Reassessing feature-based Android malware detection in a contemporary context.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Android malware detection relies heavily on machine learning.
• Previous studies explored various feature sets and models.
• The evolving Android landscape necessitates re-evaluation of existing methods.

Purpose of the Study:

• To reimplement and evaluate foundational feature-based machine learning studies for Android malware detection.
• To assess the effectiveness of feature-based approaches in a contemporary environment.
• To compare the performance of static vs. dynamic analysis features and simple vs. complex models.

Main Methods:

• Reimplementation of 18 key studies (2013-2023) on Android malware detection.
• Utilized a balanced dataset of 124,000 applications.
• Evaluated feature sets from static and dynamic analysis, including API calls, opcodes, and network traffic.
• Compared performance of simple and complex machine learning models, including ensembles.

Main Results:

• Feature-based methods achieved over 98% detection accuracy.
• Static analysis features (API calls, opcodes) were highly productive.
• Dynamic analysis features (network traffic) showed moderate benefits.
• Simpler models often outperformed complex ones.
• Ensemble models efficiently combined static and dynamic features.

Conclusions:

• Feature-based machine learning remains a viable and effective strategy for Android malware detection.
• Simple, fast models are competitive with, and sometimes superior to, complex approaches.
• Static analysis features are crucial, with dynamic features offering incremental improvements.