CENDroid—A cluster-ensemble classifier for detecting malicious Android applications

Abstract

Given the use of mobile phones in our day-to-day activities—from basic applications (such as alarm clocks) to sensitive applications (such as banking)—these devices perform a vital function in today's world. Because of the sensitive and critical information they contain, these devices are among the prime targets of hackers. The phone market is dominated by Android-based phones. The open source nature of Android has also spawned various security concerns because of the extensive spread of malware. Accordingly, various classification algorithms (individual as well as ensemble) have been employed for Android malware detection. In this paper, we propose a novel Android malware detection system—CENDroid, which uses static features (API tags and permissions) along with a combination of clustering and ensemble of classifiers for classifying Android apps as benign or malicious. With the proposed cluster-ensemble method, a comparative assessment is implemented on the performance of popular individual classifiers and their ensembles; experiments on three datasets of malicious and benign Android applications are conducted as well. Relevant statistical tests validate that our proposed system outperforms individual classifiers as well as their ensemble in delivering high threshold and rank metrics for malware detection.