AndroMalPack: enhancing the ML-based malware classification by detection and removal of repacked apps for Android systems

Abstract

Due to the widespread usage of Android smartphones in the present era, Android malware has become a grave security concern. The research community relies on publicly available datasets to keep pace with evolving malware. However, a plethora of apps in those datasets are mere clones of previously identified malware. The reason is that instead of creating novel versions, malware authors generally repack existing malicious applications to create malware clones with minimal effort and expense. This paper investigates three benchmark Android malware datasets to quantify repacked malware using package names-based similarity. We consider 5560 apps from the Drebin dataset, 24,533 apps from the AMD and 695,470 apps from the AndroZoo dataset for analysis. Our analysis reveals that 52.3% apps in Drebin, 29.8% apps in the AMD and 42.3% apps in the AndroZoo dataset are repacked malware. Furthermore, we present AndroMalPack, an Android malware detector trained on clones-free datasets and optimized using Nature-inspired algorithms. Although trained on a reduced version of datasets, AndroMalPack classifies novel and repacked malware with a remarkable detection accuracy of up to 98.2% and meagre false-positive rates. Finally, we publish a dataset of cloned apps in Drebin, AMD, and AndrooZoo to foster research in the repacked malware analysis domain.

Analysing mobile forensic datasets: A systematic review on availability, efficacy, and limitations

“…At present, the dataset comprises more than 21 million unique APKs, each of which has either undergone or will undergo scrutiny by several antivirus engines to ascertain which ones are classified as malicious software. To detect potential malware, the applications included in the AndroZoo dataset are analysed and categorized by employing more than 60 antivirus tools [19]. However, the AndroZoo dataset lacks explicit static features, requiring researchers to extract the features themselves.…”

“…Sequences of Dalvik bytecode opcodes, Java VM-type signatures, the values of constant-string instructions, and signatures are a few examples of the parts that make up the characteristics that are contained. Rafiq et al [19], investigated AMD dataset and found that 29.8% applications in the AMD are repacked malware.…”

“…For example, many applications in the databases are simply copies of malware that has already been found. Malware developers typically repackage already-existing malware applications to produce malware clones with the least amount of effort and cost instead of developing fresh versions [19]. An analysis of diverse datasets by Rafiq et al [19] unveiled that repackaged malware constitutes 29.8% in AMD, 52.3% of applications in Drebin, and 42.3% in the AndroZoo dataset.…”

“…Malware developers typically repackage already-existing malware applications to produce malware clones with the least amount of effort and cost instead of developing fresh versions [19]. An analysis of diverse datasets by Rafiq et al [19] unveiled that repackaged malware constitutes 29.8% in AMD, 52.3% of applications in Drebin, and 42.3% in the AndroZoo dataset. Duplicate entries need to be removed from the dataset because they increase overhead in terms of time and computational expenses and can even lead to incorrect results by machine learning models.…”

A Comparative Analysis of Malware Detection Methods Traditional vs. Machine Learning

“…Elect.Crime Investigation 7(4):IJECI MS.ID-02 (2023) A Comparative Analysis of Malware Detection Methods Traditional vs. Machine Learning malicious software. Malware threats have increased due to the global adoption of cloud computing and Internet of Things (IoT) [1]. Such malicious actions have the potential to compromise the integrity, confidentiality, or availability of mobile systems [2].…”