Source-linked AI summary
High Accuracy Android Malware Detection Using Ensemble Learning
Suleiman Y. Yerima, Sakir Sezer, Igor Muttik
TL;DR
Evolving Android malware and signature-based detection delays create a need for timely zero-day discovery. The paper combines static analysis with ensemble learning over extensive features and large malware and benign-app repositories, achieving 97.3–99% detection accuracy with low false positive rates.
Problem
Evolving anti-analysis techniques and dependence on updated signatures limit timely detection of previously unseen Android malware.
Method
The paper combines static analysis and ensemble learning using 179 features and large malware and benign-app repositories.
Results
97.3–99% detection accuracy was achieved with low false positive rates using large mixed feature sets.
Takeaways & Limitations
The approach supports malware filtering, prioritization of further analysis, app-market policing, and pre-installation verification.
Abstract
from arXiv · showhide
With over 50 billion downloads and more than 1.3 million apps in the Google official market, Android has continued to gain popularity amongst smartphone users worldwide. At the same time there has been a rise in malware targeting the platform, with more recent strains employing highly sophisticated detection avoidance techniques. As traditional signature based methods become less potent in detecting unknown malware, alternatives are needed for timely zero-day discovery. Thus this paper proposes an approach that utilizes ensemble learning for Android malware detection. It combines advantages of static analysis with the efficiency and performance of ensemble machine learning to improve Android malware detection accuracy. The machine learning models are built using a large repository of malware samples and benign apps from a leading antivirus vendor. Experimental results and analysis presented shows that the proposed method which uses a large feature space to leverage the power of ensemble learning is capable of 97.3 to 99 percent detection accuracy with very low false positive rates.
1. INTRODUCTION
Android malware is increasingly difficult to detect because evolving anti-analysis techniques undermine signature-based methods and create delays for previously unseen threats. The paper proposes static analysis with ensemble learning, using extensive features and large datasets to improve zero-day detection.
- Polymorphism, payload encryption, code obfuscation, stealthy communications, and dynamic loading make malicious behavior harder to uncover.
- Up to three months of unnoticed malware and signature-update delays of hours to days leave users exposed to previously unseen threats.
- The paper combines static analysis and ensemble machine learning to enable high-accuracy zero-day Android malware detection.
- The proposed feature space uses 179 attributes from API calls, commands, and permissions, supported by a large malware repository.
- The approach is intended for app filtering, prioritization of expensive analysis, app-market policing, and pre-installation verification.
2. RELATED WORK
Prior Android malware research includes static analysis, machine learning, and dynamic behavioral monitoring. This paper distinguishes itself through automated static analysis combined with learning-based detection, broader features, and a larger malware dataset.
- Earlier static-analysis systems supported risk assessment, app profiling, and security or privacy analysis for Android applications.
- The proposed approach differs by combining automated static analysis with high-accuracy, robust learning-based malware detection.
- Existing work also applied machine learning with static analysis to classify Android apps using Bayesian models, permissions, call-flow graphs, and SVMs.
- The study uses 179 feature attributes from API calls, commands, and permissions, together with a larger malware dataset than previous works.
- Other approaches used dynamic monitoring of device activity, system calls, or runtime behavior for anomaly or malware detection.
3. APPLICATION FEATURE EXTRACTION
The feature-extraction pipeline analyzes APKs and converts diverse application characteristics into vectors for machine-learning classification. Its 179 features span executable code, commands, and manifest permissions to improve resilience to obfuscation and extraction failures.
- A Java-based APK analyzer extracts feature vectors, stores them in a database, and classifies unknown applications using trained models.
- The analyzer detects APIs related to messaging, telephony, package management, encryption, reflection, JNI, dynamic loading, and process execution.
- Linux and Android commands such as chmod, chown, mount, and pm install capture privilege escalation, rooting, shell execution, and stealthy installation behavior.
- Features are drawn from different APK components so that permissions may remain available even when executable-code extraction fails.
- Using all features in ensemble learning avoids the feature-ranking and selection step used by approaches such as Naïve Bayes.
- Feature diversity and a large malware repository provide additional randomization opportunities that can benefit ensemble-learning performance.
