A Novel Machine Learning Approach for Android Malware Detection Based on the Co-Existence of Features

Abstract

This paper proposes a machine learning model based on the co-existence of static features for Android malware detection. The proposed model assumes that Android malware requests an abnormal set of co-existed permissions and APIs in comparing to those requested by benign applications. To prove this assumption, the paper created a new dataset of co-existed permissions and API calls at different levels of combinations, which are the second level, the third level, the fourth level and the fifth level. The extracted datasets of co-existed features at different levels were applied on permissions only, APIs only, permissions and APIs, and APIs and APIs frequencies. To extract the most relevant co-existed features, the frequent pattern growth (FP-growth) algorithm, which is an association rule mining technique, was used. The new datasets were extracted using Android APK samples from the Drebin, Malgenome and MalDroid2020 datasets. To evaluate the proposed model, several conventional machine learning algorithms were used. The results show that the model can successfully classify Android malware with a high accuracy using machine learning algorithms and the co-existence of features. Moreover, the results show that the achieved classification accuracy depends on the classifier and the type of co-existed features. The maximum accuracy, which is 98%, was achieved using the Random Forest algorithm and the co-existence of permissions features at the second combination level. Furthermore, the results show that the proposed approach outperforms the state-of-the-art model. Using Malgenome dataset, the proposed approach achieved an accuracy of about 98%, while the state-of-the-art achieved an accuracy of about 87%. In addition, the experiments show that using the Drebin dataset, the proposed approach achieved an accuracy of about 95%, while the state-of-theart achieved an accuracy of about 93%. INDEX TERMS Android, Co-existence, FP-growth, Machine Learning, Malware I. INTRODUCTIONS MARTPHONE market is growing immensely. According to the ICD report [1], it is estimated that by 2024, the annual sales of mobile phones will reach more than 351 million units globally. Among the several mobiles operating systems, Android is the dominant operating system with over 2.5 billion active users across over 190 countries [2].The wide range of capabilities offered by smartphones and the rising number of activities carried out by their users, including social networking, online banking, and gaming, has given rise to very serious concerns about device security and personal privacy. Since Android is an open-source platform, it is easy for malware developer to launch their attacks and develop Android malware apps that pose severe harm. Ob-viously, the impact of Android malware is rising in modern society [3][4].Mobile malware is constantly updated with new features to evade detection by anti-malware scanners. Android malware applications usually use three types of breakthrough techniques to get access to the user's devices. 1) Repackaging: is one of ...

Hyperparameter Tunning and Feature Selection Methods for Malware Detection

“…In this method, each decision tree is created according to the dependency relationships of the data samples [38]. It uses the averaging method to increase the accuracy and prevent overfitting [39].…”

Feature Selection Using Adaptive Weight Based Grey Wolf Optimization for Malware Detection in Android

“…The malware is commonly determined by four main groups such as hardware, kernel, hardware abstraction layer as well as application-based attacks [6]. This malware causes a number of material as well as non-material damages named unauthorized action on behalf of users, collection of significant information from users, damaging the device hardware [7].…”

AMDDLmodel: Android smartphones malware detection using deep learning model

“…Several studies have been carried out to explore the use of DL in AM detection. In [4], the DL-based methods based on permission patterns and API calls were developed for AM detection. In the same way, the research work in [5] used DL approaches to evaluate static and dynamic characteristics of Android applications and attained high identification accuracy.…”