Permission-Based Android Malware Detection

Abstract

Signals based on permissions from the manifest of Android applications serve as a quick and cost-effective means to perform initial screening of potentially harmful apps. In the present paper, we develop a pipeline that relies only on manifest permissions, enhanced with concise engineered summaries (permission counts, grouped permission buckets, and a simple “dangerous permission” score). We compare a set of supervised learning algorithms: Random Forest, XGBoost, Linear Support Vector Machine (calibrated), Bernoulli Naive Bayes, and Logistic Regression. We also implement a three-step feature selection ([variance filter]-> [mutual information ranking]-> [model-based pruning]), then we solve class imbalance problems with controlled oversampling. The best outcomes overall are obtained with tree ensemble models: our random forest strikes a good balance between precision and recall, with an accuracy of 81.6% and an F1 score around 0.859, while XGBoost posts the best ranking metric, a Receiver Operating Characteristic – Area Under the Curve (ROC AUC) of about 0.90. Our error analysis confirms that a large percentage of false positives are benign apps with a lot of privileges, and that the false negatives tend to be sneaky low-permission malware. We provide the components to reproduce the results (the selected feature list, the sanitized feature name map, the trained models and the evaluation scripts) and reflect on how a permission-only filter could be implemented as an early triage in a multi-layered malware detection system.