Android Malware Detection Using API Calls: A Comparison of Feature Selection and Machine Learning Models

Muzaffar, Ali; Hassen, Hani Ragab; Lones, Michael A.; Zantout, Hind

doi:10.1007/978-3-030-95918-0_1

Cited by 5 publications

(2 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although these results suggest that 50 API calls are insufficient to train accurate models, from a practical perspective, it remains desirable to work with smaller feature sets. Consequently, in Muzaffar et al [30], we investigated the use of dimensionality reduction in API feature sets more broadly. We used a dataset of 20,000 benign applications and 20,000 malicious applications, and our results showed that the accuracy of the ML models could be improved by reducing the number of API calls by approximately 95% from the original set of 134,207.…”

Section: Reducing the Number Of Api Callsmentioning

confidence: 99%

A Comprehensive Investigation of Feature and Model Importance in Android Malware Detection

Ali¹,

Hassen²,

Zantout³

et al. 2023

Preprint

View full text Add to dashboard Cite

The popularity and relative openness of Android means it is a popular target for malware. Over the years, various studies have found that machine learning models can effectively discriminate malware from benign applications. However, as the operating system evolves, so does malware, bringing into question the findings of these previous studies, many of which used small, outdated, and often imbalanced datasets. In this paper, we reimplement 16 representative past works and evaluate them on a balanced, relevant and up-to-date dataset comprising 124,000 Android applications. We also carry out new experiments designed to fill holes in existing knowledge, and use our findings to identify the most effective features and models to use for Android malware detection within a contemporary environment. Our results suggest that accuracies of up to 96.8% can be achieved using static features alone, with a further 1% achievable using more expensive dynamic analysis approaches. We find the best models to be random forests built from API call usage and TCP network traffic features.

show abstract

Section: Reducing the Number Of Api Callsmentioning

confidence: 99%

A Comprehensive Investigation of Feature and Model Importance in Android Malware Detection

Ali¹,

Hassen²,

Zantout³

et al. 2023

Preprint

View full text Add to dashboard Cite

show abstract

“…We used DroidDissector in two of our previous works. In [8], we carried out an investigation on API calls and how feature selection and machine learning models affect detection rates. The results showed an accuracy rate of up to 96%.…”

Section: Introductionmentioning

confidence: 99%

DroidDissector: A Static and Dynamic Analysis Tool for Android Malware Detection

Muzaffar,

Ragab Hassen,

Zantout

et al. 2023

Proceedings of the International Conference on Applied Cybersecurity (ACS) 2023

Self Cite

View full text Add to dashboard Cite

DroidDissector is an extraction tool for both static and dynamic features. The aim is to provide Android malware researchers and analysts with an integrated tool that can extract all of the most widely used features in Android malware detection from one location. The static analysis module extracts features from both the manifest file and the source code of the application to obtain a broad array of features that include permissions, API call graphs and opcodes. The dynamic analysis module runs on the latest version of Android and analyses the complete behaviour of an application by tracking the system calls used, network traffic generated, API calls used and log files produced by the application.

show abstract

Android Malware Detection Using Control Flow Graphs and Text Analysis

Muzaffar,

Riaz,

Ragab Hassen

2023

Proceedings of the International Conference on Applied Cybersecurity (ACS) 2023

View full text Add to dashboard Cite

Android Malware Detection Using API Calls: A Comparison of Feature Selection and Machine Learning Models

Cited by 5 publications

References 8 publications

A Comprehensive Investigation of Feature and Model Importance in Android Malware Detection

A Comprehensive Investigation of Feature and Model Importance in Android Malware Detection

DroidDissector: A Static and Dynamic Analysis Tool for Android Malware Detection

Android Malware Detection Using Control Flow Graphs and Text Analysis

Contact Info

Product

Resources

About