Visualising Static Features and Classifying Android Malware Using a Convolutional Neural Network Approach
Source abstract
Abstract
Android phones are widely recognised as the most popular mobile phone operating system. Additionally, tasks like browsing the internet, taking pictures, making calls, and sending messages may be completed with ease in daily life because of the functionality that Android phones offer. The number of situations in which users are harmed by unauthorised access to data emerging from these processes is growing daily. Because the Android operating system is open source and generated applications are not thoroughly reviewed before being released onto the market, this scenario has been the primary focus of hackers. Therefore, technologies to distinguish between malware and benign Android applications are required. CNN-based techniques are proven to produce important and successful outcomes when applied to Android malware detection on images. The CICMalDroid 2020 dataset, which is currently utilised in the literature, was used for this purpose. The features of the apps in the dataset were obtained using the AndroPyTool tool, and faster analysis files of 17,089 Android applications were obtained using the parallel execution technique. Permissions, intents, receivers, and services were used as static analysis features in this article. After these features were obtained, as data preprocessing, the ones with a grand total equal to 1 for each feature in the whole dataset were excluded in order to exclude the features that were specially created by the applications themselves. For each of the features specified for each application, a comma-separated text was obtained according to the usage status of the application. The BERT method was used to digitise the pertinent texts in order to create a unique embedding vector for every feature. Following the digitisation of the vectors, picture files were produced based on the length of each feature. To create a single image file, these image files were combined side by side. Finally, these image files were classified with CNNs. Experimental results were obtained by applying CNNs to the dataset used in the study. As a result of the experiments, a CNN with two outputs provided the highest performance with an accuracy of 91%, an F1-score of 89%, a Recall of 90%, and a Precision of 91%.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Mobile and Web Applications · Network Security and Intrusion Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Engineering, Faculty of Technology, Gazi University, Ankara 06560, Turkey
References (71)
Show source-provided references
1. (2024, February 26). Android Security Paper 2023. Available online: https://services.google.com/fh/files/misc/android-enterprise-security-paper-2023.pdf?utm_medium=blog&utm_source=keyword&utm_content=cta-txt&utm_campaign=2023-oct-global-android_14_security-eng&utm_term=security.
2. (2024, February 26). Market Share of Mobile Operating Systems Worldwide 2009–2023. Available online: https://www.statista.com/statistics/272698/global-market-share-held-by-mobile-operating-systems-since-2009/.
3. (2024, February 26). On-Device Protections. Available online: https://developers.google.com/android/play-protect/client-protections?hl=en.
4. (2024, February 26). Enhanced Google Play Protect Real-Time Scanning for App Installs. Available online: https://security.googleblog.com/2023/10/enhanced-google-play-protect-real-time.html.
5. Hammood, L., Doğru, İ.A., and Kılıç, K. (2023). Machine Learning-Based Adaptive Genetic Algorithm for Android Malware Detection in Auto-Driving Vehicles. Appl. Sci., 13.10.3390/app13095403 ↗
6. Kaspersky (2024, May 15). Global Mobile Banking Malware Grows 32 Percent in 2023. Available online: https://www.kaspersky.com/about/press-releases/2024_global-mobile-banking-malware-grows-32-percent-in-2023.
