Android Malware Classification Research Articles

TabLSTMNet: enhancing android malware classification through integrated attention and explainable AI

TabLSTMNet: enhancing android malware classification through integrated attention and explainable AI

Securing Mobile Devices from Malware: A Faceoff Between Federated Learning and Deep Learning Models for Android Malware Classification

Securing Mobile Devices from Malware: A Faceoff Between Federated Learning and Deep Learning Models for Android Malware Classification

EAGLE: Evasion Attacks Guided by Local Explanations against Android Malware Classification

EAGLE: Evasion Attacks Guided by Local Explanations against Android Malware Classification

Explainable Machine Learning for Malware Detection on Android Applications

The presence of malicious software (malware), for example, in Android applications (apps), has harmful or irreparable consequences to the user and/or the device. Despite the protections app stores provide to avoid malware, it keeps growing in sophistication and diffusion. In this paper, we explore the use of machine learning (ML) techniques to detect malware in Android apps. The focus is on the study of different data pre-processing, dimensionality reduction, and classification techniques, assessing the generalization ability of the learned models using public domain datasets and specifically developed apps. We find that the classifiers that achieve better performance for this task are support vector machines (SVM) and random forests (RF). We emphasize the use of feature selection (FS) techniques to reduce the data dimensionality and to identify the most relevant features in Android malware classification, leading to explainability on this task. Our approach can identify the most relevant features to classify an app as malware. Namely, we conclude that permissions play a prominent role in Android malware detection. The proposed approach reduces the data dimensionality while achieving high accuracy in identifying malware in Android apps.

Contrastive Learning for Robust Android Malware Familial Classification

Due to its open-source nature, Android operating system has been the main target of attackers to exploit. Malware creators always perform different code obfuscations on their apps to hide malicious activities. Features extracted from these obfuscated samples through program analysis contain many useless and disguised features, which leads to many false negatives. To address the issue, in this paper, we demonstrate that obfuscation-resilient malware family analysis can be achieved through contrastive learning. The key insight behind our analysis is that contrastive learning can be used to reduce the difference introduced by obfuscation while amplifying the difference between malware and other types of malware. Based on the proposed analysis, we design a system that can achieve robust and interpretable classification of Android malware. To achieve robust classification, we perform contrastive learning on malware samples to learn an encoder that can automatically extract robust features from malware samples. To achieve interpretable classification, we transform the function call graph of a sample into an image by centrality analysis. Then the corresponding heatmaps can be obtained by visualization techniques. These heatmaps can help users understand why the malware is classified as this family. We implement <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">IFDroid</i> and perform extensive evaluations on two datasets. Experimental results show that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">IFDroid</i> is superior to state-of-the-art Android malware familial classification systems. Moreover, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">IFDroid</i> is capable of maintaining a 98.4% F1 on classifying 69,421 obfuscated malware samples.

Multi-label Classification for Android Malware Based on Active Learning

The existing malware classification approaches (i.e., binary and family classification) can barely benefit subsequent analysis with their outputs. Even the family classification approaches suffer from lacking a formal naming standard and an incomplete definition of malicious behaviors. More importantly, the existing approaches are powerless for one malware with multiple malicious behaviors, while this is a very common phenomenon for Android malware in the wild. So that both of them actually cannot provide researchers with a direct and comprehensive enough understanding of malware. In this paper, we propose MLCDroid, an ML-based multi-label classification approach that can directly indicate the existence of pre-defined malicious behaviors. With an in-depth analysis, we summarize 6 basic malicious behaviors from real-world malware with security reports and construct a labeled dataset. We compare the results of 70 algorithm combinations to evaluate the effectiveness (best at 73.3%). Faced with the challenge of the expensive cost of data annotation, we further propose an active learning approach based on data augmentation, which can improve the overall accuracy to 86.7% with a data augmentation of 5,000+ high-quality samples from an unlabeled malware dataset. This is the first multi-label Android malware classification approach intending to provide more information on fine-grained malicious behaviors.

