Identifying Android Malware Research Articles

Android malware detection through centrality analysis of applications network

Android OS is a widely-used platform for mobile devices. However, with the increasing number of Android applications and ongoing advancements in application development, there is a need for flexible and scalable malware detection methods that can address the challenges posed by big data. Recently, researchers have developed methods based on complex network analysis that aim to reduce the complexity and enhance the scalability of malware detection. These methods have shown high accuracy in identifying Android malware. Our proposed method involves generating two weighted graphs that depict the relationships between applications in benign and malware states, respectively, by extracting the functions of each application. Network-analysis-based features are then extracted from the graphs and combined with static application features to distinguish malware applications from benign ones. Our approach demonstrated an increase in accuracy, achieving 99% and 98% accuracy on the DataMD and IntDroid datasets, respectively. We further demonstrate our proposed method’s superiority against state-of-the-art approaches.

Deep Learning-Based Detection of Android Malware using Graph Convolutional Networks (GCN)

The study is centered around identifying Android malware using deep learning methods through Graph Neural Networks (GNNs) and Graph Convolutional Networks (GCNs). With Android being widely used worldwide ensuring the security of released applications poses a challenge. Conventional malware detection techniques, like dynamic analysis have limitations in recognizing new malware types leading to a shift towards machine learning and deep learning solutions. The research introduces a malware detection system that employs GNNs particularly focusing on GCNs to analyze the relationships within an applications code by transforming APK files into graph formats. The system follows stages including data gathering, feature extraction, graph construction, model training and implementation. By concentrating on function call graphs the system proves effective in identifying software surpassing traditional machine learning methods in terms of accuracy, precision, recall and F1 score. The GCN based model shows enhancements over approaches with an accuracy rate of 95% compared to 89%, for traditional machine learning models. This progress highlights the potential of learning techniques in bolstering Android security. The system excels not in identifying software but also proves versatile, for different uses like screening apps, in stores and functioning as a standalone antivirus program.

MADRAS-NET: A deep learning approach for detecting and classifying android malware using Linknet

Malware is an intentionally created malicious software that still poses a serious threat in cyberspace. Android malware has become one of the most significant online threats in recent years due to its increase in prevalence. Even though a lot of work has gone into identifying and categorizing Android malware, problems including data theft, difficulties identifying Android malware, and time-consuming detection remain unresolved. To overcome this issue, this paper proposed a Deep Learning (DL) Based Malware Attack DetectoR in Android Smartphones using LinkNET (MADRAS-NET) which effectively detects and mitigates the types of malwares in Android devices. The Max Abs Scaler receives a set of data as input first for pre-processing. Following pre-processing, the output is sent to LinkNET for classification. LinkNET uses the pre-processed data to identify malware, and then divides the output into three groups: real users, Penetho malware, and FakeAV malware. Lastly, the AndMal2020 dataset, which detects and classifies malware as well as malware families, is used to evaluate the suggested MADRAS-NET approach. The suggested LinkNET achieves a maximum accuracy of 99.81%, while other models, such as the Deep Belief Network (DBN) at 96.75%, the Generative Adversarial Network (GAN) at 94.42%, and the Long Short Term Memory Network (LSTM) at 93.11%, achieve similar results. The comparison of the MADRAS-NET model with the LSTM, GAN, and DBN frameworks indicates its better performance.

Detection of Android Malware using Feature Selection with a Hybrid Genetic Algorithm and Simulated Annealing (SVM and DBN)

Because of the widespread use of the Android operating system and the simplicity with which applications can be created on the Android platform, anyone can easily create malware using pre-made tools. Due to the spread of malware among many helpful applications, Android users are experiencing issues. In this study, we showed how to use permissions gleaned from static analysis to identify Android malware. Utilising support vector machines and deep belief networks, we choose the pertinent features from the set of permissions based on this methodology. The suggested technique increases the effectiveness of Android malware detection.

