Android Malware Detection Method Based on Machine Learning

For the Android app market, malware uses code encryption techniques for block detection. For Android applications, scholars have proposed a method to determine whether Android applications are malicious software by analyzing the behavioral characteristics of software operation. The most traditional method is static detection, which is characterized by fast detection speed and less resource occupation. However, Android software cannot be detected by static methods after using encryption technology. The APK package of the application is first decompiled to detect and extract key features, behavioral patterns, and invocation information using Frida and Camille. Subsequently, the long short-term memory network (LSTM) is employed to analyze software intent for determining the presence of malware. The experimental results demonstrate that the static method achieves an accuracy of approximately 80%, whereas the dynamic method achieves an accuracy of 91%. Through the utilization of software intention analysis and permission usage checks in combination, the accuracy rate can be further enhanced to 94%. Upon comparison of the different algorithms utilized in each detection method, it is concluded that both the KNN and random forest algorithms exhibit higher accuracy in the application of such detection methods.