Multi-layer Android Malware Detection Method Based On Neural Network And Classifiers Fusion

With the development of technology,the rate of mobile network coverage and transmission continue to increase,and mobile intelligent terminal equipment has become one of the necessary tools in people's life and work.At the same time,due to the continuous decline of malware development threshold and the openness of Android system,there are a large number of Android malwares and their variants in the market.In order to detect malware more efficiently and conveniently,we propose a novel multi-layer Android malware detection method based on the neural network and binary classifiers fusion.This method introduces a multi-layer perceptron(MLP)in the feature extraction layer.The feature extraction process is divided into two parts by MLP.Firstly,the xml features of all applications are extracted,and the ternary classification,which is malicious,benign,category uncertain is performed by MLP.Then the Smali features extraction is added to the identified “category uncertain” applications,and the feature vectors of these applications are passed to the subsequent detection layer for further classification.Then,in the classification performance optimization layer,we design four sorting algorithms for the second-layer classifiers,which are ranking algorithm based on category accuracy harmonic mean(RHM),ranking algorithm based on category accuracy difference(RDB),ranking algorithm based on weighted aggregation of category accuracy(RWA),and ranking algorithm based on the weighted aggregation of category accuracy harmonic mean and difference(RWHD).Multiple comparison experiments were performed by algorithms combination.The results show that RDB and RWA combination is the most optimal.And we use it to build the final fusion classification model.In the experimental phase,we used a data set consisting of 23,299 applications,which including 11,352 malware and 11,947 benign applications.After several comparison experiments on the dataset,we verify that the classification performance and robustness of the proposed multi-layer classification fusion model is better than single classifier and majority voting fusion classification method.Moreover,due to the presence of MLP,the time of features extraction of experimental samples is significantly lower than other detection methods.