Scribd
Upload
5 views3 pages

Enhanced Android Malware Detection System

The document outlines a two-step machine learning framework for Android malware detection, consisting of binary classification for benign vs. malicious apps and multi-class categorization of malware types, achieving an accuracy of 84.09%. It identifies limitations in the existing system, such as reliance on static features and lack of model fusion techniques, and proposes enhancements including model fusion, multi-view learning, and improved explainability for better performance against evolving malware threats. The proposed system aims to improve accuracy, robustness, and real-time adaptability while maintaining a modular design for incremental learning.

Uploaded by

technologypanda1
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
5 views3 pages

Enhanced Android Malware Detection System

The document outlines a two-step machine learning framework for Android malware detection, consisting of binary classification for benign vs. malicious apps and multi-class categorization of malware types, achieving an accuracy of 84.09%. It identifies limitations in the existing system, such as reliance on static features and lack of model fusion techniques, and proposes enhancements including model fusion, multi-view learning, and improved explainability for better performance against evolving malware threats. The proposed system aims to improve accuracy, robustness, and real-time adaptability while maintaining a modular design for incremental learning.

Uploaded by

technologypanda1
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Existing System Description

The paper presents a two-step machine learning-based framework for Android malware
detection and categorization.

1. Two-Stage ML Pipeline:

Stage 1: Binary classification to detect if an app is benign or malicious.

Stage 2: Multi-class classification to categorize detected malware (e.g.,


adware, banking malware, SMS malware, riskware).

2. Feature Engineering:

Feature selection using Select-from-Model (SFM).

3. Classifiers Used:

Naïve Bayes (NB)

K-Nearest Neighbors (KNN)

Decision Tree (DT)

Random Forest (RF)

4. Dataset:

CICMalDroid 2020 dataset with 11,598 samples.

Includes both static and dynamic features.

5. Performance:

Malware Detection and Categorization Accuracy: 84.09%

Disadvantages of the Existing System

1. Limited Use of Ensemble Diversity:

Uses only individual models (NB, KNN, DT, RF) or simple majority voting—
not advanced fusion techniques.

2. Static Feature Dependency:

Heavily relies on static features; dynamic behavior analysis is limited.


3. No Model Fusion or Hybridization:

Lacks use of model-level fusion (e.g., stacking, blending, weighted ensembles)


to improve robustness.

4. No Real-Time Adaptation:

The system is not adaptive to evolving or zero-day malware threats.

5. Lack of Deep Interpretability Tools:

Although interpretable models are used (like RF, DT), deeper insights like
SHAP or LIME are not integrated.

6. Computational Cost of RF:

Random Forest shows high training time and is computationally heavier than
simpler models.

Proposed System (Using ML Model Fusion Techniques)


The proposed system builds upon the existing framework by incorporating model fusion
techniques (also called ensemble learning strategies beyond majority voting) to enhance
performance and resilience.

Key Enhancements:

1. Model Fusion Techniques:

Use stacking, ensembles combining RF, SVM, Gradient Boost, XGBoost,


etc.

Train a meta-learner on the predictions of base models.

2. Multi-View Learning:

Combine models trained on static and dynamic features separately.

3. Improved Detection of Evolving Malware:

Fusion models adapt better to obfuscation and zero-day threats.

4. Explainability Layer:

Integrate SHAP, LIME, or attention-based interpretability to explain


predictions.
5. Optimized Real-Time Deployment:

Reduce complexity by fusing lightweight models for mobile inference.

Advantages of Proposed System

1. Improved Accuracy and Generalization:

Fusion models reduce individual biases, improving detection and classification


accuracy on unseen malware.

2. Robustness to Obfuscation:

Model diversity helps detect polymorphic and metamorphic malware.

3. Reduced Overfitting:

Combining predictions from diverse learners increases robustness.

4. Scalable and Flexible:

Can switch to faster or lighter models in real-time scenarios while maintaining


accuracy.

5. Modular Design:

Each model/module can be updated independently, supporting incremental


learning.

You might also like