Advertisement

Evaluation of Tree Based Machine Learning Classifiers for Android Malware Detection

  • Md. Shohel Rana
  • Sheikh Shah Mohammad Motiur Rahman
  • Andrew H. Sung
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11056)

Abstract

Android is a most popular mobile-based operating system with billions of active users, which has encouraged hackers and cyber-criminals to push the malware into this operating system. Accordingly, extensive research has been conducted on malware analysis and detection for Android in recent years; and Android has developed and implemented numerous security controls to deal with the problems, including unique ID (UID) for each application, system permissions, and its distribution platform Google Play. In this paper, we evaluate four tree-based machine learning algorithms for detecting Android malware in conjunction with a substring-based feature selection method for the classifiers. In the experiments 11,120 apps of the DREBIN dataset were used where 5,560 contain malware samples and the rest are benign. It is found that the Random Forest classifier outperforms the best previously reported result (around 94% accuracy, obtained by SVM) with 97.24% accuracy, and thus provides a strong basis for building effective tools for Android malware detection.

Keywords

Machine learning Classifier DREBIN Substring Malware 

References

  1. 1.
    Christian, U., Andres, N.: Framework for malware analysis in android. Sist. Telemát. 14(37), 45–56 (2016)CrossRefGoogle Scholar
  2. 2.
    Drake, J.J., Lanier, Z., Mulliner, C., Fora, P.O., Ridley, S.A., Wicherski, G.: Android Hacker’s Handbook. Wiley, Indianapolis (2014)Google Scholar
  3. 3.
    Peiravian, N., Zhu, X.: Machine learning for android malware detection using permission and API calls. In: 2013 IEEE 25th International Conference on Tools with Artificial Intelligence (ICTAI), pp. 300–305 (2013)Google Scholar
  4. 4.
    Yan, P., Yan, Z.: A survey on dynamic mobile malware detection, Softw. Qual. J. (2017).  https://doi.org/10.1007/s11219-017-9368-4. Accessed 31 May 2018
  5. 5.
    Arp, D., Spreitzenbarth, M., Hubner, M., Gascon, H., Rieck, K.: DREBIN: effective and explainable detection of android malware in your pocket. In: Symposium on Network and Distributed System Security (NDSS).  https://doi.org/10.14722/ndss.2014.23247 (2014)
  6. 6.
    Motive Security Labs Malware Reports—Nokia Networks. https://networks.nokia.com/solutions/malware-reports. Accessed 31 May 2018
  7. 7.
    Mobile Malware Evolution 2015—Securelist. https://securelist.com/analysis/kasperskysecurity-bulletin/73839/mobile-malware-evolution-2015/. Accessed 31 May 2018
  8. 8.
    IT Threat Evolution in Q2 2016. Statistics—Securelist. https://securelist.com/analysis/quarterly-malware-reports/75640/it-threat-evolution-in-q22016-statistics/. Accessed 24 May 2018
  9. 9.
    Threat Insight/Threat Reports—Proofpoint. https://www.proofpoint.com/us/threatinsight/threat-reports. Accessed 24 May 2018
  10. 10.
    Qiao, M., Sung, A.H., Liu, Q.: Merging permission and API features for android malware detection. In: 5th IIAI International Congress on Advanced Applied Informatics (IIAI-AAI), Kumamoto, pp. 566–571 (2016).  https://doi.org/10.1109/iiai-aai.2016.237
  11. 11.
    Urcuqui, C., Navarro, A.: Machine learning classifiers for android malware analysis. In: IEEE Colombian Conference on Communications and Computing (COLCOM), pp. 1–6 (2016)Google Scholar
  12. 12.
    Talha, K.A., Alper, D.I., Aydin, C.: APK Auditor: permission-based android malware detection system. Digital Invest. 13, 1–14 (2015)CrossRefGoogle Scholar
  13. 13.
    Sahs, J., Khan, L.: A machine learning approach to android malware detection. In: Intelligence and Security Informatics Conference (EISIC), pp. 141–147. IEEE (2012)Google Scholar
  14. 14.
    Scikit-learn: machine learning in Python Scikit-learn 0.16.1 documentation. http://scikit-learn.org/stable/. Accessed 31 May 2018
  15. 15.
    Yerima, S.Y., Sezer, S., McWilliams, G., Muttik, I.: A new android malware detection approach using Bayesian classification. In: IEEE 27th International Conference on Advanced Information Networking and Applications (AINA), pp. 121–128 (2013)Google Scholar
  16. 16.
    Wu, W.C., Hung, S.H.: DroidDolphin: a dynamic android malware detection framework using big data and machine learning. In: Conference on Research in Adaptive and Convergent Systems, pp. 247–252. ACM (2014)Google Scholar
  17. 17.
    Chang, C.C., Lin, C.J.: LIBSVM: a library for support vector machines. Trans. Intell. Syst. Technol. 2(3), 1–39 (2011)CrossRefGoogle Scholar
  18. 18.
    Feizollah, A., Anuar, N.B., Salleh, R., Amalina, F., Ma’arof, R.U.R., Shamshirband, S.: A study of machine learning classifiers for anomaly-based mobile botnet detection. Malays. J. Comput. Sci. 26(4), 251–265 (2014)Google Scholar
  19. 19.
  20. 20.
    A Gentle Introduction to Random Forests, Ensembles, and Performance Metrics in a Commercial System. http://blog.citizennet.com/blog/2012/11/10/random-forests-ensembles-and-performance-metrics. Accessed 31 May 2018
  21. 21.
  22. 22.
    Introduction to Boosting Trees for Regression and Classification. http://www.statsoft.com/Textbook/Boosting-Trees-Regression-Classification. Accessed 31 May 2018
  23. 23.
    Kurtulmus, A.B., Daniel, K.: Trustless Machine Learning Contracts; Evaluating and Exchanging Machine Learning Models on the Ethereum Blockchain, Algorithmia Research. https://algorithmia.com/static/documents/d3a4c04/Machine_Learning_Models_on_the_Ethereum_Blockchain.pdf (2018)

Copyright information

© Springer Nature Switzerland AG 2018

Authors and Affiliations

  • Md. Shohel Rana
    • 1
  • Sheikh Shah Mohammad Motiur Rahman
    • 2
  • Andrew H. Sung
    • 1
  1. 1.The University of Southern MississippiHattiesburgUSA
  2. 2.Daffodil International UniversityDhakaBangladesh

Personalised recommendations