Machine Learning for Android Scareware Detection

Abstract

With the steady rise in the use of smartphones, specifically android smartphones, there is an ongoing need to build strong Intrusion Detection Systems to protect ourselves from malicious software attacks, especially on Android smartphones. This work focuses on a sub-group of android malware, scareware. The novelty of this work lies in being able to detect the various scareware families individually using a small number of network attributes, determined by a recursive feature elimination process based on information gain. No work has yet been done on analyzing the scareware families individually. Results of this work show that the number of bytes initially sent back and forth, packet size, amount of time between flows and flow duration are the most important attributes that would be needed to classify a scareware attack. Three classifiers, Decision Tree, Naïve Bayes and OneR, were used for classification. The highest average classification accuracy (79.5%) was achieved by the Decision Tree classifier with a minimum of 44 attributes.