PermDroid - 使用特征选择方法与机器学习技术的Android恶意软件检测框架

Aug 5, 2026

Upload by Ivy

Developing an Android malware detection framework that reliably identifies malware in real-world applications remains challenging due to weaknesses in Android’s permission model. Prior work often relies on using all extracted features, which can overburden models and reduce overall effectiveness. This paper proposes a two-stage feature selection framework to select discriminative features using t-test and univariate logistic regression, then validates them via stepwise multivariate linear regression and correlation analysis. The selected features feed ensemble methods and a neural network, outperforming models built on all features.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages38

Reading Time1 h 36 min

AccessFree to download

Abstract

Problem Background

Proposed Feature Selection Framework

Model Development and Evaluation

[www. nature.com/scientificreports](www. nature.com/scientificreports) OPEN PermDroid a framework developed using proposed feature selection approach and machine learning techniques for Android malware detection Arvind Mahindru1*, HimaniArora2, Abhinav Kumar3, Sachin Kumar Gupta4,5*, Shubham Mahajan6*, Seifedine Kadry6,7,8,9 & Jungeun Kim10* The challenge of developing an Android malware detection framework that can identify malware in real-world apps is difficult for academicians and researchers. The vulnerability lies in the permission model of Android. Therefore, it has attracted the attention of various researchers to develop an Android malware detection model using permission or a set of permissions. Academicians and researchers have used all extracted features in previous studies, resulting in overburdening while creating malware detection models. But, the effectiveness of the machine learning model depends on the relevant features, which help in reducing the value of misclassification errors and have excellent discriminative power. A feature selection framework is proposed in this research paper that helps in selecting the relevant features. In the first stage of the proposed framework, t-test, and univariate logistic regression are implemented on our collected feature data set to classify their capacity for detecting malware. Multivariate linear regression stepwise forward selection and correlation analysis are implemented in the second stage to evaluate the correctness of the features selected in the first stage. Furthermore, the resulting features are used as input in the development of malware detection models using three ensemble methods and a neural network with six different machine-learning algorithms. The developed models’ performance is compared using two performance parameters: F-measure and Accuracy. The experiment is performed by using half a million different Android apps. The empirical findings reveal that malware detection model developed using features selected by implementing proposed feature selection framework achieved higher detection rate as compared to the model developed using all extracted features data set. Further, when compared to previously developed frameworks or methodologies, the experimental results indicates that model developed in this study achieved an accuracy of 98.8% . Keywords Android apps, API calls, Neural network, Deep learning, Feature selection, Intrusion detection, Permissions model 1Department of Computer Science and applications, D.A.V. University, Sarmastpur, Jalandhar 144012, India. 2Department of Mathematics, Guru Nanak Dev University, Amritsar, India. 3Department of Nuclear and Renewable Energy, Ural Federal University Named after the First President of Russia Boris Yeltsin, Ekaterinburg, Russia 620002. 4Department of Electronics and Communication Engineering, Central University of Jammu, Jammu 181143, UT of J&K, India. 5School of Electronics and Communication Engineering, Shri Mata Vaishno Devi University, Katra 182320, UT of J&K, India. 6Department of Applied Data Science, Noroff University College, Kristiansand, Norway. 7Artificial Intelligence Research Center (AIRC), Ajman University, Ajman, 346, United Arab Emirates. 8MEU Research Unit, Middle East University, Amman 11831, Jordan. 9Applied Science Research Center, Applied Science Private University, Amman, Jordan. 10Department of Software, Department of Computer Science and Engineering, Kongju National University, Cheonan 31080, Korea.* email: [er.arvindmahindru@gmail.com](er.arvindmahindru@gmail.com); sachin.ece@cujammu.ac.in; [mahajanshubham2232579@gmail.com](mahajanshubham2232579@gmail.com); [jekim@kongju.ac.kr](jekim@kongju.ac.kr) [www. nature.com/scientificreports/](www. nature.com/scientificreports/) Now-a-days, smartphones can do the same work as the computer has been doing. By the end of 2023, there will be around 6.64 billion smartphone users worldwide ([https://www.bankmycell.com/blog/h

FAQs

Why is Android malware detection difficult in real-world apps?

Android’s permission model creates vulnerabilities that make it hard to reliably distinguish malicious behavior. Malware can be injected into app stores, leading to real-user risk.

How does the proposed framework select relevant features?

It uses t-test and univariate logistic regression in the first stage to assess feature capacity for malware detection. The second stage applies stepwise multivariate linear regression with correlation analysis to verify correctness of the selected features.

How are the final detection models evaluated?

The framework trains malware detection models using the selected features with three ensemble methods and a neural network. Performance is compared using F-measure and Accuracy, achieving an accuracy of 98.8% on an experimental dataset of half a million Android apps.

Aug 5, 2026

Upload by Ivy