Android Malware Classification Based on Fuzzy Hashing Visualization

The proliferation of Android-based devices has brought about an unprecedented surge in mobile application usage, making the Android ecosystem a prime target for cybercriminals. In this paper, a new method for Android malware classification is proposed. The method implements a convolutional neural network for malware classification using images. The research presents a novel approach to transforming the Android Application Package (APK) into a grayscale image. The image creation utilizes natural language processing techniques for text cleaning, extraction, and fuzzy hashing to represent the decompiled code from the APK in a set of hashes after preprocessing, where the image is composed of n fuzzy hashes that represent an APK. The method was tested on an Android malware dataset with 15,493 samples of five malware types. The proposed method showed an increase in accuracy compared to others in the literature, achieving up to 98.24% in the classification task.

SynDroid: An adaptive enhanced Android malware classification method based on CTGAN-SVM

Android mobile phones have the highest market share nowadays, bringing a boom of Android application programming as well as malicious software (malware) issues. Traditional machine learning and deep learning methods are widely used in Android malware detection and classification, both require plenty of application samples to train classifiers. However, the collected samples are always imbalanced, because the distribution of malware categories differs hugely in the real environment. For Android malware samples with high dimension features, and Class Imbalance Ratio coming to more than 100:1, traditional methods become weak. To fill the gap, we propose an Android malware classification model named SynDroid. The core step of SynDroid uses CTGAN-SVM to generate qualified high-dimension samples, and adaptively discards bad results. Besides, we propose KS-CIR test to help the model to determine which classes of data needed to be enhanced most. This new proposed test can measure the data in respect of both samples' quality and quantity. Lastly, Random Forest is taken as a classifier to finish the classification task. The performance of SynDroid is evaluated on CCCS-CIC-AndMal2020 on the accuracy, precision, recall and F1-score. Both longitudinal and horizontal comparison experiments have been done with traditional oversampling methods, cost-sensitive learning, and other complicated methods. The result shows that the proposed method gets 12% more accuracy than the method on the same dataset and alleviates imbalanced data problems.

Hybrid machine learning model for malware analysis in android apps

Android smartphones have been widely adopted across the globe. They have the capability to access private and confidential information resulting in these devices being targeted by malware devisers. The dramatic escalation of assaults build an awareness to create a robust system that detects the occurrence of malicious actions in Android applications. The malware exposure study consists of static and dynamic analysis. This research work proposed a hybrid machine learning model based on static and dynamic analysis which offers efficient classification and detection of Android malware. The proposed novel malware classification technique can process any android application, then extracts its features, and predicts whether the applications under process is malware or benign. The proposed malware detection model can characterizes diverse malware types from Android platform with high positive rate. The proposed approach detects malicious applications in reduced execution time while also improving the security of Android as compared to existing approaches. State-of-the-art machine learning algorithms such as Support Vector Machine, k-Nearest Neighbor, Naïve Bayes, and different ensembles are employed on benign and malign applications to assess the execution of all classifiers on permissions, API calls and intents to identify malware. The proposed technique is evaluated on Drebin, MalGenome and Kaggle dataset, and outcomes indicate that this robust system improved runtime detection of malware with high speed and accuracy. Best accuracy of 100% is achieved on benchmark dataset when compared with state of the art techniques. Furthermore, the proposed approach outperforms state of the art techniques in terms of computational time, true positive rate, false positive rate, accuracy, precision, recall, and f-measure.

MUDROID: Android malware detection and classification based on permission and behavior for autonomous vehicles

AbstractWith the growing popularity of autonomous vehicles, ensuring their safety has become a significant concern. Vehicle manufacturers have incorporated the Android operating system to enhance user convenience. However, the Android operating system's diversity and vulnerability may significantly impact autonomous vehicles because these natures lead to a critical threat in autonomous vehicle security: Android malware. The complex nature of multi‐data sources fusion in autonomous driving systems has resulted in low detection efficiency and accuracy for Android malware. Given the security requirements for autonomous‐driving systems, this article presents an Android malware classification method centered around the multifeature fusion and deep learning architecture designed to detect and classify Android malware within autonomous‐driving systems. The proposed MUDROID framework relies on the Android permission mechanism and behavioral feature to formulate a malware classification model. Comprising four essential components—feature extraction, representation, multifeature fusion, and classifier training, MUDROID leverages the advantages of CNN and GCN combination model and is adept at extracting and interpreting multidimensional features, consequently constructing a multifeature fusion classifier to amplify the efficiency and accuracy of Android malware detection and classification. The experiment results support MUDROID's superior classification performance, with an impressive Android malware detection accuracy rate of 98.69% and family classification (95.42%). The proposed method can detect and classify Android malware effectively, thus elevating the security and robustness of the self‐driving system. Additionally, the approach in this article also addresses feature representation issues in detecting malware variants, facilitating the recognition of Android malware variants across diverse platforms.

