Deep Feature Extraction and Classification of Android Malware Images

Distinguishing malicious programs based on visualization and hybrid learning algorithms

The increasing number of mobile devices using the Android operating system in the market makes these devices the first target for malicious applications. In recent years, several Android malware applications were developed to perform certain illegitimate activities and harmful actions on mobile devices. In response, specific tools and anti-virus programs used conventional signature-based methods in order to detect such Android malware applications. However, the most recent Android malware apps, such as zero-day, cannot be detected through conventional methods that are still based on fixed signatures or identifiers. Therefore, the most recently published research studies have suggested machine learning techniques as an alternative method to detect Android malware due to their ability to learn and use the existing information to detect the new Android malware apps. This paper presents the basic concepts of Android architecture, Android malware, and permission features utilized as effective malware predictors. Furthermore, a comprehensive review of the existing static, dynamic, and hybrid Android malware detection approaches is presented in this study. More significantly, this paper empirically discusses and compares the performances of six supervised machine learning algorithms, known as K-Nearest Neighbors (K-NN), Decision Tree (DT), Support Vector Machine (SVM), Random Forest (RF), Naïve Bayes (NB), and Logistic Regression (LR), which are commonly used in the literature for detecting malware apps.

The attack that occurred recently involved the utilization of malicious software, commonly referred to as malware, along with advanced techniques such as machine learning, specifically deep learning, code transformation, and polymorphism. This makes it harder for cyber experts to detect malware using traditional analysis methods. In view of the low accuracy and high false positive rate of traditional malware detection methods, this research proposes a fine-tuned deep learning model with a novel dataset that is compared with ANN, Support Vector Machine (SVM), random forest (RF), K-Nearest Neighbourhood (KNN) classifiers. Converting a malware code into an image could allow users to effectively identify the presence of malware, even if the original code is modified by the creator. This is due to the fact that the attributes of images remain unchanged, allowing for reliable identification. So, researchers used deep learning technology to detect malware, like detecting malaria from red blood cells. The deep learning model found that a more detailed analysis of malware data sets, focusing on RGB and greyscale images, is needed. These data sets currently rely on publicly available data, but the accuracy of the traditional model could be a lot higher. It also produces many false positive results. The main goal is to create a new data set and model using malware images to identify and categorize malware using deep learning without relying on existing image detection and transfer learning models. The researcher adjusted different hyper parameters, like the number of neurons, filters, stride, hidden units, layers, learning rate, batch size, activation function, optimizer, and epochs. Identifying and correcting issues in models, improving their clarity, stability, and fairness, as well as debugging and monitoring them, is a challenging task. To eliminate this obstacle, assess the model's behaviour and performance by employing various methods such as logging, profiling, testing, visualization, and model clarity. To overcome the challenges posed by the electricity shutdown, we utilized Google's cloud-based GPU and Python 3.7 language to conduct the experiment and train the model. Kali Linux is an operating system that can automatically encrypt file systems and has a lower chance of crashing the system due to malware in a virtual sandbox. The researcher used techniques like early stopping and cross-validation to prevent over fitting and assess generalization in addition to monitoring and evaluating the model's behaviour and performance. The researcher used different methods like L1 and L2 regularization, dropout, and batch normalization to improve the model's performance and avoid over fitting. The binary portable executable (PE) malware dataset is collected from Kaggle, Malimg, Virusshare, Malvis, MS Big2015, and VX-underground and finally converted to greyscale and RGB images to create a novel dataset to fill the lack of image dataset. The raw dataset was then rescaled to a 128x128 greyscale and RGB (red, green, blue) image and flattened to 1024-byte vector images input into convolution neural network (CNN) interpolation to extract features for malware detection. The newly acquired dataset is utilized as an input for the innovative DL algorithms in order to create a tailor-made model capable of accurately predicting malware. The findings in this customized CNN model by fine-tuning hyper-parameters with the three-channel RGB dataset outperformed a greyscale dataset with an accuracy of 98.7% and error rate of 1.3% in current malware compared with other artificial neural network (ANN), ML algorithms such as Support Vector Machine (SVM), K-Nearest Neighbour (KNN), and also Random Forest (RF) models. The proposed approach is compatible with all operating systems (Windows, Linux, and Mac) and can identify different types of malwares, such as packed, polymorphic, obfuscated, metamorphic, or variations of a malware family. There are some limitations to the shortage of malware image datasets and computational costs for fine-tuning hyper parameters in the whole model. Furthermore, the proposed approach detects malware and groups it into families without using common techniques like disassembly, decompilation, de-obfuscation, or running malicious code in a virtual environment.

