Android Malware Detection and Classification using LOFO Feature Selection and Tree-based Models

Malware is a major threat to the computer security. There are so many variants of malware evolving each day which results the loss in economy as well as data and personal information is precious than economy. Malware prevention can be achieved by carefully analyzing the content of the EULA. As EULA analysis deals with analyzing the unstructured text documents, text mining concept plays an important role. This paper analyzes the detection mechanism for malware detection, using text mining over an ample set of existing EULA. The comparison presented in this paper highlights some malware analysis and text mining techniques. Although there are several malware detection systems exist, evolution and revolution is required to fill the gap in malware evolution and detection. In order to achieve the goal or to verify the authenticity of an executable, this paper provides an alternate approach to detect the malware before execution. EULA analysis which acts as gateway can be included in other behavioral or data mining based malware detection system to achieve both external and internal security of the computing system including mobile devices.

Land subsidence modelling using tree-based machine learning algorithms

With more than three million applications already in the Android marketplace, various malware detection systems based on machine learning have been proposed to prevent attacks from cybercriminals; most of these systems use static analyses to extract application features. However, many features generated by static analyses can be easily thwarted by obfuscation techniques. Therefore, several researchers have addressed this obfuscation problem with obfuscation-invariant features. However, to the best of our knowledge, no researcher has utilized deobfuscation techniques. To this end, we adopt a code deobfuscation technique with an Android malware detection system and investigate its effects. Experimental results indicate that code deobfuscation can successfully retrieve useful information concealed by obfuscation. Further, we propose interaction terms based on identified feature interactions. The proposed interaction terms aim to eliminate the interference caused by the size of the application and other features because many feature values are correlated to the size of the application. In addition, the experimental results indicate that these interaction terms have a high ranking in terms of feature importance values. Our proposed Android malware detection model achieves 99.55% accuracy and a 94.61% F1-score with the well-known Drebin dataset, which is better than the performance of previous works.

Research and development have demonstrated that effective building energy prediction is significant for enhancing energy efficiency and ensuring grid reliability. Many machine learning (ML) models, particularly deep learning (DL) approaches, are widely used for power or peak demand forecasting. However, evaluating prediction models solely based on accuracy is insufficient, as complex models often suffer from low interpretability and high computational costs, making them difficult to implement in real-world applications. This study proposes a multi-perspective evaluation analysis that includes prediction accuracy (both overall and at different power levels), interpretability (global/local perspectives and model structure), and computational efficiency. Three popular DL models—recurrent neural network, gated recurrent unit, long short-term memory, and three tree-based models—random forecast, extreme gradient boosting, and light gradient boosting machine—are analyzed due to their popularity and high prediction accuracy in the field of power demand prediction. The comparison reveals the following: (1) The best-performing prediction model changes under different power demand levels. In scenarios with lower power usage patterns, tree-based models achieve an average CV-RMSE of 13.62%, which is comparable to the 12.17% average CV-RMSE of DL models. (2) Global and local interpretations indicate that past power use and time-related features are the most important. Tree-based models excel at identifying which specific lagged features are more significant. (3) The DL model behavior can be interpreted by visualizing the hidden state at each layer to reveal how the model captures temporal dynamics across different time steps. However, tree-based models are more intuitive to interpret using straightforward decision rules and structures. This study provides guidance for applying ML algorithms to load forecasting, offering multiple perspectives on model selection trade-offs.

With the advances in artificial intelligence (AI), data-driven algorithms are becoming increasingly popular in the medical domain. However, due to the nonlinear and complex behavior of many of these algorithms, decision-making by such algorithms is not trustworthy for clinicians and is considered a black-box process. Hence, the scientific community has introduced explainable artificial intelligence (XAI) to remedy the problem. This systematic scoping review investigates the application of XAI in breast cancer detection and risk prediction. We conducted a comprehensive search on Scopus, IEEE Explore, PubMed, and Google Scholar (first 50 citations) using a systematic search strategy. The search spanned from January 2017 to July 2023, focusing on peer-reviewed studies implementing XAI methods in breast cancer datasets. Thirty studies met our inclusion criteria and were included in the analysis. The results revealed that SHapley Additive exPlanations (SHAP) is the top model-agnostic XAI technique in breast cancer research in terms of usage, explaining the model prediction results, diagnosis and classification of biomarkers, and prognosis and survival analysis. Additionally, the SHAP model primarily explained tree-based ensemble machine learning models. The most common reason is that SHAP is model agnostic, which makes it both popular and useful for explaining any model prediction. Additionally, it is relatively easy to implement effectively and completely suits performant models, such as tree-based models. Explainable AI improves the transparency, interpretability, fairness, and trustworthiness of AI-enabled health systems and medical devices and, ultimately, the quality of care and outcomes.