CRGB_Mem: At the intersection of memory forensics and machine learning

Mobile malware’s alarming sophistication and pervasiveness have continued to draw the attention of many cybersecurity researchers. Particularly on the Android platform, malware trojans designed to steal user PIIs, crypto miners, ransomware, and on-device fraud continue to infiltrate the primary Google store market and other secondary markets. While much effort has been put in place by the research community and industry to curb this menace since 2012, malware authors have consistently found ways to circumvent the existing detection and prevention mechanisms. Largely this remains so because of the restrictiveness of the feature set used in building the current classification models. Thus, the overarching objective of this paper is to bridge the gap between static and dynamic analysis by exploring the use of in-memory artifacts generated from the concrete execution of Android apps for effective malware classification. Our proposed approach, called RGB_Mem trains RGB images generated from in-memory allocation patterns in a Convolutional Neural Network. The result of our classification algorithm achieved an accuracy of 95.98% for samples with known objects and 84.48% for samples with unknown features. These results indicate that artifacts recovered from post-mortem memory forensics can provide a new dimension for training Android malware classification. The post-execution features, which are not impeded by any obfuscation and hooking constraints, provide a more accurate characterization of an app and are, therefore more suitable for classification.

GCDroid: Android Malware Detection Based on Graph Compression With Reachability Relationship Extraction for IoT Devices

With the widespread popularity of Internet of Things (IoT) devices based on the Android system, the amount of Android malware targeting IoT devices continues to increase, causing great economic losses. Accordingly, efficient and accurate Android malware detection methods are particularly important. Recently, many Android malware detection and classification methods have been proposed, but most of them ignore the deep relationships among software. In this paper, we propose a graph compression algorithm with reachability relationship extraction (GCRR) and design an Android malware detection and classification method called GCDroid based on this algorithm. A theoretical analysis shows that GCRR can reasonably extract the reachability relationships among APKs and compress a large heterogeneous APK-API relationship graph into a homogeneous APKs graph. Experiments show that GCDroid based on GCRR greatly reduces the required time consumption while improving detection accuracy. Compared with the existing excellent static Android malware detection methods, GCDroid improves upon their detection accuracies by 1.53%-39.13% on different datasets and outperforms the benchmark methods in terms of Android malware classification. Furthermore, compared with those of the baseline methods that are similar to GCDroid, GCDroid’s time consumption for model training and other aspects is only one-tenth as high or even less.

DroidDetectMW: A Hybrid Intelligent Model for Android Malware Detection

Malicious apps specifically aimed at the Android platform have increased in tandem with the proliferation of mobile devices. Malware is now so carefully written that it is difficult to detect. Due to the exponential growth in malware, manual methods of malware are increasingly ineffective. Although prior writers have proposed numerous high-quality approaches, static and dynamic assessments inherently necessitate intricate procedures. The obfuscation methods used by modern malware are incredibly complex and clever. As a result, it cannot be detected using only static malware analysis. As a result, this work presents a hybrid analysis approach, partially tailored for multiple-feature data, for identifying Android malware and classifying malware families to improve Android malware detection and classification. This paper offers a hybrid method that combines static and dynamic malware analysis to give a full view of the threat. Three distinct phases make up the framework proposed in this research. Normalization and feature extraction procedures are used in the first phase of pre-processing. Both static and dynamic features undergo feature selection in the second phase. Two feature selection strategies are proposed to choose the best subset of features to use for both static and dynamic features. The third phase involves applying a newly proposed detection model to classify android apps; this model uses a neural network optimized with an improved version of HHO. Application of binary and multi-class classification is used, with binary classification for benign and malware apps and multi-class classification for detecting malware categories and families. By utilizing the features gleaned from static and dynamic malware analysis, several machine-learning methods are used for malware classification. According to the results of the experiments, the hybrid approach improves the accuracy of detection and classification of Android malware compared to the scenario when considering static and dynamic information separately.

