Source-linked AI summary
Analysis of Bayesian Classification based Approaches for Android Malware Detection
Suleiman Y. Yerima, Sakir Sezer, Gavin McWilliams
TL;DR
The paper addresses the need to detect evolving and previously unknown Android malware beyond traditional signature scanning. It develops Bayesian classifiers using statically extracted and information-ranked app features, and reports strong detection performance, including approximately 0.93 accuracy for the mixed-attributes model and an AUC of 0.97731 for the best setting.
Problem
Evolving Android malware and limitations of signature-based scanning create a need for improved detection of unknown malware.
Method
The paper builds Bayesian classifiers from statically extracted permissions and code properties, ranking features by mutual information before training.
Results
Approximately 0.93 overall accuracy was achieved by the mixed-attributes model, while the best reported AUC was 0.97731 for the M-based model with 15f.
Takeaways & Limitations
The models provide a complementary static-analysis approach to signature-based scanning and can support fast filtering for large-scale analyses of unknown malware.
Abstract
from arXiv · showhide
Mobile malware has been growing in scale and complexity spurred by the unabated uptake of smartphones worldwide. Android is fast becoming the most popular mobile platform resulting in sharp increase in malware targeting the platform. Additionally, Android malware is evolving rapidly to evade detection by traditional signature-based scanning. Despite current detection measures in place, timely discovery of new malware is still a critical issue. This calls for novel approaches to mitigate the growing threat of zero-day Android malware. Hence, in this paper we develop and analyze proactive Machine Learning approaches based on Bayesian classification aimed at uncovering unknown Android malware via static analysis. The study, which is based on a large malware sample set of majority of the existing families, demonstrates detection capabilities with high accuracy. Empirical results and comparative analysis are presented offering useful insight towards development of effective static-analytic Bayesian classification based solutions for detecting unknown Android malware.
4.1 The classifier model
The classifier learns from statically extracted application features and uses Bayesian probabilities to classify Android apps as benign or suspicious. Mutual-information ranking selects the most relevant features before training.
- 4.1 The classifier model: The classifier combines detectors, feature selection, and probability estimation to make final benign-versus-suspicious decisions.Detectors extract features from an app corpus; marginal and conditional probabilities are then calculated for classification.
- 4.1 The classifier model: Mutual information ranks each application feature against the class variable before model training.The class variable represents suspicious or benign applications.
- 4.1 The classifier model: Each application is represented by a feature vector whose entries are the observed values of mined application characteristics.The vector is formed from the results of the corresponding feature random variables.
- 4.1 The classifier model: The feature-selection stage retains the top n features with the highest information gain to maximize classification accuracy.Features are ranked in descending order before selection.
A. Model evaluation
The study evaluates Bayesian models using permissions, code properties, and combined features extracted from Android applications. The feature sets are ranked by information gain to retain attributes most relevant to malware classification.
- A. Model evaluation: The experiments use 2000 applications comprising 1000 malware samples from 49 families and 1000 benign apps.The malware and benign sets support construction and evaluation of the permissions-based model.
- A. Model evaluation: The permissions model extracts standard Android permissions from manifest files and ranks them before classifier training.The analyzer matches 131 standard permissions and selects the highest-ranked features.
- A. Model evaluation: The combined model jointly ranks permission and code-property features and selects the highest-ranked attributes for Bayesian classification.Its input features include selected attributes from both feature types.
- A. Model evaluation: Permission differences between malware and benign samples support using permissions as discriminative classifier attributes.Several SMS-related permissions appear among malware’s frequent permissions but not among the benign set’s top 20.
- A. Model evaluation: The code-property model extracts API calls, Linux commands, Android commands, and notifications from disassembled applications and related resources.The analyzer also examines external libraries, assets, and resource files when present.
5. METHODOLOGY AND EXPERIMENTS
The three Bayesian models are trained and tested under controlled feature-selection settings, with performance assessed using classification metrics derived from benign and suspicious outcomes. The evaluation distinguishes correct classifications from false positives and false negatives.
