Fuzzy analytical hierarchy process based risk assessment for malware detection in android mobile system / Juliza Binti Mohamad Arif

Faculty of Computing

Thesis (Master of Science) -- Universiti Malaysia Pahang – 2022

Includes bibliographical references

Android mobile devices record a large number of users and are accessible via open source. The openness of the Android mobile devices is extremely vulnerable to malware attacks. Even though various antivirus or security devices are installed in the mobile device, users are still exposed to malware attacks. Attackers are constantly making changes according to current trends. Previous solutions are insufficient to significantly reduce attacks, as newer malware is skillful at finding Android vulnerabilities. Google Play's malware detection method is insufficient to scan third-party applications that may violate user confidentiality. Android security mechanism, which is based on permissions, is also insufficient, exposing mobile users to non-secure environments and making them susceptible to external attacks. Mobile users typically disregard lengthy lists of permissions due to their incomprehensibility. Therefore, Android applications need to be analysed to ensure that benign or malware applications can be distinguished as well as the risk of each permission request being known. In mobile malware detection, there are two types of malware analysis, which include static and dynamic analysis. This study leverages permission features and emphasises static analysis techniques. Static analysis examines programs without execution of the application and notifies its behaviour. The advantages of static analysis are fast detection, minimal resource requirements, and high accuracy in detecting malware. The goal of this research is to propose a fuzzy analytical hierarchy process based risk assessment for malware detection in Android mobile systems. Risk assessment is applied to educate mobile users about the dangers associated with granting permission requests. The number of permission requests by each Android application is taken into account in assessing the risk of malware attacks. The three optimization techniques such as Particle Swarm Optimisation (PSO), Information Gain and Evolutionary Computational are applied to select the best permission features. Each permission was divided into groups, and fuzzy pairwise comparison scale was applied to determine each permission group's weightage. The assessment process applied 10,000 datasets retrieved from Drebin and Androzoo. In addition, the findings show the accuracy rate achieved was 90.54% for malware detection. Risk assessment effectively categorised the Android application into four distinct risk levels (very low, low, medium, and high). According to risk analysis, the malware families with the high risk level are Plankton, ExploitLinuxLotoor, and SMSreg. Properties and message permission group indicate the highest weightage with value 0.274 and 0.273, respectively. The study's excellent findings confirmed that permission features are important for evaluating malware as well as risk analysis on an Android application. Risk assessment able to discover risk exposure to Android applications and provide knowledge to users by providing risk levels to minimize the attacks.