An optimal deep learning-based framework for the detection and classification of android malware

The use of smartphones is increasing rapidly and the malicious intrusions associated with it have become a challenging task that needs to be resolved. A secure and effective technique is needed to prevent breaches and detect malicious applications. Through deep learning methods and neural networks, the earliest detection and classification of malware can be performed. Detection of Android malware is the process to identify malicious attackers and through the classification method of malware, the type is categorized as adware, ransomware, SMS malware, and scareware. Since there were several techniques employed so far for malware detection and classification, there were some limitations like a reduced rate of accuracy and so on. To overcome these limitations, a deep learning-based automated process is employed to identify the malware. In this paper, initially, the datasets are collected, and through the preprocessing method, the duplicate and noisy data are removed to improve accuracy. Then the separated malware and benign dataset from the preprocessing phase is dealt with in feature selection. The reliable features are extracted in this process by Meta-Heuristic Artificial Jellyfish Search Optimizer (MH-AJSO). Further by the process of classification, the type of malware is categorized. The classification method is performed by the proposed Dense Dilated ResNet101 (DDResNet101) classifier. According to the type of malware the breach is prevented and secured on the android device. Although several methods of malware detection are found in the android platform the accuracy is effectively derived in our proposed system. Various performance analysis is performed to compare the robustness of detection. The results show that better accuracy of 98% is achieved in the proposed model with effectiveness for identifying the malware and thereby breaches and intrusion can be prevented.

Android-IoT Malware Classification and Detection Approach Using Deep URL Features Analysis

Currently, malware attacks pose a high risk to compromise the security of Android-IoT apps. These threats have the potential to steal critical information, causing economic, social, and financial harm. Because of their constant availability on the network, Android apps are easily attacked by URL-based traffic. In this paper, an Android malware classification and detection approach using deep and broad URL feature mining is proposed. This study entails the development of a novel traffic data preprocessing and transformation method that can detect malicious apps using network traffic analysis. The encrypted URL-based traffic is mined to decrypt the transmitted data. To extract the sequenced features, the N-gram analysis method is used, and afterward, the singular value decomposition (SVD) method is utilized to reduce the features while preserving the actual semantics. The latent features are extracted using the latent semantic analysis tool. Finally, CNN-LSTM, a multi-view deep learning approach, is designed for effective malware classification and detection.

Intelligent Hyperparameter-Tuned Deep Learning-Based Android Malware Detection and Classification Model

Recently, Android applications have been playing a vital part in the everyday life as several services are offered via mobile applications. Due of its market dominance, Android is more at danger from malicious software, and this threat is growing. The exponential growth of malicious Android apps has made it essential to develop cutting-edge methods for identifying them. Despite the prevalence of a number of security-based approaches in the research, feature selection (FS) methods for Android malware detection methods still have to be developed. In this research, researchers provide a method for distinguishing malicious Android apps from legitimate ones by using a intelligent hyperparameter tuned deep learning based malware detection (IHPT-DLMD). Extraction of features and preliminary data processing are the main functions of the IHPT-DLMD method. The proposed IHPT-DLMD technique initially aims to determine the considerable permissions and API calls using the binary coyote optimization algorithm (BCOA)-based FS technique, which aids to remove the unnecessary features. Besides, bidirectional long short-term memory (Bi-LSTM) model is employed for the detection and classification of Android malware. Finally, the glowworm swarm optimization (GSO) algorithm is applied to optimize the hyperparameters of the BiLSTM model to produce effectual outcomes for Android application classification. This IHPT-DLMD method is checked for quality using a benchmark dataset and evaluated in several ways. The test data demonstrated overall higher performance of the IHPT-DLMD methodology in comparison to the most contemporary methods that are currently in use.