Comparison of tree-based model with deep learning model in predicting effluent pH and concentration by capacitive deionization

To assess the impact of gender and orthodontic qualification length on the awareness, knowledge and usage of orthodontic diagnostic mobile applications, non-diagnostic mobile applications and social media platforms among orthodontic clinicians. Cross-sectional questionnaire-based study. The Republic of Croatia. A total of 92 orthodontic specialists, members of the Croatian Dental Chamber. This study was conducted using a questionnaire distributed via email to orthodontic clinicians between May and July 2022. In total, 92 respondents were divided into groups according to sex and median orthodontic qualification length: more recently qualified (MRQ) with ⩽12 years; and longer qualified (LQ) with >12 years. Nearly one-third of respondents did not have any prior knowledge of mobile applications used as an orthodontic diagnostic tool. MRQ respondents were more interested in using mobile apps as opposed to computer software for digital analysis (P < 0.05). This interest was in a negative correlation with orthodontic qualification length (P < 0.01) and was more prevalent among female respondents (P < 0.001). About one-third (32.6%) of respondents did not use non-diagnostic mobile applications and 44.6% did not use social media platforms. Nearly two-thirds (62%) of the respondents did not promote their work through social media. Male respondents and LQ promoted their work more frequently than others (P < 0.05). The usage of other mobile applications was in a positive correlation with the knowledge and awareness of orthodontic mobile applications (P < 0.05). Orthodontic clinicians lacked knowledge, awareness and the usage of orthodontic diagnostic mobile applications according to sex and orthodontic qualification length. One-third used non-diagnostic mobile applications and less than half used social platforms in daily clinical work.

Android malware poses severe threats to users, hence raising an urgent demand for malware detection. In-cloud Android malware detection often suffers privacy leakage and communication overheads. Therefore, this article focuses on on-device Android malware detection. At present, on-device malware detectors are usually trained on servers and then transplanted to mobile devices (e.g., smartphones). In practice, on-device training is particularly important due to the demand for offline updates. Because mobile devices are limited in resource, however, on-device training is hard to implement, especially for those high-complexity malware detectors. To overcome this challenge, we design a lightweight on-device Android malware detector, based on the recently proposed broad learning method. Our detector mainly uses one-shot computation for model training. Hence it can be fully or incrementally trained directly on mobile devices. As far as detection accuracy is concerned, our detector outperforms the shallow learning-based models, including support vector machine (SVM) and AdaBoost, and approaches the deep learning-based models multilayer perceptron (MLP) and convolutional neural network (CNN). Moreover, our detector is more robust to adversarial examples than the existing detectors, and its robustness can be further improved through on-device model retraining. Finally, its advantages are confirmed by extensive experiments, and its practicality is demonstrated through runtime evaluation on smartphones.

There are apps for everything, from online banking, social software to shopping. They have become one of the most important tools in our daily lives. This even implies that a mobile device has stored most of personal information, including photos, credit cards, and communications. If an intruder succeeds in hacking into the mobile device, all private properties must suffer from the leakage threats. Undoubtedly, a malware is the commonest tool used by an attacker to compromise a mobile phone. In particular, it is often disguised as a popular application through an obfuscated or packed form. That is the main reason why it is difficult to distinguish a malware from the legal ones. In this article, we have adopted machine learning technique to develop a static analysis mechanism for Android malware detection based on shallow feature and permission correlation (AMD). AMD first analyses the Application Programming Interfaces of the target to detect all possible and hidden privilege threats. It then filters this obfuscation information using permission correlation to eliminate noise and identify meaningful malicious indicators. The proposed approach leverages the correlation patterns between permissions and API calls to distinguish suspicious behaviours from legitimate ones. Thus, AMD can extract all the representative shallow features to achieve the high detection rate. Simulation results have shown that AMD can outperform related works under the datasets of CICAndMal2017 and CICMalDroid2020, which confirms the effectiveness of shallow features and permission correlation.

