Future Generation Computer Systems 115 (2021) 844–856

Contents lists available at ScienceDirect

Future Generation Computer Systems

journal homepage: www.elsevier.com/locate/fgcs

DeepAMD: Detection and identification of Android malware using

high-efficient Deep Artificial Neural Network
∗
Syed Ibrahim Imtiaz a , Saif ur Rehman b , Abdul Rehman Javed c , , Zunera Jalil c , Xuan Liu d ,
Waleed S. Alnumay e
a
Institute of Avionics and Aeronautics, PAF Complex, E-9, Air University, Islamabad, Pakistan
b
Faculty of Computing and AI, PAF Complex, E-9, Air University, Islamabad, Pakistan
c
Department of CyberSecurity, PAF Complex, E-9, Air University, Islamabad, Pakistan
d
School of Information Engineering, Yangzhou University, China
e
Computer Science Department, King Saud University, Riyadh, Saudi Arabia

article info a b s t r a c t

Article history: Android smartphones are being utilized by a vast majority of users for everyday planning, data
Received 20 April 2020 exchanges, correspondences, social interaction, business execution, bank transactions, and almost
Received in revised form 28 September 2020 in each walk of everyday lives. With the expansion of human reliance on smartphone technology,
Accepted 11 October 2020
cyberattacks against these devices have surged exponentially. Smartphone applications use permissions
Available online 19 October 2020
to utilize various functionalities of the smartphone that can be maneuvered to launch an attack or
Keywords: inject malware by hackers. Existing studies present various approaches to detect Android malware
Android malware but lack early detection and identification. Accordingly, there is a dire need to craft an efficient
Malware family mechanism for malicious applications’ detection before they exploit the data. In this paper, a novel
Malware category approach DeepAMD to defend against real-world Android malware using deep Artificial Neural Network
API calls
(ANN) has been adopted including an efficiency comparison of DeepAMD with conventional machine
Deep learning
learning classifiers and state-of-the-art studies based on performance measures such as accuracy, recall,
Machine learning
Cyberattack f-score, and precision. As per the experimental analysis, DeepAMD outperforms other approaches in
Security detecting and identifying malware attacks on both Static as well as Dynamic layers. On the Static layer,
DeepAMD achieves the highest accuracy of 93.4% for malware classification, 92.5% for malware category
classification, and 90% for malware family classification. On the Dynamic layer, DeepAMD achieves the
highest accuracy of 80.3% for malware category classification and 59% for malware family classification
in comparison with the state-of-the-art techniques.
© 2020 Elsevier B.V. All rights reserved.

1. Introduction data is inaccessible due to privacy protections and bandwidth

limitations.
Commercialization of computing services, software, as well as Android smartphones are widely used because of its flexible
hardware and the emergence of IoT in the last decade has made operating system with many user-friendly features. One of the
it possible to access billions of smart devices within no time. reasons for Android to be one of the most popular operating
The world computing industry has seen a massive increase in systems is that it is being supported by Google as open-source
the number of personal computers, laptops, smartphones, tablets, software. Android operating system (OS) can run applications
and smartwatches during the last four years [1–3]. According to a developed in Java language. These codes work only if the target
recent survey [4], a typical user buys a new smartphone every 18– OS is Android [6,7]. Android application is a compressed file
20 months. According to the Groupe Speciale Mobile Association that comprises of different libraries and records. The Android
(GSMA) [5] mobile economy report 2020, there are currently 5.2 Manifest file contains the meta-information about the applica-
billion mobile users and 12 billion IoT devices being used. These
tion (i.e., name of the bundle, permissions required, meanings
devices are creating enormous bytes of data and most of this
of segments for example services, activities, content providers,
broadcast receivers, libraries, and rendition support). Android OS
∗ Corresponding author.
contains a directory named ‘‘res’’ that stores pictures, symbols,
E-mail addresses: [email protected] (S.I. Imtiaz),
[email protected] (S.u. Rehman), [email protected]
and User Interface (UI) formats. Other library resources contain
(A.R. Javed), [email protected] (Z. Jalil), [email protected] (X. Liu), assets that are non-aggregated [8]. Cyberattacks are also evolving
[email protected] (W.S. Alnumay). with the advancements in computing technology [9,10]. These

https://doi.org/10.1016/j.future.2020.10.008
0167-739X/© 2020 Elsevier B.V. All rights reserved.
S.I. Imtiaz, S.u. Rehman, A.R. Javed et al. Future Generation Computer Systems 115 (2021) 844–856