Computer Malicious Code Signal Detection based on Big Data Technology

The article addresses the challenges modelled by the inadequacy of traditional detection methods in effectively handling the substantial volume of software behavior samples, particularly in big data. A novel approach is proposed for leveraging big data technology to detect malicious computer code signals. Additionally, it seeks to attack the issues associated with machine learning-based mobile malware detection, namely the presence of a large number of features, low accuracy in detection, and imbalanced data distribution. To resolve these challenges, this paper presents a multifaceted methodology. First, it introduces a feature selection technique based on mean and variance analysis to eliminate irrelevant features hindering classification accuracy. Next, a comprehensive classification method is implemented, utilizing various feature extraction techniques such as principal component analysis (PCA), Kaehunen-Loeve transform (KLT), and independent component analysis (ICA). These techniques collectively contribute to enhancing the Precision of the detection process. Recognizing the issue of unbalanced data distribution among software samples, the study proposes a multi-level classification integration model grounded in decision trees. In response, the research focuses on enhancing accuracy and mitigating the impact of data imbalance through a combination of feature selection, extraction techniques, and a multi-level classification model. The empirical results highlight the effectiveness of the proposed methodologies, showcasing notable accuracy improvements ranging from 3.36% to 6.41% across different detection methods on the Android platform. The introduced malware detection technology, grounded in source code analysis, demonstrates a promising capacity to identify Android malware effectively.

MalDetect: A classifier fusion approach for detection of android malware

Android has been a significant target of malware applications due to the exponential growth of mobile devices. This may result in severe threats to Android users such as financial loss, information leakage etc. The security of smartphones has encouraged the researchers in applying machine learning techniques to enhance the Android malware detection rate as the traditional approaches are not effective in distinguishing unknown malware. In recent years, many malicious apps have been detected on Android devices using machine learning based approaches. The problem with these detection systems is that they give a high false positive and false negative rate. Therefore, it is imperative to develop methods for better identifying and classifying malware. The main contribution of this paper is to improve the classification accuracy by fusing the base classifiers. This paper proposes a fusion approach named as MalDetect that enables an effective combination of machine learning techniques to improve the identification rate of malware. The proposed approach is based on the base classifiers and a set of ranking algorithms defined on their predictive error rate. The purpose of this method is to improve the detection rate of Android malware. Two datasets i.e. Drebin and AndroMD are used to illustrate the effectiveness of the proposed approach. Experimental results show that the proposed approach performs better than the individual base classifiers and traditional ensemble learning techniques for identifying Android malware. Further, the proposed approach is compared with the renowned Stacking ensemble technique that uses a meta-classifier. From the experimental outcomes, it is found that the weighted F-measure obtained from the Stacking for Drebin and AndroMD datasets is 0.9811 and 0.9775 respectively whereas the weighted F-measure acquired from the proposed approach is 0.9857 and 0.9790 respectively.

DroidDetectMW: A Hybrid Intelligent Model for Android Malware Detection

Malicious apps specifically aimed at the Android platform have increased in tandem with the proliferation of mobile devices. Malware is now so carefully written that it is difficult to detect. Due to the exponential growth in malware, manual methods of malware are increasingly ineffective. Although prior writers have proposed numerous high-quality approaches, static and dynamic assessments inherently necessitate intricate procedures. The obfuscation methods used by modern malware are incredibly complex and clever. As a result, it cannot be detected using only static malware analysis. As a result, this work presents a hybrid analysis approach, partially tailored for multiple-feature data, for identifying Android malware and classifying malware families to improve Android malware detection and classification. This paper offers a hybrid method that combines static and dynamic malware analysis to give a full view of the threat. Three distinct phases make up the framework proposed in this research. Normalization and feature extraction procedures are used in the first phase of pre-processing. Both static and dynamic features undergo feature selection in the second phase. Two feature selection strategies are proposed to choose the best subset of features to use for both static and dynamic features. The third phase involves applying a newly proposed detection model to classify android apps; this model uses a neural network optimized with an improved version of HHO. Application of binary and multi-class classification is used, with binary classification for benign and malware apps and multi-class classification for detecting malware categories and families. By utilizing the features gleaned from static and dynamic malware analysis, several machine-learning methods are used for malware classification. According to the results of the experiments, the hybrid approach improves the accuracy of detection and classification of Android malware compared to the scenario when considering static and dynamic information separately.

