Leveraging Application Complexity Partition for Android Malware Detection

Abstract

With the widespread use of Android applications, malicious applications seriously threaten information security and personal privacy. Although a lot of researches have been conducted on malware detection by using various detection models, the effect of the complexity characteristics of Android application on the android malware detection is not investigated in depth. In this article, we leverage application complexity partition for Android malware detection to deal with different android application complexity characteristics in fine-grain. We first investigate the impact of application complexity on malware detection, and utilize application complexity to screen out four datasets with different complexity by dividing the original dataset. Then, we use frequency difference sorting (FDS) algorithm to extract highly sensitive permissions and API calls that can identify benign and malicious applications. Finally, we evaluate support vector machine (SVM) and four other machine learning methods to perform android malware detection with respect to different application complexity partitions. Experimental results show that ACPDs can achieve 95.18%-99.19% accuracy and 95.45%-99.68% recall in different application complexity datasets, which are better than the 91.02% accuracy of SigPID. The experimental results demonstrate that ACPDs are scalable enough to work well with different machine learning methods and improve machine learning based Android malware detection effectively.