attacks encompass the violation of Android device security by 2. Related work

novel malware attacks that are hard to detect and is challenging.
Android OS contains a module to authorize the permissions Nowadays, smartphones are being used by a huge majority of
required by the Android applications and grant permissions if people in every field of life. A recent study shows the growth
no breach in security policy occurs. Android authorizations are of smartphone users from 3.2 billion in 2019 to 3.5 billion in
ordered into four distinct degrees of assurance which are further 2020 [26]. Smartphones are not only used to make calls but
discussed in [8,11]. Furthermore, the dataset consists of four dis- also store user information in the form of text, images, videos,
tinct malware to be classified as: adware [12], ransomware [13], documents, etc. Android smartphones are trending and contain
scareware [14], and SMS malware [15]. Due to the evolving and confidential data that these are a lucrative target for many cy-
expanding nature of malware, various detection and prevention bercriminals who try to breach their security and hack user’s
approaches are being proposed. Researchers have reported two data [27]. Malware existence on smart devices is increasing and
different approaches to detect malware. First is Static analysis,
is a big threat requiring the researcher’s attention. In the Android
in which applications are checked without their execution and
framework, security breach occurs mostly by the installation of
the second is Dynamic analysis, in which malware behavior is
third-party applications. Android devices have been analyzed to
analyzed in an isolated environment after execution [16].
improve security, including presentation judgments, discovery,
Despite the role of modern technologies in improving quality
of life and making the cyber world a better place, the surface and investigation of malware.
of cyber-threats and anticipated cyberattacks are at a new level Authors in [28] evaluated the accuracy of detecting
and evolving at a disturbing rate [8,17]. Besides, new attacks are ransomware with machine learning algorithms from the CICAn-
rising every day having the potential to violate the security of the dMal2017 dataset of 10 ransomware families. CICAndMal2017
smartphone. The security policy can be violated in different ways dataset contains benign and malware applications [29]. CICAn-
according to the operating system being used by the smartphone. dMal2017 has 4 different categories of malware: Adware, Ran-
In this paper, we focused on Android OS and the associated somware, Scareware, and SMS Malware. This dataset also con-
emerging attacks that can violate its security. It is a challenging tains more than 80 network traffic features. In [30], the CICAnd-
task since millions of smartphones are currently running Android Mal2017 dataset was used by the researchers and they chose one
OS, therefore, it is the need of time to provide services to the users PCAP file for each malware family randomly. Next, they extracted
along with security and privacy. features from PCAP files in two stages. First, network flows
Some of the existing studies [18–23] used API calls and per- were separated using a Java program that applies a flow-level
missions as a feature to check if malware exists in the smartphone technique. Then 15 features were extracted and then used three
application. They report that Static analysis is not enough to supervised machine-learning classifiers Random forest, K-Nearest
detect malware from obfuscated applications, therefore, Dynamic Neighbors, and Decision Tree were used to classify applications as
analysis is also required. Some studies used deep learning to malware, benign, adware, ransomware, or scareware.
check if malware exists in the smartphone application [24,25]. CICIDS2017 dataset was compiled using data captured from