Evaluation and classification of obfuscated Android malware through deep learning using ensemble voting mechanism

With the rise in popularity and usage of Android operating systems, malicious applications are targeted by applying innovative ways and techniques. Today, malware becomes intelligent that uses several ways of obfuscation techniques to hide its functionality and evade anti-malware engines. For mainstream smartphone users, Android malware poses a severe security danger. An obfuscation approach, however, can produce malware versions that can evade current detection strategies and dramatically lower the detection accuracy. Attempting to identify Android malware obfuscation variations, this paper proposes an approach to address the challenges and issues related to the classification and detection of malicious obfuscated variants. The employed detection and classification scheme uses both static and dynamic analysis using an ensemble voting mechanism. Moreover, this study demonstrates that a small subset of features performs consistently well when they are derived from the basic malware (non-obfuscated), however, after applying a novel feature-based obfuscation approach, the study shows a drastic change indicating the relative importance of these features in obfuscating benign and malware applications. For this purpose, we present a fast, scalable, and accurate mechanism for obfuscated Android malware detection based on the Deep learning algorithm using real and emulator-based platforms. The experiments show that the proposed model detects malware effectively and accurately along with the identification of features that are usually obfuscated by malware attackers.

A Comparative Analysis of Machine Learning Algorithms for Android Malware Detection

The immense growth of Android mobile malware threats has pushed cybersecurity researchers to develop efficient systems that can detect new Android malware. In spite of the academic and industrial attempts to establish a robust, reliable, and efficient solution for Android, malware classification is considered an open problem with many challenges. This paper sheds light on the performance of several machine learning algorithms and analyzes their efficiency in detecting android malware. Moreover, it applies Synthetic Minority Oversampling Technique (SMOTE), normalizes the numerical features and PCA to reach the maximum accuracy. Furthermore, the paper develops a Light Gradient Boosting Model to identify Android malware and classify their families into five classes: Adware, Banking Malware, SMS Malware, Mobile Riskware, and Benign. The paper uses a large and recent dataset, which consists of 11,598 APK collected from several sources and provided by the Canadian Institute of Cybersecurity.

Android malware detection method based on highly distinguishable static features and DenseNet.

The rapid growth of malware has become a serious problem that threatens the security of the mobile ecosystem and needs to be studied and resolved. Android is the main target of attackers due to its open source and popularity. To solve this serious problem, an accurate and efficient malware detection method is needed. Most existing methods use a single type of feature, which can be easily bypassed, resulting in low detection accuracy. In addition, although multiple types of features are used in some methods to solve the drawbacks of detection methods using a single type of feature, there are still some problems. Firstly, due to multiple types of features, the number of features in the initial feature set is extremely large, and some methods directly use them for training, resulting in excessive overhead. Furthermore, some methods utilize feature selection to reduce the dimensionality of features, but they do not select highly distinguishable features, resulting in poor detection performance. In this article, an effective and accurate method for identifying Android malware, which is based on an analysis of the use of seven types of static features in Android is proposed to cope with the rapid increase in the amount of Android malware and overcome the drawbacks of detection methods using a single type of feature. Instead of utilizing all extracted features, we design three levels of feature selection methods to obtain highly distinguishable features that can be effective in identifying malware. Then a fully densely connected convolutional network based on DenseNet is adopted to leverage features more efficiently and effectively for malware detection. Compared with the number of features in the original feature set, the number of features in the feature set obtained by the three levels of feature selection methods is reduced by about 97%, but the accuracy is only reduced by 0.45%, and the accuracy is more than 99% in a variety of machine learning methods. Moreover, we compare our detection method with different machine learning models, and the experimental results show that our method outperforms general machine learning models. We also compare the performance of our detection method with two state-of-the-art neural networks. The experimental results show that our detection model can greatly reduce the training cost and still achieve good detection performance, reaching an accuracy of 99.72%. In addition, we compare our detection method with other similar detection methods that also use multiple types of features. The results show that our detection method is superior to the comparison methods.

An Analysis of Machine Learning-Based Android Malware Detection Approaches

Despite the fact that Android apps are rapidly expanding throughout the mobile ecosystem, Android malware continues to emerge. Malware operations are on the rise, particularly on Android phones, it make up 72.2 percent of all smartphone sales. Credential theft, eavesdropping, and malicious advertising are just some of the ways used by hackers to attack cell phones. Many researchers have looked into Android malware detection from various perspectives and presented hypothesis and methodologies. Machine learning (ML)-based techniques have demonstrated to be effective in identifying these attacks because they can build a classifier from a set of training cases, eliminating the need for explicit signature definition in malware detection.This paper provided a detailed examination of machine-learning-based Android malware detection approaches. According to present research, machine learning and genetic algorithms are in identifying Android malware, this is a powerful and promising solution. In this quick study of Android apps, we go through the Android system architecture, security mechanisms, and malware categorization.

