Android Malware Detection Using Machine Learning with SMOTE-Tomek Data Balancing

The proliferation of IoT technologies has increased Android-based consumer electronics software, while these applications are susceptible to malware attacks. Applying network traffic for Android malware detection is being extensively developed. Existing approaches primarily focus on statistical features or visualized features of network traffic to detect malware. However, they require labeled data to maintain the detection accuracy. To further enhance detection accuracy and reduce the labeling rate of data, NFNI-MGATMg is proposed to detect Android malware and classify malware categories. First, the Network Flow Node Interaction Graph (NFNI) is introduced to convert the network traffic into the graph. Subsequently, the line graph principle is employed to transform the edges of NFNI into nodes, and both the node graphs and edge-node graphs are fed into the Multi-layer Graph Attention Network Merger (MGATMg) model to aggregate neighbor nodes for effective Android malware detection with limited labeled data. By leveraging MGATMg, it is possible to effectively capture both structural features and statistical features of network traffic, thereby enhancing the accuracy of malware detection. Finally, comprehensive experiments are designed to verify the effectiveness of our framework; the F1-scores of our model reached 98.83% and 91.7% for malware detection and malware category classification, respectively.

The rapid expansion of Android smartphones and their open-source characteristics have rendered them a primary target for malware attacks, endangering user privacy and device security. With the rise of malware attacks, robust and reliable security is not only wanted but much needed. As the Android malware landscape evolves, traditional approaches become increasingly challenging to implement with the same degree of accuracy in detecting new, emerging malware patterns. Recently, machine learning has gained attention as an effective and reliable solution in many application domains, including malware detection. However, traditional methods for detecting malware on Android smartphones are facing new challenges, such as a high false positive rate, performance problems, and a lack of scalability. In this study, we investigate the application of machine learning-based systematic practices to achieve effective and scalable Android malware detection. The experiments were conducted using a dataset consisting of over 15,000 benign and malicious Android apps. A SelectKBest feature selection method was used to reduce computation and improve efficiency by extracting the top 20 most relevant features. The extracted features were then used to train and validate four machine learning classifiers: K-Nearest Neighbors (KNN), Support Vector Machine (SVM), Random Forest (RF), and Multi-Layer Perceptron (MLP). The model was cross-validated using K-fold cross-validation to evaluate its performance on the entire dataset. Random Forest has achieved the highest accuracy among other models, which is 90.64%. The result demonstrates the feasibility of implementing static analysis feature selection and machine learning methods to improve the detection accuracy and computation efficiency. The study provides practical guidance for an optimized static analysis approach that focuses on manifest permissions, enhances detection accuracy, and reduces computational overhead for Android-based malware detection systems, thereby protecting mobile cybersecurity.

With the popularity of smartphones and mobile applications, the threat of Android malware is increasingly serious.The analysis and behaviour modelling of Android malware features is studied to realize the efficient and accurate detection of Android malware, and an Android malware detection method combining mean aggregator and long-term and short-term memory is proposed.The results show that the improved system detection time is relatively stable regardless of the number of samples.The average detection time of the improved and unimproved systems is 0.274 s and 0.336 s, respectively, and the improved detection efficiency of the improved system is more prominent.The highest improvement rate of the enhanced system reached 18.2%.Compared with other models, the average absolute error and root mean square error were the smallest, with 3.84 and 6.26, respectively, indicating that the detection performance of the improved model is the best.With permission features and third-party library features, the accuracy of the enhanced model was 98.89% and 92.65%, and the recall rate was 99.24% and 99.09%, respectively.The improved model detection performance is good, and the robustness and stability are enhanced.Applied to actual Android devices, it can improve the security and privacy protection level of user data.This method ensures enhanced efficiency and stability and provides a certain reference direction for Android malware detection.

The increasing number of mobile devices using the Android operating system in the market makes these devices the first target for malicious applications. In recent years, several Android malware applications were developed to perform certain illegitimate activities and harmful actions on mobile devices. In response, specific tools and anti-virus programs used conventional signature-based methods in order to detect such Android malware applications. However, the most recent Android malware apps, such as zero-day, cannot be detected through conventional methods that are still based on fixed signatures or identifiers. Therefore, the most recently published research studies have suggested machine learning techniques as an alternative method to detect Android malware due to their ability to learn and use the existing information to detect the new Android malware apps. This paper presents the basic concepts of Android architecture, Android malware, and permission features utilized as effective malware predictors. Furthermore, a comprehensive review of the existing static, dynamic, and hybrid Android malware detection approaches is presented in this study. More significantly, this paper empirically discusses and compares the performances of six supervised machine learning algorithms, known as K-Nearest Neighbors (K-NN), Decision Tree (DT), Support Vector Machine (SVM), Random Forest (RF), Naïve Bayes (NB), and Logistic Regression (LR), which are commonly used in the literature for detecting malware apps.

