Android malware detection through centrality analysis of applications network

Abstract

Android OS is a widely-used platform for mobile devices. However, with the increasing number of Android applications and ongoing advancements in application development, there is a need for flexible and scalable malware detection methods that can address the challenges posed by big data. Recently, researchers have developed methods based on complex network analysis that aim to reduce the complexity and enhance the scalability of malware detection. These methods have shown high accuracy in identifying Android malware. Our proposed method involves generating two weighted graphs that depict the relationships between applications in benign and malware states, respectively, by extracting the functions of each application. Network-analysis-based features are then extracted from the graphs and combined with static application features to distinguish malware applications from benign ones. Our approach demonstrated an increase in accuracy, achieving 99% and 98% accuracy on the DataMD and IntDroid datasets, respectively. We further demonstrate our proposed method’s superiority against state-of-the-art approaches.