PaperlayerView exact revision on arXiv

Source-linked AI summary

Android Malware Detection Using Parallel Machine Learning Classifiers

Suleiman Y. Yerima, Sakir Sezer, Igor Muttik

arXiv:1607.08186v1cs.CRcs.AI

TL;DR

Android malware evasion challenges existing detection, including signatures. This paper combines diverse machine-learning classifiers for early detection; its maximum-probability scheme improved the reported detection rate over the best individual classifier, while product schemes had the best accuracy and TNR.

  • Problem

    Android malware can evade common detection through concealed or obfuscated payloads, making prompt identification difficult and signature-based scanning vulnerable.

    Source: §I · p. 1

  • Method

    The paper combines heterogeneous supervised classifiers using parallel schemes and evaluates the model with 10-fold cross-validation.

    Source: §I · p. 1, C. Model evaluation · p. 3

  • Results

    The maximum-probability scheme reached a 97.5% detection rate, improving on the best individual classifier’s 95.7%; products-of-probabilities schemes had the best accuracy and TNR, with a slight FPR increase for the maximum-probability scheme.

    Source: C. Experiment 2: parallel classifiers… · p. 5

  • Takeaways & Limitations

    The authors consider parallel classification a viable complementary tool that may improve Android malware detection and provide interpretable intermediate output through rule-based classifiers.

    Source: C. Experiment 2: parallel classifiers… · p. 5, §VII · p. 6

Abstract

from arXiv · show

Mobile malware has continued to grow at an alarming rate despite on-going efforts towards mitigating the problem. This has been particularly noticeable on Android due to its being an open platform that has subsequently overtaken other platforms in the share of the mobile smart devices market. Hence, incentivizing a new wave of emerging Android malware sophisticated enough to evade most common detection methods. This paper proposes and investigates a parallel machine learning based classification approach for early detection of Android malware. Using real malware samples and benign applications, a composite classification model is developed from parallel combination of heterogeneous classifiers. The empirical evaluation of the model under different combination schemes demonstrates its efficacy and potential to improve detection accuracy. More importantly, by utilizing several classifiers with diverse characteristics, their strengths can be harnessed not only for enhanced Android malware detection but also quicker white box analysis by means of the more interpretable constituent classifiers.

I. INTRODUCTION

Android malware spreads through official and third-party app stores, while evasion techniques make prompt detection and signature-based scanning difficult. The paper investigates parallel heterogeneous classifiers for early detection, with potential benefits for accuracy and white-box analysis.

I. INTRODUCTION

  • Android malware has appeared in both official and third-party stores, where some unofficial markets have weak or nonexistent safeguards against malicious uploads.DroidDream, distributed through the official Android Market, reportedly affected 50,000 to 200,000 users.Source: §I · p. 1
  • Polymorphism, encrypted payloads, and code obfuscation can bypass signatures and prolong analysts’ work; runtime-fetched payloads also undermine prior-signature zero-day detection.The cited example is AnserverBot, which can fetch and execute malicious payloads at run time.Source: §I · p. 1
  • The proposed early-detection model combines diverse machine-learning classifiers trained on static app features to label new applications suspicious or benign.The paper investigates different schemes for combining the trained models.Source: §I · p. 1
  • Parallel classifiers may offer benefits beyond accuracy: outputs from more interpretable base models can complement white-box analysis.The passage presents this as a potential use of the constituent classifiers’ differing strengths.Source: §I · p. 1
  • The authors describe this as the first investigation of parallel machine-learning classifiers for proactive Android malware detection, to their knowledge.They report evaluation with real malware samples and benign applications.Source: §I · p. 1

II. ANDROID APPLICATION STRUCTURE AND FEATURE EXTRACTION

Android applications are assembled from components with user-facing or background roles, then packaged as APK archives containing code and app resources. The manifest records declarations such as components and permissions.

