Android Malware Detection Using Category-Based Machine Learning Classifiers

Android malware growth has been increasing dramatically along with increasing of the diversity and complicity of their developing techniques. Machine learning techniques are the current methods to model patterns of static features and dynamic behaviors of Android malware. Whereas the accuracy rates of the classifiers increase with increasing the quality of the features, we relate between the apps\u27 features and the features that are needed to deliver the category\u27s functionality. Differently, our classification approach defines legitimate static features for benign apps under a specific category as opposite to identifying malicious patterns. We utilize the features of the top rated apps in a specific category to learn a malware detection classifier for the given category. Android apps stores organize apps into different categories; For example, Google play store organizes apps into 26 categories such as: Health and Fitness, News and Magazine, Music and Audio, etc. Each category has its distinct functionality which means the apps under a specific category are similar in their static and dynamic features. In general, benign apps under a certain category tend to share a common set of features. On the contrary, malicious apps tend to request abnormal features, less or more than what are common for the category that they belong to. This study proposes category-based machine learning classifiers to enhance the performance of classification models at detecting malicious apps under a certain category. The intensive machine learning experiments proved that category-based classifiers report a remarkable higher average performance compared to non-category based