Analysis of Trojan Remote Access Malware Detection on Android Operating System using Ensemble Learning Method

Malware is malicious software designed to damage or control computer systems. Malware includes various types such as computer viruses, Trojan horses, spyware, adware, crimeware and other software with malicious intent. This research performs malware detection using system calls (syscall) on the Android operating system. Malware Remote Access Trojan analysis on the Android operating system uses dynamic analysis by running each malware on the Android operating system to obtain running syscall information. The syscall results are selected using feature selection with ensemble learning. This study aims to determine the characteristics of the malware based on the syscalls obtained from the dynamic analysis and compare the accuracy, precision, recall and F1 score values of the gradient boost classifier, bagging classifier, voting classifier and stacking classifier methods. The results show that the Voting Classifier, which is the most effective of all the methods, achieves an accuracy of 95%, a precision of 92%, a recall of 100% and an f1-score of 95.85%. This accuracy value is quite good and can be applied in remote access Trojan malware detection.