Android Malware Detection with Machine Learning

This project implements a binary classification system for Android malware detection using Machine Learning techniques and static features extracted from APK files.

Problem Description

The project addresses a critical cybersecurity problem: automated detection of malicious Android applications. Unlike approaches that rely solely on accuracy, this system prioritizes metrics more relevant to the security context, where the cost of a false negative (failing to detect malware) is significantly high.

Dataset and Methodology

AndroMD Dataset

• Source: AndroMD dataset with benign and malicious applications
• Representation: Static features extracted from APKs
• Format: Binary variables derived from application behavior signals

Analyzed Features

The pipeline converts static APK signals into binary variables, including:

• Communications: SMS, telephony, contacts, IMEI access
• Network and connectivity: Internet, sockets, HTTP/HTTPS, URLs
• Permissions: External storage access, foreground services, overlay
• Reflection and dynamic loading: Dynamic code loading, Java reflection
• Persistence: Boot completed, wake locks, broadcast receivers
• Cryptography: Encryption, Base64 encoding
• Location: GPS, coordinates, WiFi

Evaluated Models

Several classic Machine Learning algorithms were trained and evaluated:

1. Logistic Regression
2. Random Forest
3. Extra Trees
4. Gradient Boosting
5. HistGradientBoosting

Evaluation Metrics

The project evaluates multiple metrics relevant to cybersecurity:

• Precision: Proportion of correct detections
• Recall: Ability to detect malware (critical in security)
• F1-Score: Balance between precision and recall
• F2-Score: Prioritizes recall over precision
• ROC-AUC: Area under the ROC curve
• PR-AUC: Area under the Precision-Recall curve

Special emphasis on malware class recall to minimize false negatives.

Model Results

Best Model: Balanced Random Forest

Test set metrics:

• Malware recall: ~99% (detects most malicious applications)
• Model: random_forest_balanced
• Optimized thresholds:
  • Suspicious threshold: 0.01
  • Malware threshold: 0.18449

Trichotomous Classification System

Instead of traditional binary classification, the system uses three operational categories:

1. benign: The application appears benign
2. suspicious: Suspicious signals requiring manual review
3. malware: Strong signals of malicious behavior

This strategy allows:

• Reducing critical false negatives
• Avoiding automatic classification as benign for doubtful applications
• Prioritizing manual review when necessary

Inference Results (Sample)

Analyzed Applications

• fake-chat.apk: Classified as malware (probability: 0.2033)
• AprCerberus.apk: Classified as malware (probability: 0.1967)
• Yokai_Watch_Go_1.0.3_APKPure.apk: Classified as suspicious (probability: 0.0100)

Detected Evidence Categories

• Telephony/SMS/Identity: IMEI access, SMS, phone state
• Personal data: Contacts, accounts, audio recording
• Network communication: HTTP, sockets, URLs
• Cryptography/Obfuscation: Encryption, Base64
• Dynamic loading/Reflection: Dynamic class loading, reflection
• Persistence: Broadcast receivers, boot completed, wake locks
• Privilege abuse: Sensitive permissions, overlay, accessibility
• Location: GPS, coordinates, WiFi

System Architecture

1. APK Parser: Extracts static features in JSON format
2. Normalization: Maps raw features to model features
3. ML Model: Random Forest trained with AndroMD dataset
4. Threshold system: Trichotomous classification based on probabilities
5. Explainability: Evidence categorization and comprehensible reports

Trade-offs and Security Considerations

• High sensitivity: Prioritizes detecting malware over minimizing false positives
• Security context: The cost of not detecting malware is greater than investigating suspicious applications
• Calibrated thresholds: Balance detection and practical operability
• Interpretability: System explains the reasons for each classification

Limitations

• Results are not absolute truth and require additional validation
• Malware with advanced evasion techniques may not be detected
• Recommended to complement with dynamic analysis and other security tools
• Classification as "benign" does not guarantee an application is completely safe

Project Files

• prevention-android-malware.ipynb: Main notebook with complete implementation
• .gitignore: Configuration to exclude temporary files
• README.md: This documentation

Usage

The notebook is designed to run in Google Colab with access to Google Drive where the following are stored:

• AndroMD dataset
• Trained models
• Sample JSON files
• Inference results

Conclusion

This project demonstrates a practical and security-oriented approach for Android malware detection. The architecture prioritizes detection over absolute precision, recognizing that in cybersecurity it is preferable to investigate suspicious applications rather than allow malware to go undetected.

The trichotomous classification system and calibrated thresholds provide a more useful tool for security professionals than traditional binary classification, enabling more informed and operationally viable decision-making.