EDMDroid:Ensuring Diversity to improve Android malware detection based on permissions

Android system has become the main target of malicious software on account of its open source and popularity. The rapid growth of malicious software, including tariff consumption, privacy theft and remote control, has brought great harm to users. Therefore, the task of detecting malware carries great significance. This article proposes a framework EDMDroid based on Android permission frequency to detect malware. The purpose of this framework is to improve the detection rate by ensuring the diversity of ensemble base classifiers. The realization of diversity is to generate data subsets through random feature subspace and bootstrapping technology, then use non-negative matrix factorization (NMF) technology to generate new data sets on the basis of data subsets. The final prediction results using the integrated strategy voting method come from the integrated predicted results of the model trained by decision tree algorithm. We verified the proposed method on two datasets. The first dataset only extracts the permissions officially defined by Android (OFC dataset). The second dataset contains custom and officially defined permissions (CBA dataset). Experimental results prove that EDMDroid is an effective way for detecting Android malware.