Empirical Analysis of Forest Penalizing Attribute and Its Enhanced Variations for Android Malware Detection

As a result of the rapid advancement of mobile and internet technology, a plethora of new mobile security risks has recently emerged. Many techniques have been developed to address the risks associated with Android malware. The most extensively used method for identifying Android malware is signature-based detection. The drawback of this method, however, is that it is unable to detect unknown malware. As a consequence of this problem, machine learning (ML) methods for detecting and classifying malware applications were developed. The goal of conventional ML approaches is to improve classification accuracy. However, owing to imbalanced real-world datasets, the traditional classification algorithms perform poorly in detecting malicious apps. As a result, in this study, we developed a meta-learning approach based on the forest penalizing attribute (FPA) classification algorithm for detecting malware applications. In other words, with this research, we investigated how to improve Android malware detection by applying empirical analysis of FPA and its enhanced variants (Cas_FPA and RoF_FPA). The proposed FPA and its enhanced variants were tested using the Malgenome and Drebin Android malware datasets, which contain features gathered from both static and dynamic Android malware analysis. Furthermore, the findings obtained using the proposed technique were compared with baseline classifiers and existing malware detection methods to validate their effectiveness in detecting malware application families. Based on the findings, FPA outperforms the baseline classifiers and existing ML-based Android malware detection models in dealing with the unbalanced family categorization of Android malware apps, with an accuracy of 98.94% and an area under curve (AUC) value of 0.999. Hence, further development and deployment of FPA-based meta-learners for Android malware detection and other cybersecurity threats is recommended.

MFDroid: A Stacking Ensemble Learning Framework for Android Malware Detection.

As Android is a popular a mobile operating system, Android malware is on the rise, which poses a great threat to user privacy and security. Considering the poor detection effects of the single feature selection algorithm and the low detection efficiency of traditional machine learning methods, we propose an Android malware detection framework based on stacking ensemble learning—MFDroid—to identify Android malware. In this paper, we used seven feature selection algorithms to select permissions, API calls, and opcodes, and then merged the results of each feature selection algorithm to obtain a new feature set. Subsequently, we used this to train the base learner, and set the logical regression as a meta-classifier, to learn the implicit information from the output of base learners and obtain the classification results. After the evaluation, the F1-score of MFDroid reached 96.0%. Finally, we analyzed each type of feature to identify the differences between malicious and benign applications. At the end of this paper, we present some general conclusions. In recent years, malicious applications and benign applications have been similar in terms of permission requests. In other words, the model of training, only with permission, can no longer effectively or efficiently distinguish malicious applications from benign applications.

Using Machine Learning to Identify Android Malware Relying on API calling sequences and Permissions

Using Machine Learning to Identify Android Malware Relying on API calling sequences and Permissions

Using Machine Learning to Identify Android Malware Relying on API calling sequences and Permissions

Using Machine Learning to Identify Android Malware Relying on API calling sequences and Permissions

Blockchain Based Detection of Android Malware using Ranked Permissions

Android mobile devices are a prime target for a huge number of cyber-criminals as they aim to create malware for disrupting and damaging the servers, clients, or networks. Android malware are in the form of malicious apps, that get downloaded on mobile devices via the Play Store or third-party app markets. Such malicious apps pose serious threats like system damage, information leakage, financial loss to user, etc. Thus, predicting which apps contain malicious behavior will help in preventing malware attacks on mobile devices. Identifying Android malware has become a major challenge because of the ever-increasing number of permissions that applications ask for, to enhance the experience of the users. And most of the times, permissions and other features defined in normal and malicious apps are generally the same. In this paper, we aim to detect Android malware using machine learning, deep learning, and natural language processing techniques. To delve into the problem, we use the Android manifest files which provide us with features like permissions which become the basis for detecting Android malware. We have used the concept of information value for ranking permissions. Further, we have proposed a consensus-based blockchain framework for making more concrete predictions as blockchain have high reliability and low cost. The experimental results demonstrate that the proposed model gives the detection accuracy of 95.44% with the Random Forest classifier. This accuracy is achieved with top 45 permissions ranked according to Information Value.

