MFDroid: A Stacking Ensemble Learning Framework for Android Malware Detection.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Android malware poses a significant threat to user privacy and security.
• Traditional machine learning methods and single feature selection algorithms show limitations in detecting Android malware effectively.
• Malicious and benign applications increasingly exhibit similar permission request patterns, hindering traditional detection methods.

Purpose of the Study:

• To propose and evaluate MFDroid, a novel Android malware detection framework utilizing stacking ensemble learning.
• To enhance the accuracy and efficiency of Android malware identification.
• To analyze feature differences between malicious and benign applications.

Main Methods:

• Implemented a stacking ensemble learning framework named MFDroid.
• Employed seven feature selection algorithms to extract permissions, API calls, and opcodes.
• Merged features from multiple algorithms to create a comprehensive feature set.
• Utilized base learners trained on the merged features and a logistic regression meta-classifier for final classification.

Main Results:

• MFDroid achieved a high F1-score of 96.0% in Android malware detection.
• The framework effectively integrated information from diverse feature selection methods.
• Analysis revealed that permission requests alone are insufficient for distinguishing malicious from benign apps.

Conclusions:

• Stacking ensemble learning, as implemented in MFDroid, offers a robust approach to Android malware detection.
• Feature engineering combining permissions, API calls, and opcodes is crucial for accurate detection.
• The study highlights the evolving nature of malware and the need for advanced detection techniques beyond simple permission analysis.