Highlights A hybrid CNN–WE model markedly improves the accuracy of barley disease classification. Adaptive weighting enhances decision stability by reducing the influence of weaker classifiers. The proposed ensemble achieves 98.72% accuracy, outperforming individual models. The framework supports accurate barley disease detection and contributes to the next generation of smart agriculture. ABSTRACT. Rhynchosporium commune and Pyrenophora teres are two of the most prevalent barley diseases, and their highly similar visual symptoms make accurate diagnosis and differentiation particularly challenging. Artificial intelligence (AI) and machine learning (ML) methods have been widely applied to plant disease detection; however, their performance often degrades under diverse field conditions and noisy image data. Moreover, reliance on a single model increases vulnerability to its specific limitations, especially when diseases exhibit overlapping visual characteristics. To address these challenges, this study proposes a hybrid model that integrates deep feature extraction using a Convolutional Neural Network (CNN) with a weighted ensemble (WE) of ML classifiers. The CNN-extracted features are fed into four classifiers: Support Vector Machine (SVM), k-Nearest Neighbors (k-NN), Random Forest (RF), and Decision Tree (DT), each leveraging distinct strengths in handling complex, nonlinear, and interpretable data. A dynamic weighting strategy is then applied, assigning higher weights to classifiers with superior validation accuracy, and the final prediction is obtained through weighted majority voting. Unlike conventional ensemble methods that treat all classifiers equally, this adaptive weighting enhances decision stability, reduces the influence of weaker models, and significantly improves overall accuracy. Experimental results demonstrate classification accuracies of 82.5% for CNN, 87.3% for k-NN, 83.7% for DT, 91.6% for SVM, and 93.5% for RF, while the proposed WE achieves 98.72% accuracy. Furthermore, the ensemble model attains class-wise precision of 98.5% for R. commune, 97.5% for P. teres, and 98.5% for healthy samples, marking a substantial improvement over individual classifiers. These findings highlight the effectiveness of combining automatic deep feature extraction with adaptive ensemble learning, offering a robust framework for accurate barley disease detection and contributing to the advancement of intelligent plant health monitoring and precision agriculture systems. Keywords: Barley disease classification, Convolutional neural networks, Deep feature extraction, Ensemble classifiers, Machine learning, Weighted ensemble.

With the growing popularity of autonomous vehicles, ensuring their safety has become a significant concern. Vehicle manufacturers have incorporated the Android operating system to enhance user convenience. However, the Android operating system's diversity and vulnerability may significantly impact autonomous vehicles because these natures lead to a critical threat in autonomous vehicle security: Android malware. The complex nature of multi‐data sources fusion in autonomous driving systems has resulted in low detection efficiency and accuracy for Android malware. Given the security requirements for autonomous‐driving systems, this article presents an Android malware classification method centered around the multifeature fusion and deep learning architecture designed to detect and classify Android malware within autonomous‐driving systems. The proposed MUDROID framework relies on the Android permission mechanism and behavioral feature to formulate a malware classification model. Comprising four essential components—feature extraction, representation, multifeature fusion, and classifier training, MUDROID leverages the advantages of CNN and GCN combination model and is adept at extracting and interpreting multidimensional features, consequently constructing a multifeature fusion classifier to amplify the efficiency and accuracy of Android malware detection and classification. The experiment results support MUDROID's superior classification performance, with an impressive Android malware detection accuracy rate of 98.69% and family classification (95.42%). The proposed method can detect and classify Android malware effectively, thus elevating the security and robustness of the self‐driving system. Additionally, the approach in this article also addresses feature representation issues in detecting malware variants, facilitating the recognition of Android malware variants across diverse platforms.