Evaluation of Advanced Ensemble Learning Techniques for Android Malware Detection

Android is the most well-known portable working framework having billions of dynamic clients worldwide that pulled in promoters, programmers, and cybercriminals to create malware for different purposes. As of late, wide-running inquiries have been led on malware examination and identification for Android gadgets while Android has likewise actualized different security controls to manage the malware issues, including a User ID (UID) for every application, framework authorizations. In this paper, we advance and assess various kinds of machine learning (ML) by applying ensemble-based learning systems for identifying Android malware related to a substring-based feature selection (SBFS) strategy for the classifiers. In the investigation, we have broadened our previous work where it has been seen that the ensemble-based learning techniques acquire preferred outcome over the recently revealed outcome by directing the DREBIN dataset, and in this manner they give a solid premise to building compelling instruments for Android malware detection.

Intelligent mobile malware detection using permission requests and API calls

Malware is a serious threat that has been used to target mobile devices since its inception. Two types of mobile malware attacks are standalone: fraudulent mobile apps and injected malicious apps. Defending against the cyber threats of mobile malware requires a strong understanding of the permissions declared in applications and application programmeinterface (API) calls. In this paper, we propose an effective classification model that combines permission requests and API calls. As Android apps use a large number of APIs, we propose three different grouping strategies for choosing the most valuable API calls to maximize the likelihood of identifying Android malware apps: the ambiguous group, risky group, and disruptive group. The results demonstrate that compared with benign apps, malicious applications invoke a different set of API calls and that mobile malware often requests dangerous permissions to access sensitive data more often than benign apps. Empirical results obtained with a real malware dataset containing 27,891 Android apps suggest that our proposed method is effective at detecting mobile malware apps and achieves an F-measure of 94.3%. Our model can significantly assist in the process of malware forensic investigation and mobile application analysis.

SEDMDroid: An Enhanced Stacking Ensemble Framework for Android Malware Detection

The popularity of the Android platform in smartphones and other Internet-of-Things devices has resulted in the explosive of malware attacks against it. Malware presents a serious threat to the security of devices and the services they provided, e.g. stealing the privacy sensitive data stored in mobile devices. This work raises a stacking ensemble framework SEDMDroid to identify Android malware. Specifically, to ensure individual's diversity, it adopts random feature subspaces and bootstrapping samples techniques to generate subset, and runs Principal Component Analysis (PCA) on each subset. The accuracy is probed by keeping all the principal components and using the whole dataset to train each base learner Multi-Layer Perception (MLP). Then, Support Vector Machine (SVM) is employed as the fusion classifier to learn the implicit supplementary information from the output of the ensemble members and yield the final prediction result. We show experimental results on two separate datasets collected by static analysis way to prove the effectiveness of the SEDMDroid. The first one extracts permission, sensitive API, monitoring system event and so on that are widely used in Android malwares as the features, and SEDMDroid achieves 89.07% accuracy in term of these multi-level static features. The second one, a public big dataset, extracts the sensitive data flow information as the features, and the average accuracy is 94.92%. Promising experiment results reveal that the proposed method is an effective way to identify Android malware.

Convolutional Neural Network for Classification of Android Applications Represented as Grayscale Images

A rapid dissemination of Android operating system in smart phone market has resulted in an exponential growth of threats to mobile applications. Various studies have been carried out in academia and industry for the identification and classification of malicious applications using machine learning and deep learning algorithms. Convolution Neural Network is a deep learning technique which has gained popularity in speech and image recognition. The conventional solution for identifying Android malware needs learning based on pre-extracted features to preserve high performance for detecting Android malware. In order to reduce the efforts and domain expertise involved in hand-feature engineering, we have generated the grayscale images of AndroidManifest.xml and classes.dex files which are extracted from the Android package and applied Convolution Neural Network for classifying the images. The experiments are conducted on a recent dataset of 1747 malicious Android applications. The results indicate that classes.dex file gives better results as compared to the AndroidManifest.xml and also demonstrate that model performs better as the image become larger.