Permissions-Based Detection of Android Malware Using Machine Learning

Abstract

Malware applications (Apps) targeting mobile devices are widespread, and compromise the sensitive and private information stored on the devices. This is due to the asymmetry between informative permissions and irrelevant and redundant permissions for benign Apps. It also depends on the characteristics of the Android platform, such as adopting an open-source policy, supporting unofficial App stores, and the great tolerance for App verification; therefore the Android platform is destined to face such malicious intrusions. In this paper, we propose a permissions-based malware detection system (PerDRaML) that determines the App’s maliciousness based on the usage of suspicious permissions. The system uses a multi-level based methodology; we first extract and identify the significant features such as permissions, smali sizes, and permission rates from a manually collected dataset of 10,000 applications. Further, we employ various machine learning models to categorize the Apps into their malicious or benign categories. Through extensive experimentations, the proposed method successfully identifies the 5× most significant features to predict malicious Apps. The proposed method outperformed the existing techniques by achieving high accuracies of malware detection i.e., 89.7% with Support Vector Machine, 89.96% with Random Forest, 86.25% with Rotation Forest, and 89.52% with Naïve Bayes models. Moreover, the proposed method optimized up to ~77% of the feature set as compared to the recent approaches, while improving the evaluation metrics such as precision, sensitivity, accuracy, and F-measure. The experimental results show that the proposed system provides a high level of symmetry between irrelevant permissions and malware Apps. Further, the proposed system is promising and may provide a low-cost alternative for Android malware detection for malicious or repackaged Apps.

A Systematic Literature Review and a Conceptual Framework Proposition for Advanced Persistent Threats (APT) Detection for Mobile Devices Using Artificial Intelligence Techniques

“…These permissions included permission rate, type, and the sizes of the applications to undertake static analysis and explicitly grasp each application's behavior. After identifying the list of permissions, filtering, finalizing, and retrieving the essential features will be used to specify the most important permissions to differentiate malicious and benign apps [217]. Permissions are assigned one of the four protection levels, which describe the potential risks they may entail and impose various install-time approval procedures.…”

Fuzzy Discretization on the Multinomial Naïve Bayes Method for Modeling Multiclass Classification of Corn Plant Diseases and Pests

“…Some of them are multinomial naïve Bayes (MNB), decision tree ID3 (DTID3), decision tree C45 (DTC45), decision tree C50 (DTC50), neural network (NN), genetic algorithm (GA), and analytical hierarchy process (AHP). Most of each variable is discretized using the same membership function [3,5,28,29]. However, some combine several fuzzy membership functions [9,10,12].…”

“…The naïve Bayes method is the usual classification method with a satisfactory performance [27,28], especially for image classification [14,29,30]. If the predictor variables have a continuous scale and meet the assumption of a Gaussian distribution, this method is known as Gaussian naïve Bayes.…”

Android applications classification with deep neural networks

“…Naive users,who unfortunately are in the majority will always fall victims by not strictly observing these guidelines.The biggest traction in recent years has been achieved by new android based malware detection approaches based on machine learning techniques [14], such as ensemble clustering methods. Akbar et al [15], recently presented a permissions-based malware detection method that assesses an app's malice based on the use of suspecious permissions. The authors employed a multilevel technique by extracting the important features like permissions from over 10000 android apps.To classify the applications into their malicious or legitimate categories, the researchers used a variety of machine learning algorithms,including Support Vector Machine,Random Forest, Rotation Forest, and Naïve Bayes classifiers.…”