Evaluation of machine learning classifiers for mobile malware detection

Abstract

Mobile devices have become a significant part of people's lives, leading to an increasing number of users involved with such technology. The rising number of users invites hackers to generate malicious applications. Besides, the security of sensitive data available on mobile devices is taken lightly. Relying on currently developed approaches is not sufficient, given that intelligent malware keeps modifying rapidly and as a result becomes more difficult to detect. In this paper, we propose an alternative solution to evaluating malware detection using the anomaly-based approach with machine learning classifiers. Among the various network traffic features, the four categories selected are basic information, content based, time based and connection based. The evaluation utilizes two datasets: public (i.e. MalGenome) and private (i.e. self-collected). Based on the evaluation results, both the Bayes network and random forest classifiers produced more accurate readings, with a 99.97 % true-positive rate (TPR) as opposed to the multi-layer perceptron with only 93.03 % on the MalGenome dataset. However, this experiment revealed that the k-nearest neighbor classifier efficiently detected the latest Android malware with an 84.57 % truepositive rate higher than other classifiers. Communicated by V. Loia.

Internet of Things Malware : A Survey

“…Narudin et al [84] evaluates logical-based, perceptron-based, static-based and instance-based classifiers evaluating in mobile applications. Arshad et al [85] surveys static based approaches (i.e.…”

AndroDialysis: Analysis of Android Intent Effectiveness in Malware Detection

“…More recently, new malware such as the BrainTest [3], have succeeded in infecting over half a million Android devices, targeting Google Play in particular. Many recent studies have resulted in a number of automated approaches to tackle the spread of malware [4] [5] [6] [7]. Static analysis techniques, which have traditionally been used for detecting malware targeting desktop computers, have recently gained popularity as effective measures for the protection of mobile applications [8].…”

Intelligent Hybrid Approach for Android Malware Detection based on Permissions and API Calls

“…They enable an application to create windows that can be shown on top of other applications and even execute tasks on them, these abilities made them an extremely attractive target for malware developers to perform tapjacking attacks. A significantly sophisticated new form of Android ransomware/Android.Lockdroid.E is detected [4], this variant of ransomware malware employs the accessibility tapjacking method to pose a real threat for more than 67% of Android devices. Table 2 above shows the testing and training RMSE for both ANFIS and PSO-ANFIS using the features selected by the proposed dual-stage method based on the five-fold crossvalidation.…”

“…Detecting the huge number of Android malware and isolating them from application markets is potential and great challenging issue. Very recently in 2016, a significantly sophisticated new form of Android ransomware/Android.Lockdroid.E is detected by Symantec, this variant of ransomware malware employs the accessibility tapjacking method to pose a real threat for more than 67% of Android devices [4].…”