Using Machine Learning to Classify Android Application Behavior

Android malware detection has been a major concern in the recent years. Google Play store uses a malware detection system called Play Protect to verify the benignity of the apps before making them available for download. However, a considerable number of apps on Google official store is supplemented with malicious behaviors that bypass Play Protect. To address this issue, we introduce DroidLicious, a solution that focuses on identifying whether an Android app is supplemented with a malware-like behavior. DroidLicious utilizes reliable machine learning classifier to classify the static features of the app, which are extracted using state-of-the-art static taint analysis techniques. DroidLicious's classifier was trained using static features extracted from 6,538 malware and benign apps of equal distribution. Our experiments proved DroidLicious accuracy in classifying the behavior of Android apps, also that it can improve through re-training using more samples.