MFDroid: A Stacking Ensemble Learning Framework for Android Malware Detection
As Android is a popular a mobile operating system, Android malware is on the rise, which poses a great threat to user privacy and security. Considering the poor detection effects of the single feature selection algorithm and the low detection efficiency of traditional machine learning methods, we pr...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2022-03-01
|
| Series: | Sensors |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1424-8220/22/7/2597 |
| _version_ | 1797437746284855296 |
|---|---|
| author | Xusheng Wang Linlin Zhang Kai Zhao Xuhui Ding Mingming Yu |
| author_facet | Xusheng Wang Linlin Zhang Kai Zhao Xuhui Ding Mingming Yu |
| author_sort | Xusheng Wang |
| collection | DOAJ |
| description | As Android is a popular a mobile operating system, Android malware is on the rise, which poses a great threat to user privacy and security. Considering the poor detection effects of the single feature selection algorithm and the low detection efficiency of traditional machine learning methods, we propose an Android malware detection framework based on stacking ensemble learning—MFDroid—to identify Android malware. In this paper, we used seven feature selection algorithms to select permissions, API calls, and opcodes, and then merged the results of each feature selection algorithm to obtain a new feature set. Subsequently, we used this to train the base learner, and set the logical regression as a meta-classifier, to learn the implicit information from the output of base learners and obtain the classification results. After the evaluation, the F1-score of MFDroid reached 96.0%. Finally, we analyzed each type of feature to identify the differences between malicious and benign applications. At the end of this paper, we present some general conclusions. In recent years, malicious applications and benign applications have been similar in terms of permission requests. In other words, the model of training, only with permission, can no longer effectively or efficiently distinguish malicious applications from benign applications. |
| first_indexed | 2024-03-09T11:27:05Z |
| format | Article |
| id | doaj.art-ef194686ed614d2583fcf275b4b548be |
| institution | Directory Open Access Journal |
| issn | 1424-8220 |
| language | English |
| last_indexed | 2024-03-09T11:27:05Z |
| publishDate | 2022-03-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Sensors |
| spelling | doaj.art-ef194686ed614d2583fcf275b4b548be2023-12-01T00:01:41ZengMDPI AGSensors1424-82202022-03-01227259710.3390/s22072597MFDroid: A Stacking Ensemble Learning Framework for Android Malware DetectionXusheng Wang0Linlin Zhang1Kai Zhao2Xuhui Ding3Mingming Yu4School of Cyber Science and Engineering, College of Information Science and Engineering, Xinjiang University, Urumqi 830046, ChinaSchool of Software, Xinjiang University, Urumqi 830046, ChinaSchool of Cyber Science and Engineering, College of Information Science and Engineering, Xinjiang University, Urumqi 830046, ChinaSchool of Cyber Science and Engineering, College of Information Science and Engineering, Xinjiang University, Urumqi 830046, ChinaSchool of Software, Xinjiang University, Urumqi 830046, ChinaAs Android is a popular a mobile operating system, Android malware is on the rise, which poses a great threat to user privacy and security. Considering the poor detection effects of the single feature selection algorithm and the low detection efficiency of traditional machine learning methods, we propose an Android malware detection framework based on stacking ensemble learning—MFDroid—to identify Android malware. In this paper, we used seven feature selection algorithms to select permissions, API calls, and opcodes, and then merged the results of each feature selection algorithm to obtain a new feature set. Subsequently, we used this to train the base learner, and set the logical regression as a meta-classifier, to learn the implicit information from the output of base learners and obtain the classification results. After the evaluation, the F1-score of MFDroid reached 96.0%. Finally, we analyzed each type of feature to identify the differences between malicious and benign applications. At the end of this paper, we present some general conclusions. In recent years, malicious applications and benign applications have been similar in terms of permission requests. In other words, the model of training, only with permission, can no longer effectively or efficiently distinguish malicious applications from benign applications.https://www.mdpi.com/1424-8220/22/7/2597Android malwareensemble learningmachine learningstatic analysisfeature selection |
| spellingShingle | Xusheng Wang Linlin Zhang Kai Zhao Xuhui Ding Mingming Yu MFDroid: A Stacking Ensemble Learning Framework for Android Malware Detection Sensors Android malware ensemble learning machine learning static analysis feature selection |
| title | MFDroid: A Stacking Ensemble Learning Framework for Android Malware Detection |
| title_full | MFDroid: A Stacking Ensemble Learning Framework for Android Malware Detection |
| title_fullStr | MFDroid: A Stacking Ensemble Learning Framework for Android Malware Detection |
| title_full_unstemmed | MFDroid: A Stacking Ensemble Learning Framework for Android Malware Detection |
| title_short | MFDroid: A Stacking Ensemble Learning Framework for Android Malware Detection |
| title_sort | mfdroid a stacking ensemble learning framework for android malware detection |
| topic | Android malware ensemble learning machine learning static analysis feature selection |
| url | https://www.mdpi.com/1424-8220/22/7/2597 |
| work_keys_str_mv | AT xushengwang mfdroidastackingensemblelearningframeworkforandroidmalwaredetection AT linlinzhang mfdroidastackingensemblelearningframeworkforandroidmalwaredetection AT kaizhao mfdroidastackingensemblelearningframeworkforandroidmalwaredetection AT xuhuiding mfdroidastackingensemblelearningframeworkforandroidmalwaredetection AT mingmingyu mfdroidastackingensemblelearningframeworkforandroidmalwaredetection |