-means and mini batch k-means, in the Android malware detection. Network traffic generated by the Android applications, normal and malicious, is analyzed for detection purpose. We have used MalGenome data sample for this work to build the dataset. We chose 800 samples out of 1260 Android malware samples. In addition, we collected numerous normal applications from the official Android market. The results show that mini batch k-means algorithm performs better than k-means algorithm in the Android malware detection.

In recent years, a dramatic change was bring to us with the rapid development of intelligent terminal technology and the popularity of mobile services. Android platforms alone have produced staggering revenues, which has attracted cybercriminals and increased malware in Android markets at an alarming rate. However, the mobile phone network traffic is used to analyze malicious software recently, but this method lack of a visual way to understand network behavior of malware as well as without integrity explanation. In this paper, we introduced a method that can reconstructed the Android applications’ network behavior based on application layer traffic. We reconstruct the application network behavior in two ways, namely, network behavior time sequence model and network connection behavior model, we can understand the network behavior of Android applications by the model we reconstructed, it provides the network interaction process integrity explanation and shows that malwares traffic include malicious traffic and normal traffic.KeywordsReconstructionAndroid applicationNetwork trafficMalwareDetection