Opcode Analysis for Android Malware Detection using Learning Techniques

Abstract

The Android operating system’s open-source nature and growing popularity have attracted malware developers to target mobile devices. Android malware frequently obtains sensitive data and information, including banking passwords, social media profiles, contacts, SMS, etc. Security researchers developed Android malware de tection methods based on static and dynamic analysis of Android apps. The major ity of these methods, however, are susceptible to false positive and false negative detections. Obfuscated malware can easily circumvent machine learning-based de tection techniques using code encryption and reflection. Therefore, I intend to ad dress the issue of code obscurity in Android malware detection. I utilized Dalvik machine-level opcodes to detect Android malware. Android applications are pack aged in an APK file that contains an AndroidManifest.xml file, dalvik executable code (classes.dex), and other resource files such as images, videos, icons, audio, etc. Malware detection models based on AndroidManifest features can be bypassed by introducing extra permissions and intents. Obfuscated malware has the potential of circumventing API call-based malware detection models. I designed and imple mented an Android malware detection model using instruction-level opcodes ex tracted from dex files. First, we use APKTool to decompress the APK files to obtain classes.dex files. Next, the opcodes are extracted from the dex files. The Android op erating system supports 218 opcodes in total. Furthermore, I generated the sequence of opcodes and applied one-hot encoding to transform the sequences into feature vectors. Deep learning models such as CNN, RNN, and LSTM have proven to be accurate in classifying text and images into various classes. I argued that convert ing the malware classification problem into a text classification problem can detect malware more precisely. Therefore, I constructed the sequence of opcodes and em ploy deep learning to classify any unknown Android app as malicious or benign. I used a dataset of 4,000 malware and benign applications to train and evaluate our deep learning-based detection model. The experimental results indicate that our proposed detection model is immune to code obfuscation and encryption and can detect malware with a 94.82% accuracy.