Investigating Feature and Model Importance in Android Malware Detection: An Implemented Survey and Experimental Comparison of ML-Based Methods

Ali Muzaffar,Hani Ragab Hassen,Hind Zantout,Michael A Lones
2024-08-26
Abstract:The popularity of Android means it is a common target for malware. Over the years, various studies have found that machine learning models can effectively discriminate malware from benign applications. However, as the operating system evolves, so does malware, bringing into question the findings of these previous studies, many of which report very high accuracies using small, outdated, and often imbalanced datasets. In this paper, we reimplement 18 representative past works and reevaluate them using a balanced, relevant, and up-to-date dataset comprising 124,000 applications. We also carry out new experiments designed to fill holes in existing knowledge, and use our findings to identify the most effective features and models to use for Android malware detection within a contemporary environment. We show that high detection accuracies (up to 96.8%) can be achieved using features extracted through static analysis alone, yielding a modest benefit (1%) from using far more expensive dynamic analysis. API calls and opcodes are the most productive static and TCP network traffic provide the most predictive dynamic features. Random forests are generally the most effective model, outperforming more complex deep learning approaches. Whilst directly combining static and dynamic features is generally ineffective, ensembling models separately leads to performances comparable to the best models but using less brittle features.
Machine Learning,Cryptography and Security
What problem does this paper attempt to address?
The paper aims to address the following issues: 1. **Importance Analysis of Features and Models**: Reimplement and evaluate past research work to determine which static and dynamic features and machine learning models are most effective for Android malware detection in the current Android ecosystem. The study found that features extracted through static analysis (such as API calls and opcodes) can achieve a high detection accuracy of up to 96.8%, and the Random Forest model is generally more effective than complex deep learning methods. 2. **Dataset Update and Expansion**: Construct a balanced, relevant, and up-to-date dataset containing 124,000 application samples (62,000 benign apps and 62,000 malicious apps) to evaluate the effectiveness of various Android anti-malware methods. This helps to overcome the issues of outdated, small-scale, or imbalanced datasets used in previous studies. 3. **Feature Selection and Model Integration**: Fill existing knowledge gaps through experiments and identify the best feature selection algorithms and model combination methods. An integrated method combining optimal static and dynamic models is proposed, achieving an accuracy of 97.8% on contemporary datasets. In summary, the paper focuses on systematically comparing and analyzing the most effective feature and model selection strategies in the modern Android operating system environment to improve the accuracy and robustness of malware detection.