Convolution neural network with batch normalization and inception-residual modules for Android malware...

Area of Science:

• Cybersecurity
• Machine Learning
• Deep Learning

Background:

• The proliferation of malware necessitates efficient classification methods.
• Deep learning offers advanced capabilities for analyzing large cybersecurity datasets.

Purpose of the Study:

• To propose and evaluate a novel deep learning model, BIR-CNN, for Android malware classification.
• To enhance malware classification accuracy using network traffic features.

Main Methods:

• Developed BIR-CNN by integrating Convolutional Neural Network (CNN) with Batch Normalization and Inception-Residual (BIR) modules.
• Utilized 347-dimensional network traffic features for model training and evaluation.
• Compared BIR-CNN against traditional machine learning algorithms and standard CNN.

Main Results:

• Achieved 99.73% accuracy in binary classification (malware vs. benign).
• Demonstrated high accuracy in multi-class classification: 99.53% for malware category and 94.38% for malware family.
• BIR-CNN outperformed traditional methods and standard CNN in experiments.

Conclusions:

• BIR-CNN is a highly effective method for Android malware classification.
• The proposed model shows particular strength in classifying malware by category and family.
• Deep learning, specifically BIR-CNN, significantly advances Android malware detection capabilities.