A. Android application basics

  • Activities provide graphical user interaction, while Services and Broadcast Receivers operate in the background; Content Providers expose data through an interface.Activities are commonly invoked via intents, while the other component types may be optional depending on app functionality.Source: A. Android application basics · p. 2
  • Android apps are written in Java and compiled with data and resource files into an Android package, or APK, used for installation.Source: A. Android application basics · p. 2
  • An APK includes a manifest, Dalvik executable, resources, compiled libraries, certificate and resource metadata, and a compiled resource file.The manifest contains app information, component declarations, and permissions.Source: A. Android application basics · p. 2

B. App feature extraction for machine learning

The detector extracts static features from APK files and uses them to train a composite classifier. Its feature set represents API use, requested permissions, and operating-system or Android commands.

B. App feature extraction for machine learning

III. MACHINE LEARNING MODELS FOR THE PARALLEL CLASSIFICATION APPROACH

The approach trains supervised classifiers with different learning characteristics and combines them in parallel to produce a single verdict for a new app. The constituent models offer distinct forms of interpretability and sensitivity tuning.

III. MACHINE LEARNING MODELS FOR THE PARALLEL CLASSIFICATION APPROACH

  • The composite zero-day detector combines heterogeneous supervised classifiers in parallel to produce one classification verdict for new applications.The constituent algorithms are Decision Tree, Simple Logistic, Naïve Bayes, PART, and RIDOR.Source: §III · pp. 2–3, Figure 1 · p. 3
  • Rule-based classifiers provide the most interpretable output, while the probabilistic classifier is most amenable to post-training sensitivity tuning.Source: §III · p. 3
  • Decision Tree uses sequential feature tests, while Simple Logistic applies additive logistic regression with simple regression functions as base learners.The paper describes Simple Logistic as slower to train but fast in classification.Source: §III · p. 3
  • Naïve Bayes assumes feature independence and is described as potentially very fast to learn and classify.Source: §III · p. 3
  • PART builds ordered decision lists and assigns an app using the first matching rule, with a default when none matches.It builds a partial C4.5 tree at each iteration and turns a selected leaf into a rule.Source: §III · p. 3
  • RIDOR creates a default rule and iteratively adds exceptions, selecting exceptions with the least weighted error rate until pure.Source: §III · p. 3

IV. INVESTIGATION METHODOLOGY

The methodology extracts app features and represents each application as a binary feature vector for classifier training.

IV. Investigation Methodology

  • The APK analysis tool extracts features and preprocesses them into a matrix of app-level input vectors.Each row represents one app; each column represents one feature.Source: A. Input preprocessing · p. 3
  • The 179 training features comprise 54 API-call and command features and 125 app-permission features.Source: A. Input preprocessing · p. 3
  • Binary values indicate whether each corresponding feature is present or absent in an app.Source: A. Input preprocessing · p. 3

B. Model training

The study trains supervised classifiers on labeled apps and evaluates them using 10-fold cross-validation and several performance metrics.

B. Model training

  • The training corpus contains 6,863 labeled apps—2,925 malicious and 3,938 non-malicious—and the passage describes a 6,836-by-180 input matrix.The stated app total and matrix row count differ in the passage.Source: B. Model training · p. 3

C. Model evaluation

  • In 10-fold cross-validation, each of 10 non-overlapping partitions serves in turn as test data while the other nine train the model; results are averaged.The procedure is presented as assessing relative effectiveness on unknown malicious apps.Source: C. Model evaluation · p. 3
  • Evaluation metrics include TPR, TNR, FPR, FNR, accuracy, error ratio, and AUC, with accuracy defined from the four ratios and error as 1 minus accuracy.AUC is described as estimating predictive power and supporting sensitivity tuning.Source: C. Model evaluation · p. 4

A. Experiment 1: Individual classifiers experiments

Individual classifiers provide baseline results for the parallel approach, and their differing accuracy and computational characteristics inform classifier selection.

