Android Malware Detection and Categorization Based on Conversation-level Network Traffic Features

Abstract

The number of malware in Android environment is increasing. As a result, the conventional detection algorithms that employ signature detection methods are facing challenges to cope with the huge number of attacks. In this respect, a supervised-based model that can enhance the accuracy and the depth of the malware detection and categorization process using a conversation-level feature is presented. The ensemble learning technique was employed in order to select the most useful features. A comparison between the methods provided in this research and the results of other studies that used the same dataset is given. The results show that Extra-trees classifier had achieved the highest weighted accuracy percentage among the other classifiers by 87.75% for malware detection and 79.97% for malware categorization. Finally, this study has achieved significant enhancement in malware categorization rate by 30.2% for precision and 31.14% recall in comparison with other studies that used the same dataset.