But they have certain limitations (i.e., low malware detection and 3/07/2017 to 7/07/2017 [31]. The authors in [32] proposed the CI-
identification rate, Dynamic analysis, low detection and identifi- CID2017 dataset because it worked on the web, Denial of Service
cation rate of family and category detection, and identification of Attack (Dos), Distributed Denial of Service (DDoS), Infiltration,
malware). Thus, this paper focuses on addressing all these limi- Brute Force Secure Shell (SSH), and File Transfer Protocol (FTP)
tations by providing a highly efficient approach for the detection
attacks. CICFlowMeter analyzed network traffic that was gener-
and identification of new types of malware.
ated and extracted eighty network flow features. On the bases
In this paper, we make the following contributions:
of FTP and HyperText Transfer Protocol (HTTPS), the CICIDS2017
1. Propose DeepAMD, an effective systematic and functional dataset extracted the basics of behavior of twenty-five users. The
approach to detect and identify Android malware, malware authors in [33] evaluated the performance metrics for various
category, and family on both Static and Dynamic layers. detectors by utilizing the CICAndMal2017 dataset. Authors in [34]
2. Evaluate the effectiveness of DeepAMD using the Deep mentioned a chance of ransomware in the system’s API packages
learning approach and conventional machine learning clas- of android mobile and proposed ‘‘R-PackDroid’’ that grouped apps
sifiers. of ransomware with high accuracy. The existing work done can be
3. Present a comparative analysis of conventional machine classified into three categories: (1) Application program interface
learning techniques: Decision tree (J48), Naive Bayesian (API) Call Based Android Malware Detection, (2) Intent-Based
(NB), Sequential Minimal Optimization (SMO) and Multi- Android Malware Detection, and (3) Permission-Based Android
layer Perceptron (MLP) with Deep Artificial Neural Network Malware Detection.
(Deep ANN).
4. DeepAMD effectively enhances detection performance and 2.1. API call based android malware detection
achieve promising accuracy on both Static as well as Dy-
namic layers in comparison with conventional machine The authors in [20] utilized API calls as dataset features to
learning techniques and state-of-the-art studies. check if android applications are malicious or not. They detected
obfuscated applications. This research was immediately trailed by
The rest of the paper is organized as follows. Section 2 briefly
covers the technical background and recent advancements on Chan and Song [35], where they introduced a feature list of 19 API
Android malware detection and identification. Section 3 provides calls and permission to recognize malware.
an extensive discussion on the selected dataset and preliminaries Authors in [22] used the CICAndMal2017 dataset that consists
necessary for comprehending the background of Android mal- of Static features of permissions, intents, as well as Dynamic
ware detection and identification. Section 4 presents an overview features of API calls. They enhanced the family classification
of our proposed approach DeepAMD for Android malware de- performance of malware. Afterward, more ways to merge fea-
tection and identification, Android permission, intent, and API ture sets were introduced. Droidmat [36] introduced a malware
call features. The experimental setup and results are articulated analyzer that used Static permissions, intents, and API calls to
in Section 5. Section 6 presents comparative analysis. In Sec- classify android applications. They utilized k-means to improve
tion 7, we discussed results and Section 8 concludes along with their malware ability and utilized k-Nearest Neighbor check if
directions for future work. applications are malicious or benign. A few researchers likewise
845
S.I. Imtiaz, S.u. Rehman, A.R. Javed et al. Future Generation Computer Systems 115 (2021) 844–856

