Machine learning aided Android malware classification. (July 2017)

• Record Type: Journal Article
• Authors: Milosevic, Nikola; Dehghantanha, Ali; Choo, Kim-Kwang Raymond
• Is Part Of: Computers & electrical engineering. Volume 61(2017)
• Page Start: 266
• Page End: 274
• Publication Date: 2017-07
• Subjects: Static malware analysis -- OWASP -- Seraphimdroid Android app -- OWASP Seraphimdroid Android app -- Machine learning; 00-01 -- 99-00; Computer engineering -- Periodicals; Electrical engineering -- Periodicals; Electrical engineering -- Data processing -- Periodicals; Ordinateurs -- Conception et construction -- Périodiques; Électrotechnique -- Périodiques; Électrotechnique -- Informatique -- Périodiques; Computer engineering; Electrical engineering; Electrical engineering -- Data processing; Periodicals; Electronic journals; 621.302854
• DOI: 10.1016/j.compeleceng.2017.02.013
• Languages: English
• ISSNs: 0045-7906

Abstract

Highlights: Machine learning aided Android malware classification. OWASP Seraphimdroid Android app. Source code analysis utilizing a bag-of-words representation model. Android file decompiling and machine learning-based malware detection. Graphical abstract: Abstract: The widespread adoption of Android devices and their capability to access significant private and confidential information have resulted in these devices being targeted by malware developers. Existing Android malware analysis techniques can be broadly categorized into static and dynamic analysis. In this paper, we present two machine learning aided approaches for static analysis of Android malware. The first approach is based on permissions and the other is based on source code analysis utilizing a bag-of-words representation model. Our permission-based model is computationally inexpensive, and is implemented as the feature of OWASP Seraphimdroid Android app that can be obtained from Google Play Store. Our evaluations of both approaches indicate an F-score of 95.1% and F-measure of 89% for the source code-based classification and permission-based classification models, respectively.