SecuDroid : Android Malware Detection using ML classifier on Static Features

The Android operating system's widespread use has unfortunately made it a target for malware attacks, underlining the necessity for robust detection strategies. Existing literature has explored the potential of machine learning in combating Android malware, often employing a mix of static and dynamic analyses. However, a major portion of these malwares are zero-day vulnerabilities. In this context, our study makes a significant contribution by focusing on using static features extracted from Android application package (APK) files to differentiate between benign and malicious applications. Specifically, all training and testing in this study were performed on the Drebin-215 dataset, a comprehensive collection known for its relevance in Android security research. Improving malware detection using static features allows for detection of malwares before they are run on devices. We analyzed five ML classification algorithms, beginning with a Decision Tree, followed by SVM (Support Vector Machine) with an RBF kernel, then moving to Logistic Regression and K-Nearest Neighbor, and finally, we introduced our proposed model, the SecuDroid Neural Network—employing a methodology that employs precise hyper-parameter tuning, and evaluation through stratified 4-fold cross-validation. The evaluation on an unseen test dataset, based on accuracy, F1-score, and AUC metrics, revealed the SecuDroid Neural Network surpassed its counterparts by reaching an accuracy of 0.993, an F1-score of 0.991, and an AUC of 0.999. Our findings not only offer a comparative analysis of different machine learning models for malware detection but also introduce an efficient approach, thereby enriching the arsenal against Android malware threats, with all empirical validations grounded in the Drebin-215 dataset.