utilized API sequences, dependency graphs, and bundles. Then, Several studies provided an overview of the evolution of dif-
the DroidSIFT [37] malware classifier dependent on the weighted ferent malware detection and identification techniques [18–21].
relevant API dependency graph. DroidSIFT put a security-related Some studies used deep learning to check if malware exists
weighted API graph in a database for each application separately. in the smartphone application [24,25], but had certain limita-
It was observed that by an efficient graph search in database tions (i.e., low malware detection and identification rate, Dynamic
grouped applications based on the android packages and each analysis, family and category detection, and identification of mal-
group keeps an index of present critical API. An application was ware). These limitations arise through time and they have to
tested and its critical graph was generated. From this graph, a be updated for the safety of android phone security. This pa-
feature set was extracted in which if the vector is not zero then per focuses on addressing all these limitations by providing a
it shows the similarity score, and the test applications graph was highly efficient approach for the detection and identification of
compared with the database graph. These results were used for new types of malware. Table 1 shows existing works and the
anomaly detection and signature detection and had an accuracy limitations that we addressed in this research.
of 93% on Genome [38] dataset.
3. Dataset and preliminaries
2.2. Intent based android malware detection
We have used recently published Android Malware Dataset
Droidmat [36] introduced a malware analyzer that used Static (CICInvesAndMal2019) [46]. It is the second part of the dataset
permissions, intents, and API calls to classify android applications. CICAndMal2017 [29], in which benign and malware Android ap-
They utilized K-means to improve their malware ability and plications are tested on real smart devices. This dataset contains
utilized k-Nearest Neighbor to check if applications are malicious several families of Android malware, permissions, and intents as
or benign. Similarly, in [27], malware detection and classification Static features, API calls and all generated log files as Dynamic
model was proposed and used real-world datasets i.e. CICAnd- features. The dataset also includes captured features like process
logs, packages, log states, battery states, etc. Table 2 shows a
Mal2017. This model is used for the feature extraction phase and
detailed overview of the datasets adopted from [22] that are
to extract conversion-level features with the PeerShark tool. This
locally available with published year information. We provide a
model utilized conversation level traffic features of the network.
comparison of our dataset with the features of other publicly
In [39], a model of mobile malware detection that uses traffic
available datasets in Table 3. Malware samples in this dataset are
features to check the efficiency of traffic classifier and uses clas-
classified into four categories: (1) Adware, (2) Ransomware, (3)
sification techniques for are time-based, flow-based, and packet-
Scareware, and (4) SMS Malware.
based features to check malware families. For feature extraction
of the vector, CICFlowMeter [40] was used as the flow generator
3.1. Adware
and had extracted network traffic flow-level features. In [41], au-
thors proposed that intents are effective for identifying malicious
Adware is a type of malicious application affecting user pri-
applications because intents can encode malware when they are
vacy and security. Adware may cause the client damage by tak-
compared with the permissions feature set. Later, it was found
ing his information and sending it to a remote server, showing
through experimentation that the detection rate with permis-
advertisements forcefully through screen seizing or showing ad-
sions was 83% and with intents, it was 91%, when intent features
vertisements in the notification bar. which is typically held for
were combined with other features. However, the detection rate
significant framework occasions. In some cases, an Adware may
was up to 96% with a merge of intents and permissions.
hack the smartphone speaker [12]. The main purpose of Adware
is to make the user view or click the maximum unintentional
2.3. Permission based android malware detection commercials, banners, and posts [47]. Adware is any product
bundle that frequently presents ads to clients’ history of their
In a permission-based approach, the permission list is checked application usage or search history. This includes gathering data,
to confirm the existence of malicious apps. Authors in [42] distin- frequently and yet sometimes, using this data for malicious in-
guish between benign and malware appreciation using machine tentions [48]. Adware can be utilized deliberately by an adver-
learning and monitored permissions and event features. Aung tisement company, other meddling adware may likewise misuse
et al. [42] made a malware detection monitor that can recognize an advertisement company and subvert income and data from
malware and benign application. They utilized K-means, random the proprietors of the promotion company. Aggressive adware
forest, and decision trees to group the malware by selected fea- can make alternate routes on to the home screen, take book-
ture set. Experiments on two distinctive datasets revealed a 90% marks, change default internet browser, search engine, internet
average detection rate. Likewise, another author Huang et al. [43] settings, and pushing pointless notices Plankton is one such kind
guaranteed that a permission-based approach can be utilized as a of aggressive adware. Adware can be designed to take control
fast channel that has a detection rate of above 81% on malicious of the user’s android device when it is merged with botnet and
samples. repacks itself as a popular application [39]. Aggressive Adware
The evaluation confirmed that network traffic flow-level fea- can exploit vulnerabilities and attack installed from third-party
tures are helpful for binary detection in the above-mentioned sources [49,50].
scenarios. In [44], the malicious samples were collected from
CICAndMal2017 with the alignment of permissions. The sequence 3.2. Ransomware
alignment principle was used to check similarity based on per-
missions for normal families and malicious families. The classifi- Ransomware is a sort of malware that requests a cash amount
cation threshold is obtained from the similarity score between the from the tainted client. On Android, there are two general classes
DNA of the families and the tested application. In [45], the results of ransomware which are lock-screen and crypto. In lock-screen,
are evaluated and with those results DL-Droid which uses 31,125 class, the smartphone asset is hindered by a picture that com-
Android apps, and uses 420 Static and Dynamic features. The per- pletely covers the screen. Secondly, In the crypto class, the ran-
formance was compared with deep learning-based frameworks somware scrambles the client’s significant information. Android
and traditional machine learning classifiers. ransomware normally fits the general meaning of a trojan horse.
846
S.I. Imtiaz, S.u. Rehman, A.R. Javed et al. Future Generation Computer Systems 115 (2021) 844–856

