An enhanced android malware detection framework with ranked features selection on static analysis /
Rahiwan Nazar Romli,
An enhanced android malware detection framework with ranked features selection on static analysis / Rahiwan Nazar Romli - xii, 131 pages : illustration (some colour) ; 30 cm. + 1 CD-ROM.
Faculty of Computing
Thesis (Doctor of Philosophy) -- Universiti Malaysia Pahang Al Sultan Abdullah - 2025
Include bibliographical reference
Android emerges as the dominant mobile operating system globally. Driven by its high demand and open-source nature, it becomes a prime target for malware. Feature selection in Android malware analysis is a crucial process involving thousands of attributes. Selecting relevant attributes become increasingly challenging due to the need to thoroughly examine the application. Static analysis is one of the approaches considered as simpler and faster because it extracts malware features without executing the application. However, a major problem in static analysis is the selection of irrelevant attributes, which lead to misleading results for learning algorithms, overfitting, reduced generalizability and increased runtime. The study aims to improve the Android malware detection framework by strengthening its static analysis capabilities for optimal feature selection, refining the extracted malware features through an enhanced frequency-based optimization process, and finally validating the performance of the improved framework using real-world Android malware to ensure high detection accuracy and robustness. This study proposes an enhancement to the Android malware detection framework in the feature selection. It started with the automation in both feature extraction and binary feature vector generation. Additionally, the core Android malware detection framework is integrated with Feature Frequency Analysis to rank and filter the significant feature attributes. The enhanced framework is evaluated using 3011 benign applications from various categories in the official Google Play Store and 4995 malware applications from the AndroZoo dataset. Six machine learning algorithms, which are Random Forest, K-Nearest Neighbor (KNN), J48, Naïve Bayes, AdaBoostM1 and Voted Perceptron were tested on the enhanced framework with four different dataset-splitting techniques. Results indicated that the malware detection accuracy is improved with an optimised number of features as compared to the previous studies with 29 features and 95.3% precision. The finding is validated using regression analysis for each algorithm with 50 iterations. Random Forest Algorithm with cross-validation exhibited the highest performance relative to the benchmark studies and other classification methods with 95% accuracy. Consequently, the process of automated feature extraction effectively targets the features without limitations on the file size or quantity. It enhances the computational time with average 0.35s and reliable in identifying the significant features. For the future works, the combination or mapping of these two features, API Call and Permission could potentially lead to improved accuracy and reliability to better results and both could be used to achieve higher accuracy and acquire more reliable comparisons.
THE0010447 (Local)
Faculty of Computing--Dissertations
Universities and colleges--Dissertations
Theses--Dissertations
An enhanced android malware detection framework with ranked features selection on static analysis / Rahiwan Nazar Romli - xii, 131 pages : illustration (some colour) ; 30 cm. + 1 CD-ROM.
Faculty of Computing
Thesis (Doctor of Philosophy) -- Universiti Malaysia Pahang Al Sultan Abdullah - 2025
Include bibliographical reference
Android emerges as the dominant mobile operating system globally. Driven by its high demand and open-source nature, it becomes a prime target for malware. Feature selection in Android malware analysis is a crucial process involving thousands of attributes. Selecting relevant attributes become increasingly challenging due to the need to thoroughly examine the application. Static analysis is one of the approaches considered as simpler and faster because it extracts malware features without executing the application. However, a major problem in static analysis is the selection of irrelevant attributes, which lead to misleading results for learning algorithms, overfitting, reduced generalizability and increased runtime. The study aims to improve the Android malware detection framework by strengthening its static analysis capabilities for optimal feature selection, refining the extracted malware features through an enhanced frequency-based optimization process, and finally validating the performance of the improved framework using real-world Android malware to ensure high detection accuracy and robustness. This study proposes an enhancement to the Android malware detection framework in the feature selection. It started with the automation in both feature extraction and binary feature vector generation. Additionally, the core Android malware detection framework is integrated with Feature Frequency Analysis to rank and filter the significant feature attributes. The enhanced framework is evaluated using 3011 benign applications from various categories in the official Google Play Store and 4995 malware applications from the AndroZoo dataset. Six machine learning algorithms, which are Random Forest, K-Nearest Neighbor (KNN), J48, Naïve Bayes, AdaBoostM1 and Voted Perceptron were tested on the enhanced framework with four different dataset-splitting techniques. Results indicated that the malware detection accuracy is improved with an optimised number of features as compared to the previous studies with 29 features and 95.3% precision. The finding is validated using regression analysis for each algorithm with 50 iterations. Random Forest Algorithm with cross-validation exhibited the highest performance relative to the benchmark studies and other classification methods with 95% accuracy. Consequently, the process of automated feature extraction effectively targets the features without limitations on the file size or quantity. It enhances the computational time with average 0.35s and reliable in identifying the significant features. For the future works, the combination or mapping of these two features, API Call and Permission could potentially lead to improved accuracy and reliability to better results and both could be used to achieve higher accuracy and acquire more reliable comparisons.
THE0010447 (Local)
Faculty of Computing--Dissertations
Universities and colleges--Dissertations
Theses--Dissertations