Machine Learning Approach for Improving Android Malware Family Classification Using Hybrid Feature Optimisation

The Android operating system (OS) is among the most widely used OSs in the market because it is very convenient to use and provides a variety of features to users. Due to the rapid growth of Android devices, malware on these devices is also increasing, and manual approaches are unable to detect it. Various techniques are being developed to address the issue of Android malware. Most of these techniques to detect and classify Android malware use the signature-based method, but with this method, unknown malware is not detectable. Today, new malware is distinguished by sophisticated and intricate obfuscation tactics. Thus, static malware analysis is not able to detect it. However, the dynamic method is more effective in comparison with static because it can detect evasion techniques during the runtime, but this method is time and resource-consuming and fails to execute all the execution paths. For these issues, a hybrid approach is introduced, in which features of static and dynamic malware analysis are combined. To improve the accuracy and effectiveness of malware family classification, three optimisation algorithms, i.e. genetic algorithm (GA), particle swarm optimisation, and bat algorithm (BA) are used. These optimisation algorithms select the most pertinent and discriminative set of features. The proposed method used the finest features of static and dynamic malware analysis for building and training the classification algorithms. Five machine learning (ML) algorithms, namely random forest, support vector machine, [Formula: see text]-nearest neighbour, naïve Bayes, and decision tree, are used to train the model with an original and optimised set of features. From experimental results, it is observed that random forest with the BA using hybrid malware analysis achieves 91.11% accuracy, which is the highest among all.