Android malware classification based on mobile security framework

In this paper, a machine learning based technique is proposed to classify android applications in three classes based on the confidence level defined as safe, suspicious and highly suspicious. Thirty six features are extracted and selected from Mobile Security Framework based on penetration testing. A set of experiments has been conducted on the scale of 13,850 android applications which includes 8,782 android applications downloaded from apk-dl.com, 3,960 malware and 1,108 benign applications. In order to compare the accuracy of the classification model, a ground truth of the confidence level is created by using VirusTotal. The proposed method can detect and classify android applications into three confidence levels with 81.80% accuracy. Experiment for binary classification, classify as being malware or benign has yielded 93.63% accuracy. © 2018 International Association of Engineers.