4. ENSEMBLE MACHINE LEARNING
The paper applies ensemble learning to Android malware classification, emphasizing Random Forest over all 179 features and comparing it with several alternative learners. Randomness from trees, bootstrap samples, and feature subsets supports the proposed design.
- Random Forest: Random Forest combines randomized decision trees with bagging to classify Android applications as suspicious or benign using all 179 features.
- Evaluation: The evaluation compares Random Forest with Naïve Bayes, Decision Trees, Random Trees, and Simple Logistic across datasets of malware and benign applications.
- Decision Trees: Decision trees select split features using information entropy or Gini impurity.
- Random Forest: Random Trees test randomly selected features at each node without pruning, while Random Forest trains them independently on bootstrap samples.
- Random Forest: Random Forest gains diversity through both bootstrap aggregation and random feature-subset selection during node splitting.
- Random Forest: Random Forest requires no special preprocessing and supports fast training, prediction, handling of irrelevant features, and parallelization.
- Simple Logistic: Simple Logistic uses boosting with additive logistic regression, fitting single-feature regression learners selected by log-likelihood.
5. METHODOLOGY AND EXPERIMENTS
The methodology extracts binary application features from benign and malware APKs, then evaluates classifiers across application-attribute, permission-only, and combined feature sets using standard classification metrics.
- Dataset and feature extraction: 6,863 applications—2,925 malware and 3,938 benign—were processed by a custom APK analyzer to extract binary feature vectors.The vectors recorded feature absence or presence and were stored in a MySQL database for training.
- Feature selection: 179 features remained after removing unused features: 125 permissions plus 54 API, command, and application-attribute features.Five permission features and 11 non-permission features had no occurrence in either class and were eliminated.
- Feature-set comparison: Three training feature sets compared application attributes alone, permissions alone, and the combined 179-feature representation.The feature-set comparison was designed to investigate the effect of feature diversity on classification performance.
- Evaluation: Classifier performance was evaluated using accuracy and error rate together with false-positive, false-negative, true-positive, true-negative, and precision measures.The methodology defines these measures for comparing model classification results across feature sets.
6. RESULTS AND DISCUSSIONS
Across 10-fold cross-validation, ensemble and tree-based classifiers achieved strong Android malware detection, with Random Forest performing best on the 179-feature CAPF set. Its operating point reached 97.3% detection with 2.3% false positives, while ROC-based thresholds reached 98.6–99% detection at higher false-positive rates.
- Naïve Bayes results: 85.4% was the best Naïve Bayes detection rate, achieved using the top 10 CAPF features selected by Mutual Information.The experiments used 10-fold cross-validation, and CAPF denotes the combined 179-feature set.
- Decision Tree results: 94.8% TPR with 4% FPR was obtained by Decision Tree using the CAPF feature set.CAPF also produced better detection rates than the permissions-only or application-attributes feature sets for Decision Trees.
- Random Forest results: Random Forest performance was largely insensitive to k, while increasing the number of trees from 10 to 50 had negligible impact.The best detection rates, lowest false-positive rates, and largest AUC occurred together with CAPF; build times for 10-tree models ranged from 1.48 to 6.41 seconds.
- Random Forest results: 97.6% classification accuracy was observed for Random Forest with k = 50 using the mixed CAPF feature set.The CAPF set combines 179 features, and this configuration outperformed the previously discussed algorithms.
- Random Forest results: 97.3% malware detection was obtained with 2.3% false positives for Random Forest at k = 50.At k = 20, detection was 97.2% with a 2.5% false-positive rate.
- Random Forest results: 98.6% detection was achieved at 6.3% false positives, and 99% detection at 10% false positives, with ROC area 0.993.These higher-TPR operating points support filtering apps for further or manual analysis.
- Comparison with existing work: Compared with prior static-analysis work, the proposed approach reported the highest detection accuracy and best AUC performance.The comparison included earlier methods where quantitative comparison using similar metrics was possible.
7. CONCLUSION
The proposed ensemble-learning approach uses large mixed feature sets to improve Android malware detection, achieving high detection rates with low false positives and supporting zero-day detection.
- 97-99% detection rates with low false positives were achieved using large mixed feature sets and ensemble learning.The approach avoids feature selection and uses a large malware dataset from a leading antivirus vendor.