7 Feature Engineering and Analysis Toward Temporally Robust Detection of Android Malware

With the growth in amount, variants, diversity, and sophistication in malware, conventional methods often fail to detect malicious applications. Therefore, fast and accurate detection of Android malware has become a real challenge. In this work, we build a lightweight malware detection model that is capable of fast, generalized, and accurate detection of Android malware. We design a framework that is built on static analysis approach integrated with highly effective feature engineering techniques resulting in a very lightweight model. We work with more than 0.8 million of samples which are collected between 2010 and 2019. To make our model more robust against variation of malware over time, we create multiple highly class-balanced datasets and perform parallel analysis.We extract several categories of information like permissions, API, intents, app components, etc., and demonstrate the effectiveness of feature selection techniques to analyze and identify the relevant features. These are the features that are the most informative and essential for samples gathered across different years to detect malware effectively. Finally, we present a model trained on 361 combined relevant sets of features which is capable of temporally robust detection of Android malware with 98.11% accuracy and 1.22% false positive rate (FPR). The tools that we use in our framework’s design show that the research community can build robust and effective android malware detection frameworks from scratch using the open-source tools and libraries, as mentioned in this chapter.