cHybriDroid: A Machine Learning-Based Hybrid Technique for Securing the Edge Computing

Maryam, Afifa; Ahmed, Usman; Aleem, Muhammad; Lin, Jerry Chun‐Wei; Islam, Muhammad Arshad; Iqbal, Muhammad Azhar

doi:10.1155/2020/8861639

Cited by 10 publications

(3 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Both features, but separated: in this approach, feature selection is performed on static and dynamic features independently, and the selected features are later merged. Several studies, including those by Hussain et al [48], Li et al [123], and Maryam et al [52] are just a few examples that utilized this feature selection mechanism in their research. 2.…”

Section: ) Feature Selection Mechanismmentioning

confidence: 99%

Hybrid Android Malware Detection: A Review of Heuristic-Based Approach

Yunmar,

Kusumawardani,

Widyawan

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Over the last decade, numerous research efforts have been dedicated to countering malicious mobile applications. Given its market share, Android OS has been the primary target for most of these apps. Researchers have devised numerous solutions to protect Android devices and their users, categorizing them into static and dynamic approaches. Each of these approaches has its own advantages and disadvantages. The hybrid approach aims to combine the benefits of both. This study closely examines the hybrid solutions proposed between 2012 and 2023, highlighting their strengths and limitations. The objective of this study is to provide a comprehensive review of existing research on Android malware detection using a hybrid approach. Our review identifies several issues related to hybrid detection approaches, including datasets, feature utilization and selection, working environments, detection order mechanisms, integrity of the detection step, detection algorithms, and the use of automated input generation. Key findings of this study include: (i) the majority of studies have not adequately addressed on-device detection and have overlooked the importance of system usability, (ii) many studies rely on outdated datasets that do not accurately represent the current threat landscape, (iii) there is a need for a methodology to detect zero-day attacks, and (iv) most research has not paid attention to the impact of automated input generation on malware behavior and code coverage. We also discuss some open issues and future directions on the aspect that will help to substantiate the hybrid approach study.INDEX TERMS Android malware, heuristic-based detection, hybrid approach.

show abstract

Section: ) Feature Selection Mechanismmentioning

confidence: 99%

Hybrid Android Malware Detection: A Review of Heuristic-Based Approach

Yunmar,

Kusumawardani,

Widyawan

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…GsDroid obtained up to 99% malware detection accuracy on various Android malware datasets. Maryam et al proposed cHybriDroid 48 , an Android malware classifier based on the conjunction of static and dynamic features of Android apps. They employed tree-based pipeline optimization technique (TPOT) 49 to formulate a malware detection model and achieved up to 96% malware detection accuracy on the Drebin dataset.…”

Section: Related Workmentioning

confidence: 99%

AndroMalPack: enhancing the ML-based malware classification by detection and removal of repacked apps for Android systems

Rafiq

Aslam

Aleem

et al. 2022

Sci Rep

Self Cite

View full text Add to dashboard Cite

Due to the widespread usage of Android smartphones in the present era, Android malware has become a grave security concern. The research community relies on publicly available datasets to keep pace with evolving malware. However, a plethora of apps in those datasets are mere clones of previously identified malware. The reason is that instead of creating novel versions, malware authors generally repack existing malicious applications to create malware clones with minimal effort and expense. This paper investigates three benchmark Android malware datasets to quantify repacked malware using package names-based similarity. We consider 5560 apps from the Drebin dataset, 24,533 apps from the AMD and 695,470 apps from the AndroZoo dataset for analysis. Our analysis reveals that 52.3% apps in Drebin, 29.8% apps in the AMD and 42.3% apps in the AndroZoo dataset are repacked malware. Furthermore, we present AndroMalPack, an Android malware detector trained on clones-free datasets and optimized using Nature-inspired algorithms. Although trained on a reduced version of datasets, AndroMalPack classifies novel and repacked malware with a remarkable detection accuracy of up to 98.2% and meagre false-positive rates. Finally, we publish a dataset of cloned apps in Drebin, AMD, and AndrooZoo to foster research in the repacked malware analysis domain.

show abstract

“…This makes it possible to watch and record the runtime operations of the application, as well as its interactions with the operating system, networks, and possible malicious activity. Certain studies [16][17][18][19][20] used a hybrid analysis approach in which they designed malware detection models using both static and dynamic data. However, the landscape of Android malware is constantly evolving, with attackers employing sophisticated techniques to evade detection.…”

Section: Introductionmentioning

confidence: 99%

DeepMetaDroid: Real-Time Android Malware Detection Using Deep Learning and Metadata Features

Rahima Manzil,

Naik S

2024

Cloud Computing and Data Science

View full text Add to dashboard Cite

The increasing prevalence of Android malware poses significant risks to mobile devices and user privacy. The traditional detection methods have limitations in keeping up with the evolving landscape of malware attacks, necessitating the development of more effective solutions. In this paper, we present DeepMetaDroid, a real-time detection approach for Android malware that leverages metadata features. By analyzing crucial metadata, including APK size, download size, permissions, certificates, and DEX files, the proposed method enables effective identification of malware and enhances mobile security. Using deep learning techniques, a lightweight Android real-time monitoring system is equipped with the trained model. These methods include long short-term memory (LSTM), gated recurrent units (GRU), convolutional neural networks (CNN), deep neural networks (DNN), and other ensemble models. Utilizing the rectified linear unit (ReLU) as the activation function, the DNN model is constructed with 32 neurons in the input layer. A one-dimensional convolutional layer with 32 neurons and a filter size of three is used as the input layer in the CNN model. The LSTM model is designed with an input layer consisting of 16 neurons. The GRU model with 32 neurons is employed in the input layer. Additionally, ensemble models that combined several architectures were developed. The proposed method offers a faster and more scalable solution for malware detection by consuming fewer resources like memory and CPU. This work ensures device security by providing real-time monitoring on Android devices to prevent users from installing malicious applications and, thus, enhance user privacy and security.

show abstract

cHybriDroid: A Machine Learning-Based Hybrid Technique for Securing the Edge Computing

Cited by 10 publications

References 26 publications

Hybrid Android Malware Detection: A Review of Heuristic-Based Approach

Hybrid Android Malware Detection: A Review of Heuristic-Based Approach

AndroMalPack: enhancing the ML-based malware classification by detection and removal of repacked apps for Android systems

DeepMetaDroid: Real-Time Android Malware Detection Using Deep Learning and Metadata Features

Contact Info

Product

Resources

About