Deep Learning based Malware Detection for Android Systems: A Comparative Analysis

Abstract

Nowadays, cyber attackers focus on Android, which is the most popular open-source operating system, as main target by applying some malicious software (malware) to access users' private information, control the device, or harm end-users. To detect Android malware, security experts have offered some learning-based models. In this study, we developed an Android malware detection system that uses different machine\deep learning models by performing both dynamic analyses, in which suspected malware is executed in a safe environment for observing its behaviours, and static analysis, which examines a malware file without any execution on the Android device. The benefits and weaknesses of these models and analyses are described in detail in this comparative study, and directions for future studies are drawn. Experimental results showed that the proposed models gave better results than those in the literature, with 0.988 accuracy for LSTM on static analysis and 0.953 accuracy for CNN-LSTM on dynamic analysis.

Protecting Android Devices From Malware Attacks: A State-of-the-Art Report of Concepts, Modern Learning Models and Challenges

“…Due to the diversity of the extracted information, the features that need to be used to use the categorized data in learning-based attack detection usually need to be transformed into a vectorized representation. In studies in the literature, APKs are processed and analyzed first, and then processing is carried out on the information extracted from the applications [15], [20], [38].…”

“…Additionally, MD5 check sums or hashes can be used to compare malware against a database of known malicious software. This approach offers a quick and cost-effective means of identifying harmful features and code in an application before it runs [40], [20]. Below, we describe some of the methods used in the static analysis approach to detect malware, including code analysis, API calls, and permissions.…”

“…In this virtual environment, monitoring network activities, monitoring file changes, and determining system calls are performed. Therefore, the functionalities of the actions performed by the analyzed malware require it to be a behavior-based system [20], [45]. The methods used for malware detection in the dynamic analysis approach, including system calls and monitoring of user and kernel level system behavior, are explained below.…”

“…With this work, not only researchers but also practitioners can find most of the background knowledge about the topic, which includes current Android malware datasets, malware analysis techniques, and deep learning algorithms. Although, in the literature, there are some surveys [8], [15][16][17][18][19][20] which examine different learning methods, it is seen that the studies are based on traditional machine learning models (RF, DT, SVM etc.) with older datasets.…”