Android Malware Classification Based on Static Features of an Application

Android is the most sought-after mobile platform that has changed what mobiles can do. Due to this, a continuous increase in android malware applications has been seen that poses a significant hazard to users. Thus, the detection of malware applications in the Android environment has become a trending research field for cybersecurity researchers. Android malware detection depends on characterizing the Android application’s functionalities. Over the years, malware has evolved and has become more sophisticated. Hence, it cannot be detected only using a single static feature as it might result in a high number of false negatives. We propose a detection model in this paper that accurately classifies the samples as malware or benign with fewer false positives and false negatives. We have used string features that include suspicious API calls, used permissions, requested permissions, filtered intents, hardware components, and restricted API calls. We have then employed four machine learning algorithms, namely, Ridge Classifier, XGBoost Classifier, Random Forest, and Support Vector Classifier to evaluate the effectiveness of the binary feature vector formed by the combination of these string features. It was noted that Random Forest achieved the highest score for accuracy, precision, recall, area under curve, and F1 score.