Class-Balanced Ensembled Framework for Android Malware Detection
摘要
Android is particularly vulnerable to attacks due to its widespread use and open architecture. Effective detection methods are crucial to safeguard user data and device functionality. Despite ongoing advancements in Android malware detection, significant challenges remain unaddressed. Many existing frameworks rely on outdated datasets, leading to feature extraction that fails to capture the evolving nature of modern malware. Additionally, these datasets often exhibit severe class imbalance, with benign samples vastly outnumbering malicious ones, which results in biased models. This study enhances Android malware detection by extracting features from recent malware samples and applying class balancing techniques. The framework’s core is to combine the predictions of machine learning (ML) and deep learning (DL) algorithms. The extracted features are the relevant metadata indicators of the application’s behavior. Whether primary or secondary, the dataset is often imbalanced due to the disproportionate number of benign versus malicious samples. In this study, to address the imbalanced nature of the dataset, the class balancing technique is applied to ensure the learning algorithms are not biased. To perform the training and testing, the framework uses an ensemble technique that combines the predictions of ML and DL classifiers and achieves improved accuracy. The use of recent applications for feature extraction and dataset preparation, and the application of class balancing techniques, demonstrate a significant improvement in detecting Android malware. This comprehensive approach provides a robust framework for future research and development in mobile security.