[Paper Review] A Comparative Analysis of Android Malware

Neeraj Chavan, Fabio Di Troia+1 more|arXiv (Cornell University)|Jan 21, 2019

Advanced Malware Detection Techniques19 references4 citations

TL;DR

This paper proposes a static, permission-based approach for detecting and classifying Android malware using machine learning. By leveraging a reduced set of high-impact permissions as features, the authors achieve over 95% accuracy in malware classification and 97% in detection using random forests and artificial neural networks, demonstrating that permission analysis remains a robust and efficient defense against Android malware despite evasion attempts.

ABSTRACT

In this paper, we present a comparative analysis of benign and malicious Android applications, based on static features. In particular, we focus our attention on the permissions requested by an application. We consider both binary classification of malware versus benign, as well as the multiclass problem, where we classify malware samples into their respective families. Our experiments are based on substantial malware datasets and we employ a wide variety of machine learning techniques, including decision trees and random forests, support vector machines, logistic model trees, AdaBoost, and artificial neural networks. We find that permissions are a strong feature and that by careful feature engineering, we can significantly reduce the number of features needed for highly accurate detection and classification.

Motivation & Objective

• To evaluate the effectiveness of static permissions as features for Android malware detection and classification.
• To investigate whether a reduced set of permissions can maintain high detection accuracy while improving efficiency.
• To compare multiple machine learning models—random forest, SVM, ANN, LMT, and boosting—for both binary and multiclass malware classification.
• To assess the resilience of permission-based detection against evasion tactics such as permission reduction or addition.
• To determine the practical feasibility of deploying such models on mobile devices due to low computational overhead.

Proposed method

• Collected static features from Android manifest files, focusing exclusively on requested permissions.
• Employed a diverse set of machine learning models: random forest, J48 decision tree, LMT, linear SVM, AdaBoost, and feedforward artificial neural networks with two hidden layers.
• Applied feature engineering to reduce the number of permissions while preserving predictive power, using statistical and model-based selection.
• Trained models on large, real-world malware datasets, including both benign and malicious apps, with separate evaluations for binary and multiclass settings.
• Used 100 trees in random forest experiments and 100 training epochs for neural networks with ReLU and sigmoid activation functions.
• Evaluated performance using precision, AUC, and confusion matrices, particularly analyzing misclassification patterns across malware families.

Experimental results

Research questions

• RQ1 Can a small, carefully selected subset of Android permissions serve as an effective and efficient feature set for malware detection and classification?
• RQ2 How do different machine learning models compare in performance when classifying Android malware based on permission features?
• RQ3 To what extent can malware evade detection by reducing or adding common permissions, and is permission-based detection still robust?
• RQ4 How does model performance vary between binary classification (malware vs. benign) and multiclass classification (family-level identification)?
• RQ5 Can the proposed approach be efficiently implemented on mobile devices due to low computational requirements?

Key findings

• A minimal subset of permissions is sufficient for highly accurate malware detection, reducing feature count without sacrificing performance.
• Random forest achieved the highest testing accuracy of approximately 97% in binary classification and nearly 95% in multiclass classification on balanced datasets.
• Artificial neural networks achieved an AUC of 0.9920 in binary classification using the reduced feature set, indicating excellent discriminative power.
• Even with highly imbalanced data, which reflects real-world conditions, the ANN model maintained a testing accuracy exceeding 96%.
• Misclassifications in multiclass classification were sporadic and primarily affected small malware families with fewer than 10 samples.
• The study demonstrates that permission-based detection remains resilient to common evasion techniques like permission reduction or injection of benign permissions.