Enhancing Android Malware Detection through Swarm Intelligence and Autoencoder Techniques Applied to API Call Analysis

Summary

A hybrid Android malware detection framework is proposed, leveraging learned feature representations and traditional classifiers to enhance detection accuracy, reduce manual feature engineering, and counter evolving malware threats effectively.

Abstract

Malware Security Intelligence involves analyzing applications and their metadata to identify potential security threats. Application Programming Interface (API) calls serve as a valuable source of information for detecting malware. Reducing the feature space in malware analysis enhances the efficiency of threat identification. This research seeks to identify the most significant API call features to enhance the precision of Android malware detection. Three swarm intelligence-based optimization techniques-Firefly Optimization, Cuckoo Search Optimization, and Ant Colony Optimization -are employed alongside Auto-Encoders to extract the most significant features. To evaluate these nature-inspired wrapper-based methods, popular machine learning classifiers, including K-Nearest Neighbour (KNN), Random Forest (RF), Support Vector Machine (SVM), Decision Tree (DT), and Linear Regression (LR), are used. Furthermore, a hybrid artificial neural classifier is shown to improve the performance of malware categorization. Effectiveness of the suggested method is demonstrated by experimental results, which show an accuracy of 98.87% using only 7 out of 100 API call features.

Introduction

The most popular mobile operating system is Android, which is based on Linux and has a 72.55% global market share¹. In contrast to other operating systems that are subject to stringent laws and copyrights, Android is an open-source platform that welcomes contributions from developers worldwide. But because of its large user base, virus assaults target it frequently. Malware is the term for malicious software intended to compromise the operation of computer systems or take advantage of private information. The most common method of malware infiltration in the Android ecosystem is through application downloads. While applications obtained from tr....

Protocol

The wrapper-based feature selection method using auto-encoders is used in the suggested architecture for Android malware detection, as shown in Figure 1. The dataset is divided into 70:30 training and testing subsets. Classification and feature selection are the two main steps in the malware analysis process.

Feature selection (FS): This step is iteratively searching for the best feature subsets (see Definition 1) using swarm intelligence-based algorithms, notably Cuckoo Search Optimization (CSO), Ant Lion Optimization (ALO), and Firefly Optimization (FO). After that, auto-encoders process the ....

Results

Several performance indicators, such as Mean Squared Error (MSE), Root Mean Squared Error (RMSE), Precision, Recall, F1-Score, and Accuracy, are used in the proposed Android malware detection system to assess classification accuracy. The following is a definition of these measures.

Discussion

Android malware threats are increasing, with adversaries employing increasingly sophisticated evasion techniques. Android-based mobile systems and applications play a crucial role in smart cities and industrial environments. Ensuring the security of these systems, particularly in such critical domains, necessitates robust malware detection mechanisms. Recently, machine learning-based malware detection research has gained significant attention¹⁸. However, many existing methods rely on feature engin.......

Materials

List of materials used in this article

Name	Company	Catalog Number	Comments
Anaconda Navigator	Anaconda, Inc.	Navigator-2023
Google Colab	Google LLC	N/A
Jupyter Notebook	Project Jupyter	N/A
Python	Python Software Foundation	>=3.9
PyTorch	Facebook AI Research	>=2.0
Scikit-learn	Community Driven	>=1.0
TensorFlow	Google Brain	>=2.8
Windows Operating System	Microsoft Corporation	11