Android Malware Detection Using Machine Learning

In signature based malware detection, antivirus program looks for signature which is nothing but sequence of byte in a particular file to declare the file as malicious. For polymorphic and unknown viruses, signature based detection system fails because polymorphic viruses are encrypted viruses and they are changing decryptor loop on each infection without changing actual code and for unknown viruses there is no signature present in antivirus database. Machine learning-based malware detection uses algorithms to identify patterns and behaviors characteristic of malware, without relying on previously known signatures. This type of non-signature based detection can be more effective in detecting unknown or evolving threats.
Hence, non-signature based approach to detect malware on the basis of an integrated feature set prepared by processing Portable executable (PE) file’s header fields values. The machine learning based method utilizes the structural and behavioral features of malware and benign programs to build a classification model to identify a given sample program as malware or benign.
With AndroGuard, one can examine the structure of an APK, extract and analyze its components, and extract features such as permissions, activities, and services. The library also provides a convenient API for accessing and manipulating the data, making it a useful tool for security researchers, Android developers, and anyone interested in analyzing Android applications.
Our aim was to use some of the major properties of an APK like Android Permissions as features to train several machine learning and deep learning models. We have analysed the accuracy of these models for the test data and it gave us some promising results. The models were performing very well on the new and unseen APKs. Android malware detection using file permissions involves analyzing the permissions of files and directories on the device to identify any malicious behavior.

ML Algorithms such as Logistic Regression, Random Forest Classifier, Gradient Boosting Classifier are implemented individually and then combined into a stacking model for better performance.