7. Android malware detection based on multi-head squeeze-and-excitation residual network10.1016/j.eswa.2022.118705 ↗
8. Machine Learning for Android Malware Detection: Mission Accomplished? A Comprehensive Review of Open Challenges and Future Perspectives10.1016/j.cose.2023.103654 ↗
9. Detection approaches for android malware: Taxonomy and review analysis10.1016/j.eswa.2023.122255 ↗
10. A Review of Android Malware Detection Approaches Based on Machine Learning
11. Automated Android Malware Detection Using Optimal Ensemble Learning Approach for Cybersecurity10.1109/ACCESS.2023.3294263 ↗
12. Vinayakumar, R., Soman, K.P., and Poornachandran, P. (2017, January 13–16). Deep Android Malware Detection and Classification. Proceedings of the 2017 International Conference on Advances in Computing, Communications and Informatics (ICACCI), Udupi, India.10.1109/ICACCI.2017.8126084 ↗
13. PermPair: Android Malware Detection Using Permission Pairs10.1109/TIFS.2019.2950134 ↗
14. DL-Droid: Deep learning based android malware detection using real devices10.1016/j.cose.2019.101663 ↗
15. PIndroid: A novel Android malware detection system using ensemble learning methods10.1016/j.cose.2017.03.011 ↗
16. A TAN based hybrid model for android malware detection
17. A multi-tiered feature selection model for Android malware detection based on feature discrimination and information gain
18. Hybroid: A Novel Hybrid Android Malware Detection Framework
19. Alzaylaee, M.K., Yerima, S.Y., and Sezer, S. (2017, January 19–20). Improving Dynamic Analysis of Android Apps Using Hybrid Test Input Generation. Proceedings of the IEEE International Conference on Cyber Security and Protection of Digital Services (Cyber Security 2017), London, UK.10.1109/CyberSecPODS.2017.8074845 ↗
20. Grace, M., Zhou, Y., Zhang, Q., Zou, S., and Jiang, X. (2012, January 25–29). RiskRanker: Scalable and Accurate Zero-day Android Malware Detection. Proceedings of the 10th International Conference on Mobile Systems, Applications, and Services—MobiSys’12, New York, NY, USA.10.1145/2307636.2307663 ↗
21. Zhou, Y., and Jiang, X. (2012, January 20–23). Dissecting Android Malware: Characterization and Evolution. Proceedings of the 33rd IEEE Symposium on Security and Privacy (Oakland 2012), San Francisco, CA, USA.10.1109/SP.2012.16 ↗
22. Xu, Y., Yan, H., Teng, H., Cai, J., and Li, J. (2022). A survey of Android malware detection based on deep learning. Machine Learning for Cyber Security (ML4CS 2022), Springer. [5th ed.]. Lecture Notes in Computer Science.
23. Detection of Mobile Malware in the Wild10.1109/MC.2012.36 ↗
24. Liang, S., and Du, X. (2014, January 10–14). Permission combination-based scheme for Android mobile malware detection. Proceedings of the 2014 IEEE International Conference on Communications (ICC), Sydney, Australia.10.1109/ICC.2014.6883666 ↗
25. Analysis of Malicious Behavior of Android Apps10.1016/j.procs.2016.03.028 ↗
26. Dendroid: A text mining approach to analyzing and classifying code structures in Android malware families10.1016/j.eswa.2013.07.106 ↗
27. A Novel Dynamic Android Malware Detection System with Ensemble Learning10.1109/ACCESS.2018.2844349 ↗
28. A Multimodal Deep Learning Method for Android Malware Detection Using Various Features10.1109/TIFS.2018.2866319 ↗
29. Visual Detection for Android Malware using Deep Learning10.35940/ijitee.A8132.1110120 ↗
30. Jung, J., Choi, J., Cho, S.-J., Han, S., Park, M., and Hwang, Y. (2018, January 9–12). Android malware detection using convolutional neural networks and data section images. Proceedings of the 2018 Conference on Research in Adaptive and Convergent Systems (RACS’18), New York, NY, USA.10.1145/3264746.3264780 ↗
31. Lekssays, A., Falah, B., and Abufardeh, S. (2018, January 2–4). A Novel Approach for Android Malware Detection and Classification using Convolutional Neural Networks. Proceedings of the 2018 Eleventh International Conference on Contemporary Computing (IC3), Noida, India.
32. Zhang, W., Luktarhan, N., Ding, C., and Lu, B. (2021). Android Malware Detection Using TCN with Bytecode Image. Symmetry, 13.10.3390/sym13071107 ↗
33. Li, J., Liu, Z., and Peng, H. (2019). Android Malware Detection Based on Sensitive Permissions and APIs. Security and Privacy in New Computing Environments (SPNCE 2019), Springer. [3rd ed.]. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering.