An exhaustive measurement of re-sampling detection in lossy compressed images using deep learning approach

Currently the android platform is that the quickest growing hand-held OS package. And it’s become the foremost desirable and viable objective of malevolent applications. Android malware growth has been increasing dramatically in conjunction with increasing the variety and guiltiness of their developing techniques. Mobile malware is therefore pernicious and, on the increase, consequently having a quick and reliable detection system is important for the users. Subtle Android malware use detection shunning techniques so as to cover their malicious activities from analysis tools. During this analysis, a brand-new detection and characterization system for investigation significant deviations within the network behaviour of a smart-phone application is planned. The most goal of the planned system is to guard mobile device users and cellular infrastructure corporations from malicious applications simply nine traffic feature measurements. The planned system isn’t solely ready to observe the malicious or masquerading apps, however may also determine them as general malware or specific malware (i.e. adware) on a mobile device. The planned methodology showed the common accuracy 94% for 5 classifiers namely; Random Forest (RF), K-Nearest Neighbour (KNN), decision Tree (DT), Random Tree (RT) and Regression (R) etc. We have a tendency to conjointly provide a tagged dataset of mobile malware traffic with a lot of applications includes benign and twelve completely different families of each adware and general malware. Recent substantial analysis on machine learning algorithms analyse options from mischievous application and use those preferences to catalogue and discover unknown malicious applications. This study condenses the progression of malware detection techniques supported machine learning algorithms centred on the Android Operating systems.

This study presents a comparative analysis of the classification performance of facial and emotion recognition systems using Machine Learning (ML) and Deep Learning (DL) algorithms. The primary objective of this work is to evaluate the applicability of emotion recognition in fields such as psychotherapy and crime analysis, using the FER-2013 dataset.The study was conducted with ML algorithms such as Support Vector Machines (SVM), Random Forest (RF), K-Nearest Neighbor (KNN), Decision Trees, and Gradient Boosting, as well as the DL algorithm, Convolutional Neural Network (CNN). Supported by the application of feature selection, preprocessing, and feature extraction techniques, the model’s performance was measured using standard metrics such as accuracy, precision, F1-score, and AUC-ROC.The experimental results showed that the highest classification accuracy (46.61%) was achieved with the CNN model. While the ML models generally offered lower accuracy, they provided advantages in terms of computational efficiency in specific scenarios.This study aims to contribute to the literature by providing a comparative analysis of ML and DL algorithms and by highlighting the effect of data preprocessing on performance. The findings set targets for future work, such as real-time system integration and hybrid model development.

An intrusion detection system (IDS) is an important protection instrument for detecting complex network attacks. Various machine learning (ML) or deep learning (DL) algorithms have been proposed for implementing anomaly-based IDS (AIDS). Our review of the AIDS literature identifies some issues in related work, including the randomness of the selected algorithms, parameters, and testing criteria, the application of old datasets, or shallow analyses and validation of the results. This paper comprehensively reviews previous studies on AIDS by using a set of criteria with different datasets and types of attacks to set benchmarking outcomes that can reveal the suitable AIDS algorithms, parameters, and testing criteria. Specifically, this paper applies 10 popular supervised and unsupervised ML algorithms for identifying effective and efficient ML-AIDS of networks and computers. These supervised ML algorithms include the artificial neural network (ANN), decision tree (DT), k-nearest neighbor (k-NN), naive Bayes (NB), random forest (RF), support vector machine (SVM), and convolutional neural network (CNN) algorithms, whereas the unsupervised ML algorithms include the expectation-maximization (EM), k-means, and self-organizing maps (SOM) algorithms. Several models of these algorithms are introduced, and the turning and training parameters of each algorithm are examined to achieve an optimal classifier evaluation. Unlike previous studies, this study evaluates the performance of AIDS by measuring the true positive and negative rates, accuracy, precision, recall, and F-Score of 31 ML-AIDS models. The training and testing time for ML-AIDS models are also considered in measuring their performance efficiency given that time complexity is an important factor in AIDSs. The ML-AIDS models are tested by using a recent and highly unbalanced multiclass CICIDS2017 dataset that involves real-world network attacks. In general, the k-NN-AIDS, DT-AIDS, and NB-AIDS models obtain the best results and show a greater capability in detecting web attacks compared with other models that demonstrate irregular and inferior results.

