Android malware classification using static code analysis and Apriori algorithm improved with particle swarm optimization

Abstract

Several machine learning techniques based on supervised learning have been adopted in the classification of malware. However, only supervised learning techniques have proofed insufficient for malware classification task. This paper presents a classification of android malware using candidate detectors generated from an unsupervised association rule of Apriori algorithm improved with particle swarm optimization to train three different supervised classifiers. In this method, features were extracted from Android applications byte-code through static code analysis, selected and were used to train supervised classifiers. Using a number of candidate detectors, the true positive rate of detecting malicious code is maximized, while the false positive rate of wrongful detection is minimized. The results of the experiments show that the proposed combined technique has remarkable benefits over the detection using only supervised or unsupervised learners.

On the use of artificial malicious patterns for android malware detection

“…Malware classification approaches can be categorized into two heads. The first category refers to the non-evolutionary based classification approaches, where works such as [31], [32], [42], [43], [56] can be mentioned, while the second category refers to the branch of the evolutionary based classification approaches like in [1]. In this paper, our main focus relies on the evolutionary based approaches.…”

Improved Malware Detection Model with Apriori Association Rule and Particle Swarm Optimization

“…This algorithm, PSO, has been applied successfully for the generation of candidate detector in negative selection algorithm for spam detection [14,15], virus detection [16], feature selection [17][18][19], anomaly detection [20,21], and intrusion and misuse detection [11,12]. PSO has also proved to be a successful optimizer in fuzzy system [12], multiobjective problems [22], and tracking system [23], fuzzy rule learning [24], and classifying malicious android applications [25].…”

“…The tests show that using Degree of freedom (DF) = (2-1) (2-1) = 1 with ∝ = 0.05, ℎ 2 = 3.841, for all McNemar's Test and previous calculated values are greater than distribution 2 values; therefore, there is a significant difference between the compared models and, therefore, AAR-PSO outperforms other models. The novelty in this work is the inclusion of improved detection algorithm with PSO using association rule for signature extraction, compared to the existing one in [25], which was based only on classification exercise using an improved apriori algorithm with particle swarm optimization for selection and data mining algorithms for classification.…”

“…The authors wish to acknowledge the support of Federal Government of Nigeria under TETFUND Scholarship and International Islamic University Malaysia under the Endowment Grant research number EDW B14-123-1008. Authors also wish to acknowledge this work is a continuation of research in [25] with hyperlink https://ieeexplore.ieee .org/document/7077314.…”

Machine Learning for Analyzing Malware

“…Adebayo et al [52] presented a classification system of Android malware using candidate detectors generated from Apriori algorithm improved with particle swarm optimization to train three different supervised classifiers. In this method, features were extracted from Android applications byte-code through static code analysis, selected and used to train supervised classifiers.…”