Enhanced Android Malware Detection and Family
Classification, using Conversation-level
Network Traffic Features
Mohammad
Abuthawabeh and *Khaled Mahmoud
King Hussein School of Computing Sciences, Princess
Sumaya University for Technology, Jordan
*This email address is being protected from spambots. You need JavaScript enabled to view it.
Abstract: Signature-based malware detection algorithms are
facing challenges to cope with the massive number of threats in the Android
environment. In this paper, conversation-level network traffic features are
extracted and used in a supervised-based model. This model was used to enhance
the process of Android malware detection, categorization, and family
classification. The model employs the ensemble learning technique in order to
select the most useful features among the extracted features. A real-world
dataset called CICAndMal2017 was used in this paper. The results show that
Extra-trees classifier had achieved the highest weighted accuracy percentage
among the other classifiers by 87.75%, 79.97%, and 66.71%for malware detection,
malware categorization, and malware family classification respectively. A comparison
with another study that uses the same dataset was made. This study has achieved
a significant enhancement in malware family classification and malware
categorization. For malware family classification, the enhancement was 39.71%
for precision and 41.09% for recall. The rate of enhancement for the Android
malware categorization was 30.2% and 31.14% for precision and recall,
respectively.
Keywords: Information Security, Android Malware,
Network Traffic Analysis, Conversation-level Features, and Machine Learning.
Received February 19, 2020; accepted
June 9, 2020