A. Experiment 1: Individual classifiers experiments

  • The five individual classifiers were run on the preprocessed training matrix using the stated training-testing methodology to establish baselines.Source: A. Experiment 1: Individual… · p. 4, Table II · p. 4
  • Among the five individual classifiers, RIDOR and PART showed better detection, with reported rates of 94.8%, 95.7%, and 95.8%; PART was best in overall accuracy/error rates.Naïve Bayes had the lowest detection ratio (TPR) and overall accuracy; Simple Logistic had the next-best malware detection capability, at about 91%.Source: A. Experiment 1: Individual… · p. 4, Table II · p. 4

B. Implications for parallel classification

  • PART produces 74 rules, RIDOR 25, and the Decision Tree 143 leaves; Naïve Bayes and Simple Logistic classify quickly after training.Simple Logistic takes longest to train, while the authors consider all five models' classification overhead low enough for parallel use.Source: B. Implications for parallel… · p. 4

C. Experiment 2: parallel classifiers experiments

The experiments compare four ways to combine the five classifiers' outputs. Product of probabilities performs best on accuracy and TNR, while maximum probability yields the highest reported detection rate.

C. Experiment 2: parallel classifiers experiments

  • The four combination schemes are average of probabilities, product of probabilities, maximum probability, and majority vote across the five classifiers.The first three compare class probabilities; majority vote uses individual class decisions.Source: C. Experiment 2: parallel classifiers… · pp. 4–5
  • 97.5% TPR with maximum probability improves on the best individual TPR of 95.7%; product of probabilities reaches 97.3% without increased FPR.Product of probabilities also gives the best accuracy and TNR, and its identification and error/accuracy results outperform the individual-classifier baselines.Source: Table III · p. 5, C. Experiment 2: parallel classifiers… · p. 5
  • The authors describe the composite approach as practically viable given the base classifiers' relatively low classification overhead.They frame it as complementing existing solutions, particularly for zero-day Android malware without derived signatures.Source: C. Experiment 2: parallel classifiers… · p. 5

VI. RELATED WORK

Prior Android malware work includes dynamic and static analysis, while this study uses static features and parallel classifiers. It also broadens prior permission-based feature sets with command-related features.

VI. RELATED WORK

  • Dynamic work includes AAS's combined analysis, Crowdroid's system-call clustering, MADAM's kernel/user monitoring, and Andromaly's host monitoring.AntiMalDroid uses logged behavior sequences as features for SVM training and detection.Source: §VI · p. 5
  • Static analysis supports pre-install malware identification and relatively quick app-market screening while avoiding handheld-device resource constraints.The passage also describes static analysis as undetectable by malware during analysis and as faster, less resource-intensive, and broader in code coverage than dynamic runtime analysis.Source: §VI · p. 5
  • Static predecessors include DroidMat, Bayesian classification using 58 code-based features, and SVMs trained on permissions and call-flow graphs.The Bayesian approach used 1,000 malware samples and 1,000 benign applications.Source: §VI · p. 5
  • Compared with permission-based studies by Sanz et al., Sarma et al., and Peng et al., this study uses a broader feature set including commands, also used in.The paper reports that command-related features have been effective in improving classification accuracy in its experience.Source: §VI · pp. 5–6

VII. CONCLUSION

The conclusion presents parallel classification with API-call, command, and permission features as a viable complementary Android malware detection approach. The authors identify interpretable classifier outputs and low-cost classification as potential benefits, and plan to evaluate a detection engine on emerging-market datasets.

VII. CONCLUSION

  • The approach combines diverse machine-learning classifiers using API-call, command, and permission features for Android malware detection.The authors describe it as a viable complementary tool that may improve detection and leverage the strengths of diverse classifiers.Source: §VII · p. 6
  • Rule-based classifiers can provide interpretable intermediate outputs for further analysis, while static features and low-computation models make new-app classification cost-effective.Source: §VII · p. 6
  • Future work will develop and evaluate a detection engine and tune its performance on new datasets from emerging Android app markets.Source: §VII · p. 6
Loading 1607.08186v1…