[Paper Review] FeatureAnalytics: An approach to derive relevant attributes for analyzing Android Malware

K. Deepa, G. Radhamani+4 more|arXiv (Cornell University)|Sep 17, 2018

Advanced Malware Detection Techniques1 references3 citations

TL;DR

This paper proposes RSST, a two-step feature selection method combining rough set theory and Large Population Test (LPT) to identify the most discriminative system calls for Android malware detection. By reducing 30 optimal system calls, the approach achieves 99.9% accuracy and 1.0 AUC with only 1% false positive rate, outperforming traditional selectors and static features like permissions and APIs.

ABSTRACT

Ever increasing number of Android malware, has always been a concern for cybersecurity professionals. Even though plenty of anti-malware solutions exist, a rational and pragmatic approach for the same is rare and has to be inspected further. In this paper, we propose a novel two-set feature selection approach based on Rough Set and Statistical Test named as RSST to extract relevant system calls. To address the problem of higher dimensional attribute set, we derived suboptimal system call space by applying the proposed feature selection method to maximize the separability between malware and benign samples. Comprehensive experiments conducted on a dataset consisting of 3500 samples with 30 RSST derived essential system calls resulted in an accuracy of 99.9%, Area Under Curve (AUC) of 1.0, with 1% False Positive Rate (FPR). However, other feature selectors (Information Gain, CFsSubsetEval, ChiSquare, FreqSel and Symmetric Uncertainty) used in the domain of malware analysis resulted in the accuracy of 95.5% with 8.5% FPR. Besides, empirical analysis of RSST derived system calls outperform other attributes such as permissions, opcodes, API, methods, call graphs, Droidbox attributes and network traces.

Motivation & Objective

• To address the challenge of high-dimensional, noisy feature spaces in Android malware detection.
• To identify a minimal, optimal set of system calls that best separate malicious from benign applications.
• To improve classification performance by combining rough set theory and statistical testing for feature selection.
• To evaluate the superiority of system call-based features over static attributes like permissions, APIs, and Droidbox traces.
• To develop a robust, high-accuracy detection framework using dynamic analysis and machine learning.

Proposed method

• Apply rough set theory to perform initial feature selection by identifying reducts—minimal subsets of system calls that preserve classification accuracy.
• Use Large Population Test (LPT), a non-parametric statistical test, to rank and refine the selected system calls based on their discriminative power between malware and benign samples.
• Construct a final feature vector of 30 system calls derived from the RSST process to represent application behavior.
• Train and evaluate classifiers (AdaBoostM1-J48, Random Forest, Rotation Forest) on the selected system call features.
• Compare performance against conventional feature selectors: Information Gain, Chi-Square, Symmetric Uncertainty, CFsSubsetEval, and FreqSel.
• Integrate system call features with other dynamic and static attributes (e.g., network traces, call graphs, Droidbox) for comparative analysis.

Experimental results

Research questions

• RQ1 Can a hybrid feature selection approach combining rough set theory and statistical testing improve malware detection accuracy?
• RQ2 How do system call-based features compare to traditional static features (e.g., permissions, APIs) in distinguishing malware from benign apps?
• RQ3 What is the optimal number of system calls needed to achieve high detection accuracy with low false positive rate?
• RQ4 Does the RSST method outperform standard feature selection techniques in malware detection tasks?
• RQ5 Can system call features alone achieve near-perfect classification performance in Android malware detection?

Key findings

• The RSST method achieved 99.9% detection accuracy with a 1.0 AUC and only 1% false positive rate using 30 selected system calls.
• The proposed method significantly outperformed conventional feature selectors: Information Gain, CFsSubsetEval, Chi-Square, and Symmetric Uncertainty achieved 95.5% accuracy with 8.5% FPR.
• System call-based features surpassed static features such as permissions, APIs, and Droidbox attributes in detection performance.
• The LPT-based feature set achieved 99.8% accuracy with 0.001% false positive rate in a subset evaluation, indicating high robustness.
• Empirical analysis confirmed that system calls are more discriminative than call graphs, opcodes, or network traces for malware classification.
• The study demonstrates that dynamic analysis using system calls, when combined with intelligent feature selection, enables near-perfect malware detection.