Research Article
Detection of Malicious Android Applications: Classical Machine Learning vs. Deep Neural Network Integrated with Clustering
@INPROCEEDINGS{10.1007/978-3-030-68737-3_7, author={Hemant Rathore and Sanjay K. Sahay and Shivin Thukral and Mohit Sewak}, title={Detection of Malicious Android Applications: Classical Machine Learning vs. Deep Neural Network Integrated with Clustering}, proceedings={Broadband Communications, Networks, and Systems. 11th EAI International Conference, BROADNETS 2020, Qingdao, China, December 11--12, 2020, Proceedings}, proceedings_a={BROADNETS}, year={2021}, month={2}, keywords={Android malware Cyber security Deep neural network Machine learning Malware detection Static analysis}, doi={10.1007/978-3-030-68737-3_7} }- Hemant Rathore
Sanjay K. Sahay
Shivin Thukral
Mohit Sewak
Year: 2021
Detection of Malicious Android Applications: Classical Machine Learning vs. Deep Neural Network Integrated with Clustering
BROADNETS
Springer
DOI: 10.1007/978-3-030-68737-3_7
Abstract
Today anti-malware community is facing challenges due to ever-increasing sophistication and volume of malware attacks developed by adversaries. Traditional malware detection mechanisms are not able to cope-up against next-generation malware attacks. Therefore in this paper, we propose effective and efficient Android malware detection models based on machine learning and deep learning integrated with clustering. We performed a comprehensive study of different feature reduction, classification and clustering algorithms over various performance metrics to construct the Android malware detection models. Our experimental results show that malware detection models developed using Random Forest eclipsed deep neural network and other classifiers on the majority of performance metrics. The baseline Random Forest model without any feature reduction achieved the highest AUC of(99.4\%). Also, the segregating of vector space using clustering integrated with Random Forest further boosted the AUC to(99.6\%)in one cluster and direct detection of Android malware in another cluster, thus reducing the curse of dimensionality. Additionally, we found that feature reduction in detection models does improve the model efficiency (training and testing time) many folds without much penalty on effectiveness of detection model .