- 5. METHODOLOGY AND EXPERIMENTS: The study varies feature-selection settings when training and testing the three models to compare their performance.The models are built after APK analysis and evaluated under different numbers or settings of selected features.
- 5. METHODOLOGY AND EXPERIMENTS: The three models use the same 2000-sample corpus and are evaluated with 5-fold cross-validation.Each fold trains on 1600 samples and tests on 400 samples, balanced between benign and malware apps.
- 5. METHODOLOGY AND EXPERIMENTS: Accuracy measures the overall proportion of correctly classified benign and suspicious instances, while error rate is its complement.The paper states Err = 1 - Acc.
- 5. METHODOLOGY AND EXPERIMENTS: The evaluation also defines true negative rate, false negative rate, and precision from benign and suspicious classification counts.The measures use counts of correctly and incorrectly classified applications in the testing phase.
- 5. METHODOLOGY AND EXPERIMENTS: True positive rate counts malicious samples correctly classified as suspicious, whereas false positive rate counts benign samples misclassified as suspicious.These measures are defined relative to the malicious and benign test sets, respectively.
6. RESULTS AND DISCUSSIONS
The experiments compare permission-based, code property-based, and mixed Bayesian models across feature settings, showing that the mixed model with 15 features provides the strongest overall performance. Mixed and code property features generally outperform permissions alone, while sparse low-feature settings can bias classifiers toward benign or malicious classes.
- Accuracy and error: 0.931 accuracy and 0.069 error were achieved by the 15-feature mixed Bayesian model, its best overall accuracy/error setting.Accuracy improved with feature count for code property and mixed models, whereas the permission model peaked at 10 features.
- Detection and error rates: The 15-feature mixed model delivered the best detection rate and lowest false negative rate, while mixed and code property models outperformed permissions-only models at higher feature settings.The result matters for app filtering because false negatives represent malware apps missed and potentially treated as benign.
- Detection and error rates: Sparse feature settings produced misleadingly high class-specific performance: 5-feature permission settings had high TNR but higher FNR, while 5-feature code settings had high FPR.The paper attributes these effects to classifier bias from sparse feature vectors; the 5-feature permission model achieved only about 70% detection.
- AUC and precision: 0.97731 AUC made the 15-feature mixed model the most predictive configuration across the evaluated models and feature settings.The study defines AUC as classifier predictive power, with values closer to 1 indicating better performance.
- AUC and precision: 0.950 precision was recorded by the 15-feature mixed model, exceeded only by the sparse 5-feature permission configuration.The higher precision of the sparse permission model is attributed to classifier bias associated with sparse feature vectors and low false positive rates.
- Overall comparison: Overall accuracy reached approximately 0.90, 0.92, and 0.93 for permission-based, code property-based, and mixed models, respectively, exceeding the 79.6% signature-scanning baseline.The comparative analysis identifies the mixed-based approach as the most promising of the three.
7. CONCLUSION
The paper evaluates three Bayesian models built from statically extracted Android application properties for detecting unknown malware. Mixed attributes provide the strongest overall performance, while the models offer a complementary and scalable alternative to signature-based scanning and dynamic analysis.
- The study built Bayesian models from static analysis of permissions, code properties, and their combination using a custom Android package analyzer.The models were trained from properties extracted from Android application packages.
- Experiments used 1000 malware samples from 49 Android families alongside 1000 benign applications across varied categories.
- Mixed attributes achieved the strongest overall performance, reaching approximately 0.93 accuracy and about 0.977 AUC, exceeding similar published approaches.The permissions-only and code-property models reached approximately 0.9 and 0.92 accuracy, respectively.
- The results support Bayesian classification and data mining as practical approaches for detecting unknown Android malware.
- The models can complement signature-based scanning or dynamic analysis by filtering large app collections for further investigation.