A Two-Layered Malware Detection Model Based on Permission for Android

Abstract

Malware often request extra permission to obtain users' privacy data and achieve their bad purpose. In order to detect Android malware effectively, an Android malware detection model is designed based on the declared permission. This detection model consists of two layers. The first layer detection uses an improved random forest algorithm to analysis. The second layer detection uses sensitive permission rules matching to analyze the fuzzy sets generated by the first layer detection. Finally, a series of evaluation methods were used to evaluate this detection mechanism and verify the effectiveness of the mechanism. The result shows that the sensitive permission rules have a certain improvement in the detection accuracy for Android malware.