Alongside the recognition of the android operating system (OS), android malware is on the increase. Cybercriminals are using different techniques to develop malware for android devices. In addition, malware authors are trying to make malicious android applications that severely undermine the potential of traditional malware detectors. The key purpose of the chapter is to analyze and have a different appearance at various techniques of Android malware detection in a variety of research articles. However, this chapter presents an analysis of varied android malware detection approaches and comparing them to supported various parameters like detection technique, analysis method, features extracted and so on. The experiments are based on substantial malware datasets, evaluation parameters and this study employ a wide variety of machine learning techniques, including decision trees and random forests, support vector machines, logistic model trees, and artificial neural networks, also Deep learning techniques. It is a comparative analysis that should be useful in this field for researchers. The analysis shows, based on simple criteria, the similarities and differences in essential published research in addition to the accuracy. Thus, this chapter aims to study various android malware detection techniques and to identify plausible research directions. The findings showed that machine learning, with greater detection accuracy, is a more promising method. In order to achieve improved accuracy, future researchers can pursue a deep learning approach with the use of a large dataset.

The ubiquity of mobile devices due to the advancement of Internet technology has increased the threat of Android malware, which places users' data, identities, and finances at risk of theft and cybercriminal activities.Android malware detection (AMD), which uses machine learning, faces challenges with high-dimensional datasets, leading to increased computation and reduced accuracy.Feature selection methods extract key features and eliminate redundant data but are still susceptible to overlooking important features, leading to false positives or negatives.This study aims to enhance AMD via a modified dwarf mongoose optimization algorithm (DMOA) for efficient feature selection.The DMOA is improved with adaptive mechanisms, including crossover and mutation strategies, to explore the solution space better.These enhancements help the DMOA avoid local optima and identify superior feature subsets for more accurate malware detection.The CICAndMal2017 dataset is used to evaluate the effectiveness of different machine learning classifiers.The experimental results demonstrate that the proposed modified DMOA model achieves exceptional accuracy.The decision tree (DT), random forest (RF), and XGBoost models have 100% accuracy in binary classification.Furthermore, the proposed modified DMOA consistently outperforms several existing AMD modelsincluding Particle Swarm Optimization (PSO), Multi-Verse Optimizer (MVO), Enhanced Moth Flame Optimizer (EMFO), Aquila Optimizer, and Grey Wolf Optimizer (GWO)-in terms of accuracy, based on results reported in previous studies using the same dataset.

The rapid growth of Android applications has led to increased security threats, making malware detection a critical concern in cybersecurity. This research proposes a static analysis-based technique that employs machine learning for Android malware detection. The proposed method utilizes three classification algorithms: Support Vector Machine (SVM), Random Forest, and Decision Tree. The tool extracts static permission features from APK files to evaluate their effectiveness. The dataset consists of 400 Android applications (200 benign and 200 malicious), which were analyzed using the three machine learning models. Their performance was evaluated and compared using accuracy , precision, recall, and F1-score. The Random Forest model achieved the highest accuracy. The results demonstrate that static analysis combined with a robust classification model can effectively identify malicious applications with a high degree of accuracy. Although the tool is reliable in detecting Android malware, it has limitations in handling obfuscated and dynamic threats. Future research could focus on integrating dynamic analysis techniques to improve detection accuracy and enhance resistance to evasion techniques