Retracted: Visualisation‐based binary classification of android malware using vgg16

AbstractRetraction: [Aryan Marwaha, Rami Qays Malik, Shehab Mohamed Beram, Ali Rizwan, Hari Kishore Kakarla, Deepak Thakur, Tanya Gera, Mohammad Shabaz, Visualisation‐based binary classification of android malware using vgg16, IET Software 2023 (https://doi.org/10.1049/sfw2.12094)].The above article from IET Software, published online on 23 January 2023 in Wiley Online Library (wileyonlinelibrary.com), has been retracted by agreement between the Editor‐in‐Chief, Hana Chockler, the Institution of Engineering and Technology (the IET) and John Wiley and Sons Ltd. This article was published as part of a Guest Edited special issue. Following an investigation, the IET and the journal have determined that the article was not reviewed in line with the journal’s peer review standards and there is evidence that the peer review process of the special issue underwent systematic manipulation. Accordingly, we cannot vouch for the integrity or reliability of the content. As such we have taken the decision to retract the article. The authors have been informed of the decision to retract.

Android malware classification using optimum feature selection and ensemble machine learning

The majority of smartphones on the market run on the Android operating system. Security has been a core concern with this platform since it allows users to install apps from unknown sources. With thousands of apps being produced and launched daily, malware detection using Machine Learning (ML) has attracted significant attention compared to traditional detection techniques. Despite academic and commercial efforts, developing an efficient and reliable method for classifying malware remains challenging. As a result, several datasets for malware analysis have been generated and made available during the past ten years. These datasets may contain static features, such as API calls, intents, and permissions, or dynamic features, like logcat errors, shared memory, and system calls. Dynamic analysis is more resilient when it comes to code obfuscation. Though binary classification and multi-classification have been carried out in recent studies, the latter provides valuable insight into the nature of malware. Because each malware variant operates differently, identifying its category might help prevent it. Using the well-known ensemble ML approach called weighted voting, this study performed dynamic feature analysis for multi-classification. Random Forest, K-nearest Neighbors, Multi-Level Perceptrons, Decision Trees, Support Vector Machines, and Logistic Regression are all studied in this ensemble model. We used a recent dataset named CCCS-CIC-AndMal-2020, which contains an extensive collection of Android applications and malware samples. A well-researched data preparation phase followed by weighted voting based on R2 scores of the ML classifiers presents an accuracy of 95.0% even after excluding 60.2% features, outperforming all recent studies.

Applying Wide &amp; Deep Learning Model for Android Malware Classification

Android malware has exploded in popularity in recent years, due to the platform’s dominance of the mobile market. With the advancement of deep learning technology, numerous deep learning-based works have been proposed for the classification of Android malware. Deep learning technology is designed to handle a large amount of raw and continuous data, such as image content data. However, it is incompatible with discrete features, i.e., features gathered from multiple sources. Furthermore, if the feature set is already well-extracted and sparsely distributed, this technology is less effective than traditional machine learning. On the other hand, a wide learning model can expand the feature set to enhance the classification accuracy. To maximize the benefits of both methods, this study proposes combining the components of deep learning based on multi-branch CNNs (Convolutional Network Neural) with wide learning method. The feature set is evaluated and dynamically partitioned according to its meaning and generalizability to subsets when used as input to the model’s wide or deep component. The proposed model, partition, and feature set quality are all evaluated using the K-fold cross validation method on a composite dataset with three types of features: API, permission, and raw image. The accuracy with Wide and Deep CNN (WDCNN) model is 98.64%, improved by 1.38% compared to RNN (Recurrent Neural Network) model.

Android Malware Classification Using LSTM Model

From last two decades, smartphone use is essentially widespread around the world, and Android is the most popular open-source operating system, with the largest market share and active user population of any open-source operating system. This has resulted in malicious actors turning their attention toward the Android operating system to exploit user reliance and vulnerabilities that exist inside the system. Hackers can take advantage of consumers' sensitive data to engage in advertising, extortion, and theft. Most of the existing anti-malware software’s cannot be able to detect all the malwares because of the intelligent malwares. In this paper we use the deep learning based Long short-term memory (LSTM) network for android malware classification. The model is effective in classification of intelligent malwares. The proposed model is implemented using google colab. The model is archiving more than the 98% accuracy in classification of android malwares.