Since malwares in mobile devices are expected to follow the same evolution of malwares in PC environment, it seems useful to apply malware defense techniques in PC environment to mobile devices. However, the malware defense techniques have limitations in terms of energy efficiency and maintenance, so that it will be inefficient to use the techniques on mobile devices, especially if the number of mobile malwares increases explosively. In this paper, we propose an energy-efficient run-time detection scheme which detects malware-infected executables and dynamic libraries on mobile devices. The proposed scheme works under collaboration between mobile devices and a binary- inspection server. To reduce energy consumption for security operation and achieve lightweight and easy maintenance, malware detection is delegated to the server. In experiments with a mobile device under embedded Linux, we show that our scheme guarantees the use of less energy of mobile devices and keeps security of all the mobile devices up-to-date easily and provides the mobile devices with strong protection that puts the advantages of the malware defense techniques in PC environment together.

As the use of smartphones increases, Android, as a Linux-based open source mobile operating system (OS), has become the most popular mobile OS in time. Due to the widespread use of Android, malware developers mostly target Android devices and users. Malware detection systems to be developed for Android devices are important for this reason. Machine learning methods are being increasingly used for detection and analysis of Android malware. This study presents a method for detecting Android malware using feature selection with genetic algorithm (GA). Three different classifier methods with different feature subsets that were selected using GA were implemented for detecting and analyzing Android malware comparatively. A combination of Support Vector Machines and a GA yielded the best accuracy result of 98.45% with the 16 selected permissions using the dataset of 1740 samples consisting of 1119 malwares and 621 benign samples.

Mobile devices implementing Android operating systems inherently encourage opportunities to create and implement malicious software. This opportunity increases as dissemination of the Android OS to standalone devices, such as cameras, increases. The problem intensifies when these devices utilize cloud storage service capabilities. Previous security and forensics research is focused on Android malware detection, data leakage and operating system modifications. In this research, malware was developed and implemented on a camera running an Android Operating System. The execution of this malware successfully transferred images to a secondary cloud location without notifying the user about the data transfer or raising noticeable indicators with an industry accepted mobile device analysis toolkit. The research contribution is an initial empirical analysis of the viability of software to divert an image and store it in a secondary cloud storage environment without alerting digital forensics software about the malicious nature of the malware.

Android based Smartphones are nowadays getting more popular. While using Smartphone, user is always concerned about security and malicious attacks, cryptographic vulnerability of the applications. With increase in the number of Android mobiles, Android malwares are also increasing very rapidly. So the authors have proposed the “Identification of cryptographic vulnerability and malware detection in Android” system. They have designed a user friendly android application, through which user and developer can easily test the application whether it is benign or vulnerable. The application will be tested firstly using static analysis and then the dynamic analysis will be carried out. The authors have implemented static and dynamic analysis of android application for vulnerable and malicious app detection. They have also created a web page. User can either use the application or the web page.

The use of deep learning (DL) is steadily gaining traction in scientific challenges such as cancer research. Advances in enhanced data generation, machine learning algorithms, and compute infrastructure have led to an acceleration in the use of deep learning in various domains of cancer research such as drug response problems. In our study, we explored tree-based models to improve the accuracy of a single drug response model and demonstrate that tree-based models such as XGBoost (eXtreme Gradient Boosting) have advantages over deep learning models, such as a convolutional neural network (CNN), for single drug response problems. However, comparing models is not a trivial task. To make training and comparing CNNs and XGBoost more accessible to users, we developed an open-source library called UNNT (A novel Utility for comparing Neural Net and Tree-based models). The case studies, in this manuscript, focus on cancer drug response datasets however the application can be used on datasets from other domains, such as chemistry.

Important for effective, real-world machine learning (ML) or artificial intelligence (AI)-based malware detection systems is that models demonstrate both high discriminative performance at time of training and also demonstrate a high level of performance maintenance over time subsequent to training. That is, it is desirable that the models have a slow rate of performance decline over time as they encounter previously unseen malware threats. The study of malware detection model empirical performance maintenance on real-world data sets has not been widely addressed despite significant work on ML-based malware detection in general. In this work, we evaluate performance maintenance characteristics of models using a large, one million instance malware-goodware dataset spanning executables collected over one year in duration. Based on the outperformance of gradient boosted decision tree-based models, we investigate this category of model further and demonstrate models with performance and performance maintenance superior to that demonstrated in the previous ML-based malware detection literature. Given the large size of the dataset of real-world executables utilized, the insights into model performance maintenance may have valuable implications for real-world ML-based malware detection systems.