JDroid: Android malware detection using hybrid opcode feature vector.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Android devices are prime targets for malware due to their widespread use.
• Existing malware detection methods struggle with advanced obfuscation and variant generation techniques.
• Opcodes offer rich semantic information for distinguishing benign from malicious applications.

Purpose of the Study:

• To propose JDroid, a novel tool for detecting Android malware.
• To leverage opcode sequences as features for static analysis-based malware detection.
• To develop an ensemble model that effectively handles obfuscated applications.

Main Methods:

• JDroid treats Dalvik Opcodes and Java ByteCode as features using static analysis.
• An ensemble model in a stacked generalized structure is employed, utilizing hybrid opcode sequences.
• Opcodes are extracted from APK files, converted into binary vectors, and feature selection reduces the dataset to 461 features.

Main Results:

• The proposed approach achieved 98.6% accuracy and 99.6% Area Under the Curve (AUC) in malware detection.
• The method demonstrated effectiveness against obfuscation techniques.
• Performance was evaluated on a diverse dataset of 14,000 applications across multiple benchmark datasets.

Conclusions:

• JDroid offers an efficient and high-performing solution for Android malware detection.
• The opcode-based feature extraction and ensemble model are robust against obfuscation.
• This approach enhances security for end-users by improving malware identification accuracy.