34. Deep learning for image-based mobile malware detection10.1007/s11416-019-00346-7 ↗
35. Kural, O.E., Şahin, D.Ö., Akleylek, S., Kılıç, E., and Ömüral, M. (2021, January 15–17). Apk2Img4AndMal: Android Malware Detection Framework Based on Convolutional Neural Network. Proceedings of the 6th International Conference on Computer Science and Engineering (UBMK), Ankara, Turkey.10.1109/UBMK52708.2021.9558983 ↗
36. Nazir, F., Khan, M.U.S., Khan, N., and Fayyaz, A. (2023, January 4–5). Examining Malware Patterns in Android Platform using Sufficient Input Subset (SIS). Proceedings of the 2023 International Multi-Disciplinary Conference in Emerging Research Trends (IMCERT), Karachi, Pakistan.10.1109/IMCERT57083.2023.10075203 ↗
37. Al-Fawa’reh, M., Saif, A., Jafar, M.T., and Elhassan, A. (2020, January 8–10). Malware Detection by Eating a Whole APK. Proceedings of the 15th International Conference for Internet Technology and Secured Transactions (ICITST), London, UK.10.23919/ICITST51030.2020.9351333 ↗
38. Detection of Android Malware App through Feature Extraction and Classification of Android Image
39. Android Malware Familial Classification Based on DEX File Section Features10.1109/ACCESS.2020.2965646 ↗
40. Xiao, X., and Yang, S. (2019, January 11–15). An Image-Inspired and CNN-Based Android Malware Detection Approach. Proceedings of the 34th IEEE/ACM International Conference on Automated Software Engineering (ASE), San Diego, CA, USA.10.1109/ASE.2019.00155 ↗
41. Huang, T.H.-D., and Kao, H.-Y. (2018, January 10–13). R2-d2: Color-inspired convolutional neural network (CNN)-based android malware detections. Proceedings of the 2018 IEEE International Conference on Big Data (Big Data), Seattle, WA, USA.10.1109/BigData.2018.8622324 ↗
42. Mitsuhashi, R., and Shinagawa, T. (July, January 27). Exploring Optimal Deep Learning Models for Image-based Malware Variant Classification. Proceedings of the IEEE 46th Annual Computers, Software, and Applications Conference (COMPSAC), Los Alamitos, CA, USA.
43. Mining Android Bytecodes through the Eyes of Gabor Filters for Detecting Malware
44. Android malware detection method based on bytecode image10.1007/s12652-020-02196-4 ↗
45. Wang, G., Ciptadi, A., and Ahmadzadeh, A. (2021). DEXRAY: A Simple, yet Effective Deep Learning Approach to Android Malware Detection Based on Image Representation of Bytecode. Deployable Machine Learning for Security Defense (MLHat 2021), Springer. [3rd ed.]. Communications in Computer and Information Science.
46. DeepVisDroid: Android malware detection by hybridizing image-based features with deep learning techniques10.1007/s00521-021-05816-y ↗
47. Android malware detection through hybrid features fusion and ensemble classifiers: The AndroPyTool framework and the OmniDroid dataset10.1016/j.inffus.2018.12.006 ↗
48. Martín, A., Lara-Cabrera, R., and Camacho, D. (2018, January 21–24). A new tool for static and dynamic Android malware analysis. Proceedings of the Data Science and Knowledge Engineering for Sensing Decision Support (FLINS 2018), Belfast, UK.10.1142/9789813273238_0066 ↗
49. Khoa, N.H., Cam, N.T., Pham, V.-H., and Nguyen, A.G.-T. (2021, January 29–31). Detect Android malware by using deep learning: Experiment and Evaluation. Proceedings of the 2021 5th International Conference on Machine Learning and Soft Computing (ICMLSC’21), Association for Computing Machinery, New York, NY, USA.
50. Classification and Analysis of Android Malware Images Using Feature Fusion Technique10.1109/ACCESS.2021.3090998 ↗
51. Zegzhda, P.D., Pavlenko, E., and Ignatev, G.M. (2018, January 10–12). Applying deep learning techniques for Android malware detection. Proceedings of the 11th International Conference on Security of Information and Networks (SIN’18), New York, NY, USA.10.1145/3264437.3264476 ↗
52. (2024, February 26). Androguard. Available online: https://github.com/androguard/androguard.
53. Darwaish, A., and Naït-Abdesselam, F. (2020, January 7–11). RGB-based Android Malware Detection and Classification Using Convolutional Neural Network. Proceedings of the GLOBECOM 2020—2020 IEEE Global Communications Conference, Taipei, Taiwan.10.1109/GLOBECOM42002.2020.9348206 ↗
54. Lan, T., Darwaish, A., Naït-Abdesselam, F., and Gu, P. (June, January 28). Defensive Randomization Against Adversarial Attacks in Image-based Android Malware Detection. Proceedings of the 2023 IEEE International Conference on Communications (ICC): Communication and Information System Security Symposium, Rome, Italy.10.1109/ICC45041.2023.10279592 ↗
55. Apktool (2024, February 26). A Tool for Reverse Engineering Android Apk Files. Available online: https://apktool.org/.
