AntiWare: An automated Android malware detection tool based on machine learning approach and official market metadata

The prevalence of mobile devices has increased rapidly in recent years. People store valuable data like personal and financial information on those devices. In addition, applying “bring your own device (BYOD)” policy in companies has become popular. Hence, mobile devices are also source of valuable and confidential company information. Accordingly, there is a growing need for malware detection methods and tools to protection mobile devices against attacks targeting them. In this study, an automated feature-based static analysis method is applied to detect malicious mobile applications on Android devices. By utilizing the metadata of applications on the official market and an online free malware scanner, the feasibility of a mobile malware detection model using free public sources and having quite acceptable accuracy rates is shown. As opposed to previous studies considering only the requested permissions as feature set, additional market metadata including but not limited to application category, download number, developer name, and average rating are included in the analysis as the feature set for training supervised classification algorithms. Based on an experimental evaluation of the majority voting of antivirus (AV) engines on the free online AV community, applications in the training set are labeled as malicious or benign. Naïve Bayes classification algorithm is chosen as supervised learning algorithm for the detection task. In addition, as filter-based algorithms, Chi-Square, Information Gain and ReliefF feature selection methods are used for overcoming potential overfitting problems. Finally, a quick prototype for showing the feasibility of the detection model is demonstrated with sample case applications.

I. Introduction

Smartphones and tablets have been pervading in both daily use and business settings. Conventional PC market has been falling behind the market for mobile computing. Statistics reported by the Intelligence Research Service of Business Insider strongly support this fact that it was totally 28 percent of the world population who owned tablets and smartphones when compared to PC owners constituting the 20 percent at the end of 2013 [1]. The ubiquitous use of mobile devices has induced the burst of mobile application market because mobile applications enhance the capabilities of mobile devices and improve the customer experience. The increasing acceptance of mobile applications makes mobile devices and applications fruitful lands for developing mobile malware by cybercriminals because they are full of personal and financial data [2]. Hackers have a wide range of subtle methods to harm mobile devices and trick users, and they discover new ones every day. As counterattack to this growing army, security solutions proposed by researchers have been increasing. However, this research field is immature and needs to be explored deeply [3].