Anomaly Android Malware Detection: A Comparative Analysis of Six Classifiers

Abstract

The high proliferation rate of Android devices has exposed the platform to wider vulnerabilities of increasing malware attacks. Emerging trends of the malware threats are employing highly sophisticated and dynamic detection avoidance techniques. This has continued to weaken the capacity of existing signature-based detection systems in their protection against new and unknown threats. Thus, the need for effective detection approaches for unknown and novel Android malware has remained a growing challenge in the field of mobile and information security. This study therefore aimed at investigating the best performing machine learning classification algorithm for the anomaly Android malware detection, leveraging on permission-based feature sets, by conduction a performance comparison analysis between six different classification algorithms namely: Naïve Bayes, Simple Logistics, Random Forest, PART, k-Nearest Neighbours (k-NN), and Support Vector Machine (SVM). The Machine learning tool that was used for the preprocessing of the feature sets and the classification processes is WEKA 3.8.2 suite. Findings of the study showed that Random Forest had the best detection result with false alarm rate of 2.2%, accuracy of 97.4%, error rate of 2.6% and ROC Area of 99.6%. The study concluded that, using Android permission features, Random Forest and k-Nearest Neighbours recoded best performances in Android malware detection, followed by Support Vector Machine and Simple Logistics classification algorithms. Partial Decision Tree (PART) performed relatively well, while Naïve Baye recorded the least performance. Consequently, the deployment of Random Forest model and k-NN model are recommended for the development of an anomaly Android malware detection paradigm.

A comprehensive review on permissions-based Android malware detection

“…McLauglin [68] McAfee, vendor's internal dataset Wang et al [69] Mal com1, Mal com2 and Mal Zhou [220] Grace et al [70] Github Liu et al [71] VirusShare Bayazit et al [72] CICInvesAndMal2019 Lee et al [73] Andro-AutoPsy Dataset [221] Zhu et al [74] MUDFLOW [222], VirusShare Almahmoud et al [75] CIC-AndMal2017, CIC-InvesAndMal2019, CIC-MalDroid2020 Feng et al [76] CICAndMal2017 Kandu et al [77] Genome Arora et al [78] Genome Ding et al [79] CICInvesAndMal2019 Sahin et al [80] M0Droid [223], AMD, Kaggle, [224] Idrees et al [81] Contagio, Drebin, Genome, Virus Total, theZoo, MalShare, VirusShare Khariwal et al [82] Genome, Drebin, Koodous Idrees et al [83] Contagio, VirusTotal, appsapk, Androidmob Zhu et al [15] VirusShare Bai et al [84] Drebin Taheri et al [85] Drebin, Contagio, Genome Alazab et al [86] AndroZoo, Contagio, MalShare, VirusShare, VirusTotal Mathur et al [87] Androzoo, AMD Imtiaz et al [88] CICInves AndMal2019 Liu et al [89] OmniDroid, CIC2019, CIC2020 Chen et al [90] VirusShare Guan et al [91] VirusShare Mohamed et al [92] Genome, Maldroid Varma et al [93] CICInvesAnd Mal2019 Gyunka et al [94] Genome, Contagio Taha et al [95] Drebin Peng et al [96] CICMalDroid 2020, CIC-InvesAndMal 2019, Drebin Ashwini et al [97] Drebin Jiang et al [98] Genome, Andro MalShare Wang et al [99] Information Security Lab of Peking University Rana et al …”

Performance Analysis of Machine Learning Methods with Class Imbalance Problem in Android Malware Detection

“…In all, the RF classifier trained with the static API sequence-based features achieved the best results. In Gyunka, et al [35], performance comparison of six ML algorithms: NB, Logistics Regression (LR), RF, Classification And Regression Tree (CART), KNN, and SVM leveraging on the permission-based feature set for anomaly Android malware detection. RF and KNN outperformed other algorithms considering Android permission features in malware detection.…”

IDS/IPS technologijomis grįsto mobiliųjų įrenginių atakų prevencijos metodo sukūrimas ir tyrimas

“…Taip pat populiariais atakos vektoriais tampa sparčiai rinkoje platinamos aplikacijos [2], kurios gali pasirodyti nežalingos [3] [4], tačiau vykdo duomenų vagystės, šnipinėjimo bei kitas veiklas. Tai kelia pavojų ne tik plačioms vartotojų grupėms bet ir medicinos [5], informacinių technologijų ir pramonės [6] verslo sektoriams. Tai vyksta todėl, kad neretai organizacijose yra priimtina BYOD (angl.…”