56. Wang, C., Zhang, L., Zhao, K., Ding, X., and Wang, X. (2021). AdvAndMal: Adversarial Training for Android Malware Detection and Family Classification. Symmetry, 13.10.3390/sym13061081 ↗
57. Android Malware Identification Through Visual Exploration of Disambly Files
58. Arp, D., Spreitzenbarth, M., Hubner, M., Gascon, H., Rieck, K., and Siemens, C. (2014, January 23–26). Drebin: Effective and explainable detection of android malware in your pocket. Proceedings of the Network and Distributed System Security Symposium, San Diego, CA, USA.10.14722/ndss.2014.23247 ↗
59. Polychronakis, M., and Meier, M. (2017). Deep ground truth analysis of current android malware. Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA 2017), Springer. [2nd ed.]. Lecture Notes in Computer Science.10.1007/978-3-319-60876-1 ↗
60. Allix, K., Bissyandé, T.F., Klein, J., and Traon, Y.L. (2016, January 14–22). Androzoo: Collecting millions of android apps for the research community. Proceedings of the 13th International Conference on Mining Software Repositories (MSR’16), New York, NY, USA.10.1145/2901739.2903508 ↗
61. Lashkari, A.H., Kadir, A.F.A., Taheri, L., and Ghorbani, A.A. (2018, January 22–25). Toward Developing a Systematic Approach to Generate Benchmark Android Malware Datasets and Classification. Proceedings of the 52nd IEEE International Carnahan Conference on Security Technology (ICCST), Montreal, QC, Canada.10.1109/CCST.2018.8585560 ↗
62. Ksibi, A., Zakariah, M., Almuqren, L.A., and Alluhaidan, A.S. (2024, May 20). Deep Convolution Neural Networks and Image Processing for Malware Detection. Preprint (Version 1). 27 January 2023. Available online: https://www.researchsquare.com/article/rs-2508967/v1.10.21203/rs.3.rs-2508967/v1 ↗
63. Mahdavifar, S., Kadir, A.F.A., Fatemi, R., Alhadidi, D., and Ghorbani, A.A. (2020, January 17–22). Dynamic Android Malware Category Classification using Semi-Supervised Deep Learning. Proceedings of the 2020 IEEE International Conference on Dependable, Autonomic and Secure Computing, International Conference on Pervasive Intelligence and Computing, International Conference on Cloud and Big Data Computing, International Conference on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech), Calgary, AB, Canada.10.1109/DASC-PICom-CBDCom-CyberSciTech49142.2020.00094 ↗
64. Effective and Efficient Hybrid Android Malware Classification Using Pseudo-Label Stacked Auto-Encoder10.1007/s10922-021-09634-4 ↗
65. (2024, February 26). Bert Base Model (Uncased). Available online: https://huggingface.co/bert-base-uncased.
66. (2024, February 26). Pillow (PIL Fork). Available online: https://pillow.readthedocs.io/en/stable/index.html.
67. Park, J.H., Lee, J., Lee, K., Min, J., and Ko, H. (2020, January 14–19). FBRNN: Feedback recurrent neural network for extreme image super-resolution. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, Seattle, WA, USA.
68. Zhuang, B., Shen, C., Tan, M., Liu, L., and Reid, I. (2019, January 15–20). Structured binary neural networks for accurate image classification and semantic segmentation. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, Long Beach, CA, USA.10.1109/CVPR.2019.00050 ↗
69. Optuna (2024, February 26). Optimize Your Optimization. Available online: https://optuna.org/.
70. Sogut, E., and Erdem, O.A. (2023). A Multi-Model Proposal for Classification and Detection of DDoS Attacks on SCADA Systems. Appl. Sci., 13.10.3390/app13105993 ↗
71. Jo, J., Cho, J., and Moon, J.A. (2023). Malware Detection and Extraction Method for the Related Information Using the ViT Attention Mechanism on Android Operating System. Appl. Sci., 13.10.3390/app13116839 ↗