In recent years, Ransomware has been a critical threat that attacks smartphones. Ransomware is a kind of malware that blocks the mobile’s system and prevents the user of the infected device from accessing their data until a ransom is paid. Worldwide, Ransomware attacks have led to serious losses for individuals and stakeholders. However, the dramatic increase of Ransomware families makes to the process of identifying them more challenging due to their continuously evolved characteristics. Traditional malware detection methods (e.g., statistical-based prevention methods) fail to combat the evolving Ransomware since they result in a high percentage of false positives. Indeed, developing a non-classical, intelligent technique to safeguarding against Ransomware is of significant importance. This paper introduces a new methodology for the detection of Ransomware that is depending on an evolutionary-based machine learning approach. The binary particle swarm optimization algorithm is utilized for tuning the hyperparameters of the classification algorithm, as well as performing feature selection. The support vector machines (SVM) algorithm is used alongside the synthetic minority oversampling technique (SMOTE) for classification. The utilized dataset is collected from various sources, which consists of 10,153 Android applications, where 500 of them are Ransomware. The performance of the proposed approach SMOTE- $t$ BPSO-SVM achieved merits over traditional machine learning algorithms by having the highest scores in terms of sensitivity, specificity, and g-mean.

/pdf/android-ransomware-detection-based-on-a-hybrid-evolutionary-3wyrda6d6l.pdf

Android Ransomware Detection Based on a Hybrid Evolutionary Approach in the Context of Highly Imbalanced Data

Data pre-processing is critical for handling classification issues in the field of machine learning and model identification. The processing of big data sets increases the computer processing time and space complexity while decreasing classification model precision. As a result, it is necessary to develop an appropriate method for selecting attributes. This article describes a machine learning technique to solve functional selection by safeguarding the selection and mutation operators of genetic algorithms. During population calculations in the training set, the proposed method is adaptable. Furthermore, for various population sizes, the proposed method gives the best possible probability of resolving function selection difficulties during training process. Furthermore, the proposed work is combined with a better classifier in order to detect the different malware categories. The proposed approach is compared and validated with current techniques by using different datasets. In addition to the test results, this research work utilizes the algorithm for solving a real challenge in Android categorization, and the results show that, the proposed approach is superior. Besides, the proposed algorithm provides a better mean and standard deviation value in the optimization process for leveraging model effectiveness at different datasets.

/pdf/design-an-adaptive-hybrid-approach-for-genetic-algorithm-to-4c63167iv0.pdf

Design an Adaptive Hybrid Approach for Genetic Algorithm to Detect Effective Malware Detection in Android Division

Malicious application detection in android — A systematic literature review

This paper introduces and tests a novel machine learning approach to detect Android malware. The proposed approach is composed of Support Vector Machine (SVM) classifier and Harris Hawks Optimization (HHO) algorithm. More specifically, the role of HHO algorithm is to optimize SVM classifier hyperparameters while the SVM performs the classification of malware based on the best-chosen model, as well as producing the optimal solution for weighting the features. The effectiveness of the proposed approach and the ability to increase detection performance are demonstrated by scientific testing using CICMalAnal2017 sampled datasets. We test our method and its robustness on five sampled datasets and achieved the best results in most datasets and measures when compared with other approaches. We also illustrate the ability of the proposed approach to measure the significance of each feature. In addition, we provide deep analysis of possible relationships between weighted features and the type of malware attack. The results show that the proposed approach outperforms the other metaheuristic algorithms and state-of-art classifiers.

An efficient malware detection approach with feature weighting based on Harris Hawks optimization

With the growing popularity of Android devices, it is also more prone to malware attacks. There are many malware scanning tools available for scanning the Android Malware but most of them perform static analysis and also require a lot of resources and manual overhead. By using Machine Learning Classifiers, this study aims to improve detecting Android Malware. In this paper, analysis is done on different Android Malware Detection Techniques with different Machine Learning Classifiers. This paper also discusses its strengths and weaknesses with their future scope. The conclusion of the paper also states that one of the Machine Learning Classifier known as Random Forest has the greatest accuracy compared to SVM and Naive Bayes. Also, Random Forest, SVM, Naive Bayes classifiers are highly used for performance evaluation.

Machine Learning Classifiers for Android Malware Detection

The usage of Smartphones is increasing very fast. All the private and confidential information is stored in smartphones. The popularity of Android is also increased massively. Android offers a large number of applications free of cost to be downloaded and used. Statistics revealed that Android phones are more vulnerable to malware. This paper analyses different kinds of malware, their detection techniques with pros and cons and their future scope.

A Survey on Android Malware and their Detection Techniques

Analysis of Android Malware Scanning Tools

For Malware Detection Machine Learning methods are applied extensively in ascertaining if the given APK file is malware or not. Machine learning methods are found to be less time consuming and less resource consuming compared to non-machine learning-based techniques. We have focused on Machine Learning methods for detecting unknown malware. For detecting the malware a researcher needs to create a dataset of its own. Our dataset generation process includes Android File Collection, Decompilation, and Feature Mining phases. We have already discussed the Android File Collection phase in our previous paper [1]. We have collected 15508 Malware files and 4000 Benign Files using Android File Collection. Android Files contains unstructured data in the form of text and XML files which are complex to process and store. Here our goal is to perform the decompilation of these collected Android files such that we get all the resources as well as the source code in a single instance. We aim to handle the big data in terms of Android Files and process them properly performing the Decompilation. In this paper, we have proposed an available automated solution for decompiling the files that also solves the complexity of handling and processing the big data. We have also discussed our

/pdf/unstructured-data-collection-from-apk-files-for-malware-11e174mpxl.pdf

Unstructured Data Collection from APK files for Malware Detection

With the boom of malware, the area of malware detection and the use of gadget assist to gain knowledge in research drastically with the aid of researchers. The conventional methods of malware detection are incompetent to detect new and generic malware. In this article, a generic malware detection process is proposed using machine learning named AndroHealthCheck. The malware detection process is divided into four phases, namely android file collection, decompilation, feature mining and machine learning. The overall contributions made in AndroHealthCheck are as follows: (1) designing and implementing a crawler for automating the process of benign files download, (2) collection of unstructured data from the downloaded APK files through the decompilation process, (3) defining a proper mechanism for the feature selection process by performing a static analysis process, (4) designing and implementing a feature mining script for extracting the features from unstructured data collection from APK files, (5) generating a rich homemade data set for machine learning with a huge variety and different flavours of malware files from different families and (6) evaluating the performance of the generated data set by using different types of supervised machine learning classifiers. In this article, the overall architecture and deployment flow of AndroHealthCheck are also discussed.

Prerna Agrawal

Papers

Machine Learning Classifiers for Android Malware Detection

A Survey on Android Malware and their Detection Techniques

Analysis of Android Malware Scanning Tools

Unstructured Data Collection from APK files for Malware Detection

AndroHealthCheck: A Malware Detection System for Android Using Machine Learning