Title: SHA-AMD: sample-efficient hyper-tuned approach for detection and identification of Android malware family and category

Authors: Aamir Rasool; Abdul Rehman Javed; Zunera Jalil

Addresses: Institute of Avionics and Aeronautics, Air University, Islamabad, Pakistan ' Department of Cyber Security, Air University, Islamabad, Pakistan ' Department of Cyber Security, National Center for Cyber Security, Air University, Islamabad, Pakistan

Abstract: Smart cities offer smart security solutions against cyber-attacks to the communities. Android-based smart devices have emerged as the best-selling artefact in the market. Due to this popularity and all-embracing usage, the Android operating system (OS) has become a lucrative target for attackers. In this paper, we propose an approach for the detection and classification of Android malware. We utilise ensemble machine learning (EML) comprising of support vector machines (SVM), decision tree (DT), K-nearest neighbours (KNN), and long short-term memory (LSTM) deep learning model for malware detection and classification in combination with feature selection to augment model performance. We present a comparison of EML, LSTM, and an ensemble of deep learning models: LSTM, gated recurrent unit (GRU), and recurrent neural network (RNN). Experimental results demonstrate better performance than state-of-the-art techniques using LSTM for binary classification at static layers and EML for category and family classification at dynamic layers.

Keywords: smart cities; smart security; Android malware; family; category; deep learning; machine learning; cyber-attack.

DOI: 10.1504/IJAHUC.2021.119097

International Journal of Ad Hoc and Ubiquitous Computing, 2021 Vol.38 No.1/2/3, pp.172 - 183

Received: 04 Feb 2021
Accepted: 11 Mar 2021
Published online: 22 Nov 2021 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article