Mobile malware detection using word cloud with deep learning and root exploit analysis / Che Akmal Bin Che Yahaya

Faculty of Computing

Thesis (Doctor of Philosophy) -- Universiti Malaysia Pahang Al Sultan Abdullah - 2025

Include bibliographical reference

Mobile malware continues to pose a critical threat by executing malicious activities such as stealing sensitive information, conducting unauthorized data collection, and running covert processes on infected devices. Ordinary malware families, including root exploits, botnets, trojans, and ransomware, constantly evolve as attackers refine their techniques to evade detection. Existing detection strategies rely on dynamic and static analysis. Dynamic analysis, which observes malware during execution, can detect complex behaviors but demands extensive computational resources and monitoring time. Static analysis, which examines code structure without execution, is more resource-efficient but faces limitations in selecting optimal features, especially when malicious traits emerge only through specific co-occurrence patterns of tokens. This feature selection challenge is exacerbated by the large and constantly changing set of potential attributes, including permissions, system calls, and intents. Moreover, automated feature selection picks clues one at a time; consequently, it overlooks crucial interactions and discards informative cross-feature patterns, yielding models that appear well-performing in tests yet fail to generalize to novel or obfuscated applications. To address these limitations, this study introduces a novel approach that leverages word cloud visualization as an intermediate feature representation for static malware detection. By converting complete source code into word cloud images, the method captures both frequency and co-occurrence cues of critical code tokens in a single visual space, enabling a deeper semantic representation without the need for manually defining feature categories or quantities. These word cloud images are then processed by a Convolutional Neural Network (CNN), allowing automatic feature extraction and pattern recognition, thus overcoming the traditional bottleneck of manual feature engineering. The proposed model was evaluated using a balanced dataset comprising 25,000 malware samples from the Android Malware Dataset (AMD) and 25,000 benign samples. Experimental results demonstrate that the method achieved an accuracy of 93.02% in predicting previously unseen malware variants, highlighting its ability to generalize detection to novel threats. The integration of word cloud visualization with CNN not only enhances detection accuracy but also provides a scalable, category-independent framework for combating the evolving landscape of mobile malware. Word cloud, Android apps, Static analysis, Mobile malware Detection system, Deep learning