Malware Detection: A Framework for Reverse Engineered Android Applications Through Machine Learning Algorithms

Abstract

Today, Android is one of the most used operating systems in smartphone technology. This is the main reason, Android has become the favorite target for hackers and attackers. Malicious codes are being embedded in Android applications in such a sophisticated manner that detecting and identifying an application as a malware has become the toughest job for security providers. In terms of ingenuity and cognition, Android malware has progressed to the point where they're more impervious to conventional detection techniques. Approaches based on machine learning have emerged as a much more effective way to tackle the intricacy and originality of developing Android threats. They function by first identifying current patterns of malware activity and then using this information to distinguish between identified threats and unidentified threats with unknown behavior. This research paper uses Reverse Engineered Android applications' features and Machine Learning algorithms to find vulnerabilities present in Smartphone applications. Our contribution is twofold. Firstly, we propose a model that incorporates more innovative static feature sets with the largest current datasets of malware samples than conventional methods. Secondly, we have used ensemble learning with machine learning algorithms such as AdaBoost, SVM, etc. to improve our model's performance. Our experimental results and findings exhibit 96.24% accuracy to detect extracted malware from Android applications, with a 0.3 False Positive Rate (FPR). The proposed model incorporates ignored detrimental features such as permissions, intents, API calls, and so on, trained by feeding a solitary arbitrary feature, extracted by reverse engineering as an input to the machine.

A comprehensive review on permissions-based Android malware detection

“…Malware datasets used Rovelli et al [115] Genome, Contagio Arp et al [116] Genome,FakeInstaller, GoldDream 27 , GingerMaster 28 , DroidKungFu 29 Yerima et al [117] McAfee Kang et al [118] VirusShare, Contagio, Malware.lu Zhao et al [119] Drebin Qiao et al [120] Genome Chen et al [121] 360 APKs 30 , MobiSec Lab Website 31 , [217] Demertzis et al [122] Magnum-Research 32 Verma et al [123] Contagio, malware forums , security blogs, Genome Wang et al [124] VirusTotal Tang et al [125] Genome, Drebin Wang et al [126] Drebin, Genome Li et al [127] Drebin Bhattacharya et al [128] Contagio Xie et al [129] Genome, VirusShare, Drebin Xie et al [130] Genome, VirusShare, Drebin, antivirus companies Ren et al [131] Anzhi, AndroTotal, Drebin Tao et al [132] VirusShare, Contagio Namrud et al [133] AndroZoo Alswaina et al [134] -Qiu et al [135] -Zhu et al [136] ViruShare Feng et al [137] No Malware Aonzo et al [138] AndroZoo Urooj et al [139] MalDroid [225], DefenseDroid 33 and a small own generated dataset Wang et al [140] No malware Wang et al [141] FakeInst, Opfake, FakeInstaller, Droid-KungFu, GinMaster, Plankton Zhang et al [142] No malware Kesswani et al [143] No malware Ibrahim et al [144] CICMalDroid 2020 Arshad et al [145] Drebin Yuan et al [146] Genome, Contagio Zhou et al [147] Genome Cilleruelo et al [148] Malware selected on the basis of lifespan criteria from Google Play Store ...…”

Assessing the efficacy of Machine learning classifier for Android malware detection

“…This method combines features gained through static and dynamic methods. 8 The methodologies proposed in the referenced paper contribute to the enhancement of key factors, such as selected features for classification and the overall accuracy in predicting malware detection. Numerous research has integrated all of these elements in order to enhance the efficiency of the detection rate.…”

Implementasi Frida Framework untuk Manipulasi Alur Kerja pada Aplikasi Android

“…Melakukan reverse engineering pada aplikasi Android dan mengekstrak fitur serta melakukan analisis statis dari mereka tanpa harus menjalankannya (Singh, 2022). Metode ini melibatkan pemeriksaan isi dua file: AndroidManifest.xml dan classes.dex serta bekerja pada file dengan ekstensi.apk (Urooj et al, 2022).…”