Identification and detection of malware is important in private and government agencies for defending against cyber attack on network security. Current methods for malware analysis achieves promising results using linear methods, such as, PCA. It is well-known that the underlying physical processes behind malware binaries to image conversion are highly nonlinear. Our work set out to understand the impact of malware image resolution on suitable neighborhood size over which to consider pattern phenomena, if nonlinear methods capture pattern phenomena with increased efficacy, and how they improve clustering and identification of malware. In real-life use cases, good clustering practice requires scientific and domain knowledge. As there is no rich domain history of malware image data, we set out to explore different clustering methods with reasoning. Image domains are typically high-dimensional and can have many instantiations. For this reason, statistical approaches to clustering can fail because low probability mass is associated with a single image. Moreover, related images will therefore have subtle differences as measured by their probabilities. We developed an information theoretic method for measurement of malware image resolutions and found that nonlinear methods are better in capturing underlying data regularity and give statistically significant improvement in clustering results than linear methods. This is the first application of nonlinear Manifold learning to malware image analysis in the research literature.

With the increase in the popularity of mobile devices, malicious applications targeting Android platform have greatly increased. Malware is coded so prudently that it has become very complicated to identify. The increase in the large amount of malware every day has made the manual approaches inadequate for detecting the malware. Nowadays, a new malware is characterized by sophisticated and complex obfuscation techniques. Thus, the static malware analysis alone is not enough for detecting it. However, dynamic malware analysis is appropriate to tackle evasion techniques but incapable to investigate all the execution paths and also it is very time consuming. So, for better detection and classification of Android malware, we propose a hybrid approach which integrates the features obtained after performing static and dynamic malware analysis. This approach tackles the problem of analyzing, detecting and classifying the Android malware in a more efficient manner. In this paper, we have used a robust set of features from static and dynamic malware analysis for creating two datasets i.e. binary and multiclass (family) classification datasets. These are made publically available on GitHub and Kaggle with the aim to help researchers and anti-malware tool creators for enhancing or developing new techniques and tools for detecting and classifying Android malware. Various machine learning algorithms are employed to detect and classify malware using the features extracted after performing static and dynamic malware analysis. The experimental outcomes indicate that hybrid approach enhances the accuracy of detection and classification of Android malware as compared to the case when static and dynamic features are considered alone.

- The Plant Disease Detection and Classification project is designed to help farmers identify crop diseases at an early stage using images of plant leaves. By applying advanced machine learning (ML) and deep learning (DL) techniques, this system aims to automatically detect and classify various plant diseases with high accuracy. Early identification of plant diseases plays a vital role in improving crop yield, reducing unnecessary pesticide usage, and encouraging sustainable farming practices. Once a disease is detected, the system not only identifies it but also provides a brief description and recommends appropriate prevention and treatment methods. To enhance performance, the project uses data augmentation and normalization techniques—helping the model handle variations in lighting, angles, and environmental conditions. The system is trained on a diverse dataset containing images of both healthy and diseased leaves from different plant species, categorized into 38 different classes. The project incorporates various machine learning algorithms such as Support Vector Machines (SVM), K-Nearest Neighbors (KNN), Decision Trees, and Random Forests, as well as a Convolutional Neural Network (CNN) for deep learning. Among these, CNNs have shown outstanding performance due to their ability to learn spatial features from images effectively. While existing research has shown promising results, real-world challenges such as varying image quality, lighting conditions, and background clutter still affect accuracy. This project aims to overcome these issues by training on large, diverse datasets and fine-tuning model parameters. Ultimately, this project hopes to empower farmers with an intelligent tool to monitor crop health, make informed decisions, and contribute to food security through precision agriculture. Keywords: Plant Disease Detection, Automated Disease Detection System, Machine Learning, Deep Learning, Data Augmentation, Data Normalization, Support Vector Machine, KNN Classifier, Convolutional Neural Network, Decision Trees, Random Forest

