Abstract
Android is a most popular mobile-based operating system with billions of active users, which has encouraged hackers and cyber-criminals to push the malware into this operating system. Accordingly, extensive research has been conducted on malware analysis and detection for Android in recent years; and Android has developed and implemented numerous security controls to deal with the problems, including unique ID (UID) for each application, system permissions, and its distribution platform Google Play. In this paper, we evaluate four tree-based machine learning algorithms for detecting Android malware in conjunction with a substring-based feature selection method for the classifiers. In the experiments 11,120 apps of the DREBIN dataset were used where 5,560 contain malware samples and the rest are benign. It is found that the Random Forest classifier outperforms the best previously reported result (around 94% accuracy, obtained by SVM) with 97.24% accuracy, and thus provides a strong basis for building effective tools for Android malware detection.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Christian, U., Andres, N.: Framework for malware analysis in android. Sist. Telemát. 14(37), 45–56 (2016)
Drake, J.J., Lanier, Z., Mulliner, C., Fora, P.O., Ridley, S.A., Wicherski, G.: Android Hacker’s Handbook. Wiley, Indianapolis (2014)
Peiravian, N., Zhu, X.: Machine learning for android malware detection using permission and API calls. In: 2013 IEEE 25th International Conference on Tools with Artificial Intelligence (ICTAI), pp. 300–305 (2013)
Yan, P., Yan, Z.: A survey on dynamic mobile malware detection, Softw. Qual. J. (2017). https://doi.org/10.1007/s11219-017-9368-4. Accessed 31 May 2018
Arp, D., Spreitzenbarth, M., Hubner, M., Gascon, H., Rieck, K.: DREBIN: effective and explainable detection of android malware in your pocket. In: Symposium on Network and Distributed System Security (NDSS). https://doi.org/10.14722/ndss.2014.23247 (2014)
Motive Security Labs Malware Reports—Nokia Networks. https://networks.nokia.com/solutions/malware-reports. Accessed 31 May 2018
Mobile Malware Evolution 2015—Securelist. https://securelist.com/analysis/kasperskysecurity-bulletin/73839/mobile-malware-evolution-2015/. Accessed 31 May 2018
IT Threat Evolution in Q2 2016. Statistics—Securelist. https://securelist.com/analysis/quarterly-malware-reports/75640/it-threat-evolution-in-q22016-statistics/. Accessed 24 May 2018
Threat Insight/Threat Reports—Proofpoint. https://www.proofpoint.com/us/threatinsight/threat-reports. Accessed 24 May 2018
Qiao, M., Sung, A.H., Liu, Q.: Merging permission and API features for android malware detection. In: 5th IIAI International Congress on Advanced Applied Informatics (IIAI-AAI), Kumamoto, pp. 566–571 (2016). https://doi.org/10.1109/iiai-aai.2016.237
Urcuqui, C., Navarro, A.: Machine learning classifiers for android malware analysis. In: IEEE Colombian Conference on Communications and Computing (COLCOM), pp. 1–6 (2016)
Talha, K.A., Alper, D.I., Aydin, C.: APK Auditor: permission-based android malware detection system. Digital Invest. 13, 1–14 (2015)
Sahs, J., Khan, L.: A machine learning approach to android malware detection. In: Intelligence and Security Informatics Conference (EISIC), pp. 141–147. IEEE (2012)
Scikit-learn: machine learning in Python Scikit-learn 0.16.1 documentation. http://scikit-learn.org/stable/. Accessed 31 May 2018
Yerima, S.Y., Sezer, S., McWilliams, G., Muttik, I.: A new android malware detection approach using Bayesian classification. In: IEEE 27th International Conference on Advanced Information Networking and Applications (AINA), pp. 121–128 (2013)
Wu, W.C., Hung, S.H.: DroidDolphin: a dynamic android malware detection framework using big data and machine learning. In: Conference on Research in Adaptive and Convergent Systems, pp. 247–252. ACM (2014)
Chang, C.C., Lin, C.J.: LIBSVM: a library for support vector machines. Trans. Intell. Syst. Technol. 2(3), 1–39 (2011)
Feizollah, A., Anuar, N.B., Salleh, R., Amalina, F., Ma’arof, R.U.R., Shamshirband, S.: A study of machine learning classifiers for anomaly-based mobile botnet detection. Malays. J. Comput. Sci. 26(4), 251–265 (2014)
Towards Data Science. https://towardsdatascience.com/decision-trees-in-machine-learning-641b9c4e8052. Accessed 31 May 2018
A Gentle Introduction to Random Forests, Ensembles, and Performance Metrics in a Commercial System. http://blog.citizennet.com/blog/2012/11/10/random-forests-ensembles-and-performance-metrics. Accessed 31 May 2018
Ensemble Methods. https://www3.nd.edu/~rjohns15/cse40647.sp14/www/content/lectures/31%20-%20Decision%20Tree%20Ensembles.pdf. Accessed 31 May 2018
Introduction to Boosting Trees for Regression and Classification. http://www.statsoft.com/Textbook/Boosting-Trees-Regression-Classification. Accessed 31 May 2018
Kurtulmus, A.B., Daniel, K.: Trustless Machine Learning Contracts; Evaluating and Exchanging Machine Learning Models on the Ethereum Blockchain, Algorithmia Research. https://algorithmia.com/static/documents/d3a4c04/Machine_Learning_Models_on_the_Ethereum_Blockchain.pdf (2018)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 Springer Nature Switzerland AG
About this paper
Cite this paper
Rana, M.S., Rahman, S.S.M.M., Sung, A.H. (2018). Evaluation of Tree Based Machine Learning Classifiers for Android Malware Detection. In: Nguyen, N., Pimenidis, E., Khan, Z., Trawiński, B. (eds) Computational Collective Intelligence. ICCCI 2018. Lecture Notes in Computer Science(), vol 11056. Springer, Cham. https://doi.org/10.1007/978-3-319-98446-9_35
Download citation
DOI: https://doi.org/10.1007/978-3-319-98446-9_35
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-98445-2
Online ISBN: 978-3-319-98446-9
eBook Packages: Computer ScienceComputer Science (R0)