Android Malware Detection by Correlated Real Permission Couples Using FP Growth Algorithm and Neural Networks

In the current internet era, where mobile devices are ubiquitous and often hold sensitive personal and corporate data, Android malware analysis is crucial to protect against the increasing sophistication and prevalence of mobile-based cyberattacks. This article proposes an innovative approach to Android malware detection using real permissions features extracted from Android code. This approach is unique among existing literature because, there for most cases, the declared permissions are being used, which is different from the real permission used in Android apps. Here, step-by-step guidelines have been elaborated to perform reverse engineering in any Android application package (APK) to extract the real permission feature from the Android disassembled code. After that, the most frequent & correlated pairs of real permissions were identified using the Frequent Pattern (FP) Growth algorithm. Thereafter, the existence of those identified real permission couples was checked and fed into a multi-layered, K-fold cross-validated neural network model to predict whether an APK is malware or benignware. Simultaneously, five other traditional machine learning models have also been applied to benchmark the results. The outcome of these models is measured with various well-known metrics like Accuracy, Precision, Recall, Loss, Specificity, F1 Score, Receiver Operating Characteristic (ROC) curve, Negative Predictive Value, and Mathew’s Correlation Coefficient. The experimental evaluation of the proposed methodology shows better performance on the well-known Drebin dataset as well as on the last 5 years customized dataset with an accuracy of over 96%.