Application of Machine Learning Algorithms for Android Malware Detection
Application of Machine Learning Algorithms for Android Malware Detection
复制标题
DOI：
10.1145/3293475.3293489
复制
发表时间：
2018-11
期刊：
影响因子：
--
通讯作者：
Mohsen Kakavand;M. Dabbagh;A. Dehghantanha
中科院分区：
文献类型：
--
作者：
Mohsen Kakavand;M. Dabbagh;A. Dehghantanha
随着Android智能设备的日益普及，随着新攻击的出现，包括日益复杂的规避技术，因此需要更先进的检测技术，缓解Android恶意软件的战斗已被视为一项至关重要的活动。因此，在本文中，应用和评估了两种机器学习（ML）算法，即支持向量机（SVM）和K最近邻（KNN），通过监督学习过程将特征集分类为良性或恶意应用程序（app）。这项工作涉及应用程序的静态分析，检查 Android 应用程序清单文件中关键字的存在和频率，并从 400 个应用程序数据集中导出静态功能集，以产生更好的恶意软件检测结果。 ML 算法的分类性能通过准确性和真阳性率来衡量，并进行解释以确定哪种算法更适用于 Android 恶意软件检测。对真实恶意软件和良性应用程序数据集的实验结果表明，使用 SVM 和 KNN 的平均准确率分别为 79.08% 和 80.50%，平均真阳性率超过 67.00% 和 80.00%。
As the popularity of Android smart devises increases, the battle of alleviating Android malware has been considered as a crucial activity with the advent of new attacks including progressively complicated evasion techniques, consequently entailing more cutting-edge detection techniques. Hence, in this paper, two Machine Learning (ML) algorithms, called Support Vector Machine (SVM) and K-Nearest Neighbors (KNN), are applied and evaluated to perform classification of the feature set into either benign or malicious applications (apps) through supervised learning process. This work involves in static analysis of apps, which checks for the presence and frequency of keywords in the Android apps' manifest file and derives the static feature sets from a 400-app dataset to produce better malware detection results. The classification performance of the ML algorithms is measured in terms of accuracy and true positive rate and interpreted to determine which algorithm is more applicable for the Android malware detection. The experimental results for a dataset of real malware and benign apps indicate the average accuracy rate of 79.08% and 80.50% with average true positive rate of over 67.00% and 80.00% using SVM and KNN, respectively.