SYNTHETIC MINORITY OVER-SAMPLING TECHNIQUE AND RESAMPLE APPROACH FOR ANDROID MALWARE DETECTION USING TREE-BASED CLASSIFIERS

ABSTRACT

As a result of malicious actions such as harvesting user data and sending spam emails, phone calls, and so on, malware for mobile devices is getting more sophisticated, posing a serious challenge. When it comes to malware detection, a heuristic approach is needed. This research proposes a novel approach to detect malware in android system. Synthetic Minority Over-sampling Technique (SMOTE) and resample techniques were used to select features and Tree Classifiers were used for the classification. The feature selection techniques were tested with the various tree classifiers which are Random Tree, Random Forest, J48, J48 graft, Forest PA and Logistic Model Tree (LMT) to find the best functioning algorithm. Tests and training were carried out using the Waikato Environment for Knowledge Analysis (WEKA). A number of performance metrics were measured, including correctly classified instances (accuracy), incorrectly classified instances (incorrect classification), Kappa statistic, mean absolute error (MAE), root mean square error (RMSE), false positive rate (false positive rate), precision and receiver operating curve (ROC). Observations revealed that using Random Forest as the classifier and SMOTE and resampling techniques for feature selection performed best with 99.6% accuracy with 80% split. The implication of this is that our proposed model SMOTE and Resampling for feature Selection and Random Forest for detection can be efficiently used to spot malwares in android application.

Keywords: SMOTE, Resample, Tree-based Classifier, Android, Android Malware, Performance Metric