Evaluating Dynamic Analysis Features for Android Malware Categorization

Abstract

Tremendous increase and sophistication in Android applications is making malware detection a challenging task. The use of obfuscation has complicated the task of malware detection, as static analysis can be deceived by different obfuscation schemes. Recently, studies have focused on dynamic analysis of applications, as it is more resilient against obfuscation techniques. CCCS-CIC-AndMal-2020; published by Canadian institute for cybersecurity is a recent data set of extracted features of malicious Android applications. The dynamic features in this data set belong to six categories: memory, network, battery, logs, process and APIs. Previous studies have focused on classification of Android malware using dynamic features. However, the impact of individual categories of dynamic features for malware categorization has not been analyzed in length. In this study, a comprehensive analysis on the impact of all dynamic analysis categories and features on Android malware detection is conducted using different filter and wrapper methods. The most significant categories of dynamic features are reported and important features in those categories are also listed.