Performance Analysis of Machine Learning Methods with Class Imbalance Problem in Android Malware Detection

International Journal of Interactive Mobile Technologies

article

Abimbola Ganiyat Akintola¹  Abdullateef Balogun²  Hammed Adeleke Mojeed¹  Fatima Usman-Hamza¹  Shakirat Aderonke Salihu¹  Kayode Sakariyau Adewole¹  Ghaniyyat Bolanale Balogun¹  Peter Ogirima Sadiku¹ 

[1] Department of Computer Science, University of Ilorin;University of Ilorin;Institute of Technical Informatics and Telecommunication, Gdansk University of Technology

关键词: Android;    Malware detection;    Machine learning;    Data sampling;   

DOI  :  10.3991/ijim.v16i10.29687

学科分类：社会科学、人文和艺术（综合）

来源: International Association of Online Engineering

【 摘 要 】

Due to the exponential rise of mobile technology, a slew of new mobile security concerns has surfaced recently. To address the hazards connected with malware, many approaches have been developed. Signature-based detection is the most widely used approach for detecting Android malware. This approach has the disadvantage of being unable to identify unknown malware. As a result of this issue, machine learning (ML) for identifying and categorising malware apps was created. Conventional ML methods are concerned with increasing classification accuracy. However, the standard classification method performs poorly in recognising malware applications due to the unbalanced real-world datasets. In this study, an empirical analysis of the detection performance of ML methods in the presence of class imbalance is conducted. Specifically, eleven (11) ML methods with diverse computational complexities were investigated. Also, a synthetic minority oversampling technique (SMOTE) and random undersampling (RUS) are deployed to address the class imbalance in the Android malware datasets. The experimented ML methods are tested using the Malgenome and Drebin Android malware datasets that contain features gathered from both static and dynamic malware approaches. According to the experimental findings, the performance of each experimented ML method varies across the datasets. Moreover, the presence of class imbalance deteriorated the performance of the ML methods as their performances were amplified with the deployment of data sampling methods (SMOTE and RUS) used to alleviate the class imbalance problem. Besides, ML models with SMOTE technique are superior to other experimented methods. It is therefore recommended to address the inherent class imbalance problem in Android Malware detection.

【 授权许可】

CC BY