A Deep Learning Based Android Malware Detection System with Static Analysis

In recent years, smart mobile devices have become indispensable due to the availability of office applications, the Internet, game applications, vehicle guidance or similar most of our daily lives applications in addition to traditional services such as voice calls, SMSs, and multimedia services. Due to Android's open source structure and easy development platforms, the number of applications on Google Play, the official Android app store increased day by day. This also brig some security related issues for the end users. The increased popularity of Android operating system on mobile devices, and the associated financial benefits attracted attackers for developing some malware for these devices, which results a significant increase in the number of Android malware applications. To detect this type of security threats, signature based detection (static detection) in generally preferred due to its easy applicability and fast identification ability. Therefore in this study it is aimed to implement an up-to-date, effective, and reliable malware detection system with the help of some deep learning algorithms. In the proposed system, RNN-based LSTM, BiLSTM and GRU algorithms are evaluated on CICInvesAndMal2019 data set which contains 8115 static features for malware detection. Experimental results show that the BiLSTM model outperforms other proposed RNN-based deep learning methods with an accuracy rate of 98.85 %.

I. Introduction

In recent years, with the digital transformation that has taken place, the rate of smart mobile device usage is increasing day by day. According to the “Digital 2022” report, the number of smart mobile devices worldwide has reached 5.3 billion [1] and Android operating system is used in 71.63% of these devices [2]. This is an indication that Android mobile devices are an indispensable part of daily life. Android systems have become the target of cyber attackers because of the valuable personal information they contain, which is directly proportional to factors such as the number of users, usage areas, and ease of application access. The attackers may receive access to users' devices through applications containing malware, which they succeeded in uploading to Google Play. In particular, the fact that Android applications can be downloaded from third-party sources as well as from the Google Play Store allows attackers to easily access the systems through an application. The number of mobile apps downloadable, which was 3.14 million in the fourth quarter of 2020, and 3.48 million as of the first quarter of 2021 [3]. However, the total number of Android malware in 2021 is 3.36 million [4]. This sheer when the number of Android users increases, and accordingly, the number of malware is increasing too. Because the amount of valuable information that attackers can be to accessed increases. This clearly requires effective malware detection systems against malware applications that are increasing in complexity.