MalDozer: Automatic framework for android malware detection using deep learning

TLDR

Android OS’s rapid adoption, especially in IoT, has made it a prime target for malicious apps, creating a pressing need for sophisticated, automatic malware detection. This work introduces MalDozer, an automatic framework that detects Android malware and attributes it to families using deep‑learning sequence classification. MalDozer extracts and learns malicious and benign patterns directly from raw API‑call sequences, and can be deployed on servers, mobile devices, or IoT platforms, as demonstrated on datasets of up to 33 K malware and 38 K benign apps. Across all tested datasets, MalDozer achieves an F1‑score of 96–99 % with a false‑positive rate of 0.06–2 %.

Abstract

Android OS experiences a blazing popularity since the last few years. This predominant platform has established itself not only in the mobile world but also in the Internet of Things (IoT) devices. This popularity, however, comes at the expense of security, as it has become a tempting target of malicious apps. Hence, there is an increasing need for sophisticated, automatic, and portable malware detection solutions. In this paper, we propose MalDozer, an automatic Android malware detection and family attribution framework that relies on sequences classification using deep learning techniques. Starting from the raw sequence of the app's API method calls, MalDozer automatically extracts and learns the malicious and the benign patterns from the actual samples to detect Android malware. MalDozer can serve as a ubiquitous malware detection system that is not only deployed on servers, but also on mobile and even IoT devices. We evaluate MalDozer on multiple Android malware datasets ranging from 1 K to 33 K malware apps, and 38 K benign apps. The results show that MalDozer can correctly detect malware and attribute them to their actual families with an F1-Score of 96%–99% and a false positive rate of 0.06%–2%, under all tested datasets and settings.