Malware Detection: A Framework for Reverse Engineered Android Applications Through Machine Learning Algorithms

Abstract

With the rising volume of Android applications, the threats of malware attacks have grown significantly, so there is a growing need for legitimate malware detection is a critical precondition for mobile device security. Common signature-based detection methods are often not able to detect new or disguised malware, so more intelligent detection methods are needed. In this paper, we offer a ML approach to detect malware in Android applications that is based on program properties obtained from the analysis of the application's static structure. The tools for reverse engineering are Jadx and Androguard, which are used to extract crucial static information from the APKs including permissions, API calls, intents, packages, services, and receivers. The above obtained traits are transformed into binary feature vectors and then trained and tested with three classifiers; namely, SVM, ANN and ANN-GA. The experiments were conducted on a set of 3,799 Android apps that were divided into 3,039 training and 760 testing samples. Comparative analysis shows that SVM classifier is able to detect highest accuracy (98.95%) which is better than ANN (98.68%) and ANN-GA (94.87%). The findings demonstrate that using reverse engineering, static feature analysis and ML is an accurate, efficient and scalable way to detect Android malware, without sacrificing classification accuracy for benign and malicious applications.