Classification of android malware using its image sections

Abstract

Privacy is a big concern as hackers are stealing data and misusing it by engineering malicious applications. There is a rapid increase in malware attacks like spyware, premium-rate SMS Trojans, botnets, aggressive adware, privilege escalation, and banking trojans which were distributed through the applications present on Google play store as well as unofficial application stores. Malware uses dominant techniques such as packing, encryption, a transformation of code, environment-aware approaches to evade detection. The traditional methods such as static and dynamic analysis of Android malware consume high computation resources and time. Moreover, cybercriminals use automation tools to generate numerous malware variants of the same family. This paper proposes a method to advance the classification of Android malware using visualization techniques. The visualization technique tends to transform Android malware into different image sections. The GIST algorithm is used to extract the features from the image sections. The extracted features are classified using machine learning algorithms such as K-Nearest Neighbors, Support Vector Machines, Random Forests, and Naive Bayes. This study evaluates the classification performance metrics of each classifier against every image file section. Experiment results show that the Android manifest image files have achieved a high accuracy of 92.7% with the SVM classifier.