Detecting Android Malware Based on Extreme Learning Machine

To relieve increasingly prominent security issues of Android applications, static malware-detection techniques have become essential, due to their rapid and convenient detection processes which do not require running the detected applications. Most of current commercial anti-malware tools utilize signatures of known malicious Android codes for static detection, but are unable to find out unknown, especially newly created, malware. Many existing malware-detection researches rely on traditional machine learning techniques to analyze some static features of Android applications such as permissions and API calls, but the detection approaches still have room for improvement with respect to simplicity, effectiveness or efficiency. To overcome the limitations of the above detection techniques, we propose a novel static approach to detect malicious Android applications by proposing a set of Android program features, consisting of sensitive permissions and sensitive API calls, and by utilizing Extreme Learning Machine. We implemented our approach with an automated testing tool called WaffleDetector. Controlled experiments have been conducted to compare our approach and the existing ones on detecting malicious Android applications, and the results show that our approach excels the existing ones with minimal human intervention, better detection effectiveness and less detection time.