Malware Classification Approaches Utilizing Binary and Text Embedding of Permissions

Abstract

The development of mobile applications is rapidly increasing with the advances in smartphone technology. These applications are intended to assist mobile users in accomplishing various daily tasks including e-commerce and online services. Many mobile applications were also developed to attack smartphone users. Hence, new challenges have been found such as the difficulty to distinguish between benign and malicious malware categories.In this paper, two approaches for classifying malware applications are presented, including Conv1d (Conventional one dimension) and LSTM (Long short Time Memory). The proposed approaches have modeled and solved the malware classification problem using the natural language processing method. Two encoding techniques, binary and text encoding, were conducted on android permissions as a preprocessing phase. In addition, two other classifiers, the Support Vector Machine (SVM) and K-Nearest Neighbor(KNN) were also reported. The two main approaches were evaluated on well-known dataset, the CICMalDroid2020. The Conv1d-approach and LSTM-approach using text encoding achieved the best classification, i.e., high precision and accuracy (98.16\%, 97.72\% and 96.63\%, 96.69\%, respectively). The Conv1d-approach on binary classification has outperformed the LSTM-approach model when compared with Mal-prem and datasets. The Conv1d-approach achieved the best performance, with 99.3\%,99.80\%, 98.90\%, and 98.95\% of accuracy.