A Multi-View Android Malware Detection Model Through Multi-Objective Optimization

Over the past few years, several highly accurate Machine Learning (ML) techniques have been proposed for Android malware detection. Unfortunately, proposed schemes are rarely used in production, a situation usually caused by their limited generalization capabilities, leading to low accuracies when deployed. This paper proposes a new multi-view Android malware detection model, implemented in two stages. First, we extract multiple feature sets from an analyzed Android application package. The feature sets provide a complementary Android app behavioral vector for the classification task, enhancing the system's generalization. Secondly, we conduct a multi-objective optimization to select the optimal feature subset from each view for subsequent ensemble-based classification. Our proposal's insight is to proactively select each feature subset that simultaneously improves accuracy and reduces processing requirements in a multi-view setting. Experiments on our new dataset, comprising over 40 thousand Android app samples, demonstrated the feasibility of our proposal. Our scheme can improve true-positive rates by an average of 4.4 while demanding only up to 65% of inference processing costs.