With the growing popularity of autonomous vehicles, ensuring their safety has become a significant concern. Vehicle manufacturers have incorporated the Android operating system to enhance user convenience. However, the Android operating system's diversity and vulnerability may significantly impact autonomous vehicles because these natures lead to a critical threat in autonomous vehicle security: Android malware. The complex nature of multi‐data sources fusion in autonomous driving systems has resulted in low detection efficiency and accuracy for Android malware. Given the security requirements for autonomous‐driving systems, this article presents an Android malware classification method centered around the multifeature fusion and deep learning architecture designed to detect and classify Android malware within autonomous‐driving systems. The proposed MUDROID framework relies on the Android permission mechanism and behavioral feature to formulate a malware classification model. Comprising four essential components—feature extraction, representation, multifeature fusion, and classifier training, MUDROID leverages the advantages of CNN and GCN combination model and is adept at extracting and interpreting multidimensional features, consequently constructing a multifeature fusion classifier to amplify the efficiency and accuracy of Android malware detection and classification. The experiment results support MUDROID's superior classification performance, with an impressive Android malware detection accuracy rate of 98.69% and family classification (95.42%). The proposed method can detect and classify Android malware effectively, thus elevating the security and robustness of the self‐driving system. Additionally, the approach in this article also addresses feature representation issues in detecting malware variants, facilitating the recognition of Android malware variants across diverse platforms.

Android based Smartphones are nowadays getting more popular. While using Smartphone, user is always concerned about security and malicious attacks, cryptographic vulnerability of the applications. With increase in the number of Android mobiles, Android malwares are also increasing very rapidly. So the authors have proposed the “Identification of cryptographic vulnerability and malware detection in Android” system. They have designed a user friendly android application, through which user and developer can easily test the application whether it is benign or vulnerable. The application will be tested firstly using static analysis and then the dynamic analysis will be carried out. The authors have implemented static and dynamic analysis of android application for vulnerable and malicious app detection. They have also created a web page. User can either use the application or the web page.

With the increase in the popularity of mobile devices, malicious applications targeting Android platform have greatly increased. Malware is coded so prudently that it has become very complicated to identify. The increase in the large amount of malware every day has made the manual approaches inadequate for detecting the malware. Nowadays, a new malware is characterized by sophisticated and complex obfuscation techniques. Thus, the static malware analysis alone is not enough for detecting it. However, dynamic malware analysis is appropriate to tackle evasion techniques but incapable to investigate all the execution paths and also it is very time consuming. So, for better detection and classification of Android malware, we propose a hybrid approach which integrates the features obtained after performing static and dynamic malware analysis. This approach tackles the problem of analyzing, detecting and classifying the Android malware in a more efficient manner. In this paper, we have used a robust set of features from static and dynamic malware analysis for creating two datasets i.e. binary and multiclass (family) classification datasets. These are made publically available on GitHub and Kaggle with the aim to help researchers and anti-malware tool creators for enhancing or developing new techniques and tools for detecting and classifying Android malware. Various machine learning algorithms are employed to detect and classify malware using the features extracted after performing static and dynamic malware analysis. The experimental outcomes indicate that hybrid approach enhances the accuracy of detection and classification of Android malware as compared to the case when static and dynamic features are considered alone.

Background: Genomic tests are needed in addition to clinical/pathological factors to optimize adjuvant treatment decisions in most patients with HR positive Her-2 negative early BC. We aimed to develop an AI-based model to predict high risk HR positive Her-2 negative early BC by using clinical/pathological data and Oncotype DX scores. Methods: 234 patients who underwent Oncotype Dx test at our center between 2008 and 2023 were included. Clinical/pathologic characteristics and OncotypeDx scores were analysed by an ensemble of XgBoost, Random Forest, LightGBM, and Decision Tree machine learning algorithms to predict high risk disease. The dataset was split into two subsets: 75% for the training and 25% for the test set. The final model is chosen to maximize the precision of high-risk patients by using the data associated with high risk (HR) Oncotype-Dx scores and also the clinical/pathological data from patients who had distant metastases (DM) with low and intermediate recurrence score (RS). Results: Median follow up was 84 months and median age was 47. Among 234 patients % 65 had stage I, % 22 had node positive, % 78 had grade 2 disease. Fourteen %, 68% and 18% of patients had HR, intermediate (IR) and low risk (LR) Oncotype Dx scores respectively, % 72 had clinically LR disease. Six %, 21% and 88% of patients with LR, IR and HR RS received adjuvant chemotherapy. There were 25 events: 13 DM, 2 local/regional relapse, 1 second primary, 9 deaths (7 due to BC). Two patients with HR, 8 patients with IR and 3 patients with LR Oncotype Dx scores had DM. The training (n: 175) and test set (n: 59) had similar risk level distributions. There were 6 DM, 2 deaths due to BC in the test set. Among 6 patients with DM, one patient had LR Oncotype Dx and IR AI-based score, another patient had IR Oncotype Dx and HR AI-based score, 4 patients have concordant scores (3 had IR, 1 had HR in both Oncotype Dx and AI-based model). Oncotype Dx and AI-based predicted scores were concordant in 5/11 (45%) patients with HR, 28/39 (%72) patients with IR and 1/9 (11%) patients with LR Oncotype Dx scores in the test set. There were no DMs in the AI-based low risk group vs one patient with DM in the Oncotype DX LR group. Conclusion: Our model might be used to predict high/intermediate risk patients and its performance needs validation with additional new datasets before its clinical implementation. Citation Format: Gul Basaran, Akif Gunes, Ufuk Kara, Alper Sonkaya, Mehmet Teomete, Alptekin Arıfoglu, Evrim Tezcanlı, Ozge Gumusay, Aykut Soyder. Prediciting high risk hormone receptor (HR) positive Her-2 negative early breast cancer (BC) by artificial intelligence (AI) algorithms [abstract]. In: Proceedings of the San Antonio Breast Cancer Symposium 2024; 2024 Dec 10-13; San Antonio, TX. Philadelphia (PA): AACR; Clin Cancer Res 2025;31(12 Suppl):Abstract nr P4-11-03.