SummaryScale precipitation in petroleum equipment is known as an important problem that causes damages in injection and production wells. Scale precipitation causes equipment corrosion and flow restriction and consequently a reduction in oil production. Due to this fact, the prediction of scale precipitation has vital importance among petroleum engineers. In the current work, different intelligent models, including the decision tree, random forest (RF), artificial neural network (ANN), K-nearest neighbors (KNN), convolutional neural network (CNN), support vector machine (SVM), ensemble learning, logistic regression, Naïve Bayes, and adaptive boosting (AdaBoost), are used to estimate scale formation as a function of pH and ionic compositions. Also, a sensitivity analysis is done to determine the most influential parameters on scale formation. The novelty of this work is to compare the performance of 10 different machine learning algorithms at modeling an extremely non-linear relationship between the inputs and the outputs in scale precipitation prediction. After determining the best models, they can be used to determine scale formation by manipulating the concentration of a variable in accordance with the result of the sensitivity analysis. Different classification metrics, including the accuracy, precision, F1-score, and recall, were used to compare the performance of the mentioned models. Results in the testing phase showed that the KNN and ensemble learning were the most accurate tools based on all performance metrics of solving the classification of scale/no-scale problem. As the output had an extremely non-linear behavior in terms of the inputs, an instance-based learning algorithm such as the KNN best suited the classification task in this study. This argumentation was backed by the classification results. Furthermore, the SVM, Naïve Bayes, and logistic regression performance metrics were not satisfactory in the prediction of scale formation. Note that the hyperparameters of the models were found by grid search and random search approaches. Finally, the sensitivity analysis showed that the variations in the concentration of Ca had the highest impact on scale precipitation.

Shape recognition plays a significant role in the field of robot perception. In view of the low efficiency and few types of shape recognition of the fiber tactile sensor applied to flexible skin, a convolutional-neural-network-based FBG tactile sensing array shape recognition method was proposed. Firstly, a sensing array was fabricated using flexible resin and 3D printing technology. Secondly, a shape recognition system based on the tactile sensing array was constructed to collect shape data. Finally, shape classification recognition was performed using convolutional neural network, random forest, support vector machine, and k-nearest neighbor. The results indicate that the tactile sensing array exhibits good sensitivity and perception capability. The shape recognition accuracy of convolutional neural network is 96.58%, which is 6.11%, 9.44%, and 12.01% higher than that of random forest, k-nearest neighbor, and support vector machine. Its F1 is 96.95%, which is 6.3%, 8.73%, and 11.94% higher than random forest, k-nearest neighbor, and support vector machine. The research of FBG shape sensing array based on convolutional neural network provides an experimental basis for shape perception of flexible tactile sensing.

Android, the most widely used mobile operating system, is also the most vulnerable to malware due to its high popularity. This has significantly focused on Android malware detection in mobile security. While extensive research has been conducted using various methods, new malware’s emergence underscores this field’s dynamic nature and the need for continuous research. The motivation that drives malware developers to create Android malware constantly is the potential to access Android devices, thereby gaining access to sensitive user information. This study, which is a complex and in-depth exploration, aims to detect Android malware using a meta-classifier that combines the single-classifier light gradient boosting machine, support vector machine, and random forest. The process involves converting disassembled malware codes into grey images for global and local feature extraction. The classification accuracy is 97% at best on a malware dataset of 3,963 samples. The main contribution of this paper is to produce an Android APK malware detector model that works by combining multiple machine learning algorithms trained using the dataset resulting from local and global feature extraction algorithms.