Classification of Android Malware from Binary Code Using Ensemble Method with Recursive Feature Elimination

In response to the burgeoning Android market and the concurrent proliferation of both applications and malware, we propose a direct analysis approach to classify Android malware by examining bytecode extracted from DEX files. The prevalent use of obfuscation techniques by malicious actors underscores the need for robust methods to detect and analyze mal ware. Leveraging the frequency of bi-gram and tri-gram patterns within the bytecode, we employ recursive feature elimination with TF-IDF, alongside XGB, RF, and voting classifiers, to enhance detection capabilities. Our study, conducted using the CICAndMal2017 dataset, highlights the effectiveness of this approach, with XGB classifier utilizing the top 4 096 tri-gram features achieving an impressive F1-score of 93.56 % for Android malware detection. This research contributes to the advancement of malware detection methodologies, offering a promising avenue for mitigating the growing threat landscape in the Android ecosystem.