Heterogeneous feature space for Android malware detection

Abstract

In this paper, a broad static analysis system to classify the android malware application is been proposed. The features like hardware components, permissions, application components, filtered intents, opcodes and number of smali files per application are used to generate the vector space model. Significant features are selected using Entropy based Category Coverage Difference criterion. The performance of the system was evaluated using classifiers like SVM, Rotation Forest and Random Forest. An accuracy of 98.14% with F-measure 0.976 was obtained for the Meta feature space model containing malware features using Random Forest classifier. An overall analysis concluded that the malware model outperforms benign model.