Android malware poses severe threats to users, hence raising an urgent demand for malware detection. In-cloud Android malware detection often suffers privacy leakage and communication overheads. Therefore, this article focuses on on-device Android malware detection. At present, on-device malware detectors are usually trained on servers and then transplanted to mobile devices (e.g., smartphones). In practice, on-device training is particularly important due to the demand for offline updates. Because mobile devices are limited in resource, however, on-device training is hard to implement, especially for those high-complexity malware detectors. To overcome this challenge, we design a lightweight on-device Android malware detector, based on the recently proposed broad learning method. Our detector mainly uses one-shot computation for model training. Hence it can be fully or incrementally trained directly on mobile devices. As far as detection accuracy is concerned, our detector outperforms the shallow learning-based models, including support vector machine (SVM) and AdaBoost, and approaches the deep learning-based models multilayer perceptron (MLP) and convolutional neural network (CNN). Moreover, our detector is more robust to adversarial examples than the existing detectors, and its robustness can be further improved through on-device model retraining. Finally, its advantages are confirmed by extensive experiments, and its practicality is demonstrated through runtime evaluation on smartphones.

Over the past few years, Android Application is deemed as one of the fastest-growing technology areas. On the other hand, the rapid growth of android applications also increases the security threats for Android users in the form of malware. Malware hacks the personal information of a user and exploits it in different criminal activities. To date, various studies have been conducted for the detection of android malware. Some authors have preferred static analysis while others have performed dynamic analysis for android malware detection. In static analysis, researchers have only employed one feature of android application either intents or permissions. As best of our knowledge, there does not exist any technique that combines both intents and permissions. In this paper, we have performed static analysis for the detection of Android malware using android intents (both implicit and explicit), android permissions and combination of intents and permissions. Furthermore, the classification is performed to analyze the effectiveness of different machine learning algorithms for malware detection and to identify the best performing feature. Our experiment results show that combination of intents and permissions play a key role in the detection of android malware.

EfficientNet convolutional neural networks-based Android malware detection

With explosive growth of Android malware and due to the severity of its damages to smart phone users, the detection of Android malware has become increasingly important in cybersecurity. The increasing sophistication of Android malware calls for new defensive techniques that are capable against novel threats and harder to evade. In this paper, to detect Android malware, instead of using Application Programming Interface (API) calls only, we further analyze the different relationships between them and create higher-level semantics which require more effort for attackers to evade the detection. We represent the Android applications (apps), related APIs, and their rich relationships as a structured heterogeneous information network (HIN). Then we use a meta-path based approach to characterize the semantic relatedness of apps and APIs. We use each meta-path to formulate a similarity measure over Android apps, and aggregate different similarities using multi-kernel learning. Then each meta-path is automatically weighted by the learning algorithm to make predictions. To the best of our knowledge, this is the first work to use structured HIN for Android malware detection. Comprehensive experiments on real sample collections from Comodo Cloud Security Center are conducted to compare various malware detection approaches. Promising experimental results demonstrate that our developed system HinDroid outperforms other alternative Android malware detection techniques.