Abstract

The ubiquitous development of mobile devices, especially Android-based operating system, has provided a good environment of malicious software (malware) to steal user data and system integrity. Android is open-source in nature and has a large size of applications, which makes good, timely detection of malware a significant security problem. To overcome this, the paper offers a new and evidence-based model of efficient malware detection based on various machine learning (ML) models. It uses the methodology that targets a static analysis, which employs a set of discriminatory features, including sought dangerous permissions and suspicious API calls as major elements of a comprehensive set of discriminatory features, extracted out of Android Application Packages (APKs). The output of four popular ML classifiers, namely, Random Forest (RF), Support Vector Machine (SVM), K-Nearest Neighbors (KNN), and Naive Bayes (NB) was tested on a big, real-life dataset. The outcome of the experiment proves that the Random Forest classifier performed greatly better than the other classifiers, giving an accuracy of 98.5 and an F1-score of 98.3. This high performance justifies the performance of the chosen static features to draw a line between the benign and malicious applications. The model obtained provides a strong, highly precise, and computationally efficient solution that can be incorporated into real-time security systems to enhance the defensive capability of the Android platform against ever-changing threats.