Table 1
Summary of existing malware detection studies using deep learning and machine learning.
Year Ref. Method API calls Intents Permission Limitations
2012 [36] K-means Yes Yes Yes Limited to Static permission, intents and API calls
2014 [35] MLP Yes No Yes Limited features including permissions and API calls
2016 [24] DBN Yes No Yes Does not focus on intents and has low detection rate
2014 [25] DBN Yes No No Low detection rate

Table 2
Details regarding currently available android malware datasets [22]. Key: Symbolic — S, Continuous — C, SMO — Spider Monkey, PCA — Principal Component Analysis,
States — S, Permission — P, Intent — I, Components — C, Certification — Ce, Source Code — SC, API.Call — APC, Network — N.
Dataset name Pub. No. of No. of Captured static features Captured dynamic features Installed On
Year Benign Malware S P I C Ce SC APC N Sys.Call Infoflow Log
Genome [27] 2012 – 1260 ✕ ✓ ✕ ✓ ✕ ✓ ✕ ✕ ✕ ✕ ✕ –
Drebin [3] 2014 123,453 5560 ✕ ✓ ✓ ✓ ✕ ✓ ✕ ✕ ✕ ✕ ✕ –
AndroTracker [13] 2015 51,179 4554 ✕ ✓ ✓ ✕ ✓ ✓ ✕ ✕ ✕ ✕ ✕ –
SAPIMMDS [11] 2016 1776 906 ✕ ✕ ✕ ✕ ✕ ✕ ✓ ✕ ✕ ✕ ✕ Emulator
Andro-Dumpsys [24] 2016 1776 906 ✕ ✓ ✓ ✕ ✓ ✓ ✓ ✕ ✕ ✕ ✕ Emulator
Andro-Profiler [12] 2016 8840 643 ✕ ✕ ✕ ✕ ✕ ✕ ✕ ✕ ✓ ✕ ✓ Emulator
Kharon [6] 2016 – 7 ✕ ✕ ✕ ✕ ✕ ✕ ✕ ✕ ✕ ✓ ✕ RealPhone
AAGM [15] 2017 1500 400 ✕ ✕ ✕ ✕ ✕ ✕ ✕ ✓ ✕ ✕ ✕ RealPhone
AMD [23] 2017 – 405 ✕ ✕ ✕ ✓ ✕ ✓ ✕ ✕ ✕ ✕ ✕ –
MalDozer [14] 2018 38,000 33,000 ✕ ✕ ✕ ✕ ✕ ✓ ✕ ✕ ✕ ✕ ✕ –
UCL [20] 2018 1,2M – ✕ ✕ ✕ ✓ ✕ ✓ ✕ ✕ ✕ ✕ ✕ –
CICAndMal2017 2018 1700 426 ✓ ✓ ✓ ✕ ✕ ✕ ✓ ✓ ✕ ✕ ✕ RealPhone
CICInvesAndMal2019 2019 5,065 426 ✓ ✓ ✓ ✕ ✕ ✕ ✓ ✓ ✕ ✕ ✕ RealPhone

Table 3
Comparison of publicly available android malware datasets [22].
Year Dataset A1 A2 A3 A4 A5 A6 A7 A8 A9 A10 A11 CA12 A13 A14 A15
2012 Genome [27] S – – ✓ – – ✓ ✓ – ✓ ✓ ✕ ✓ ✓ ✕
2014 Drebin [3] S – – ✓ – – ✓ ✓ ✕ ✓ ✓ ✓ ✓ ✕ ✕
2015 AndroTracker [13] S – – ✓ – – ✕ ✓ ✕ ✓ ✓ ✓ ✓ ✕ ✕
2016 SAPIMMDS [11] B ✕ ✓ ✓ ✕ ✕ ✓ ✓ ✓ ✓ ✕ ✕ ✓ ✕ ✕
2016 Andro-Dumpsys [24] B ✕ ✓ ✓ ✕ ✕ ✓ ✓ ✓ ✓ ✕ ✓ ✓ ✕ ✕
2016 Andro-Profiler [12] B ✕ ✓ ✓ ✕ ✕ ✓ ✕ ✓ ✓ ✓ ✕ ✓ ✕ ✕
2016 Kharon [6] B ✓ ✕ ✓ ✓ ✕ ✓ ✕ – ✓ ✕ ✕ ✓ ✕ ✓
2017 AAGM [15] D ✓ ✓ ✓ ✓ ✕ ✓ ✕ ✓ ✓ ✓ ✕ ✓ ✕ ✓
2017 AMD [23] S – – ✓ – – ✓ ✓ – ✓ ✓ ✓ ✓ ✓ ✓
2018 MalDozer [14] S ✕ ✕ ✓ ✕ ✕ ✓ ✓ ✓ ✕ ✓ ✕ ✓ ✕ ✓
2018 UCL [20] S ✕ ✕ ✓ ✕ ✕ ✓ ✓ ✕ ✕ ✓ ✕ ✕ ✕ ✓
2017 CICAndMal2017 B ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✕
2019 InvesCICAndMal2019 B ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓

Legend:
A1: Type of data capturing, Static(S) or Dynamic(D) or both(B).
A2: Utilizing Real-Phone devices instead of emulators.
A3: Having network architecture for the experiment set up.
A4: Examining real-world malware samples.
A5: Having malware activation scenario.
A6: Defining multiple states of data capturing.
A7: Having trust-able fully-labeled malware samples.
A8: Including diverse malware categories and families.
A9: Keeping balance between malicious and benign samples.
A10: Avoiding anonymity and preserving all captured data.
A11: Containing a heterogeneous set of resources.
A12: Providing a variety of feature sets for other researchers.
A13: For meta-data, includes a proper documentation.
A14: Including malware taxonomy.
A15: Being up-to-date.

At times, the vindictive APKs duplicate just the name and symbol 3.3. Scareware
of the typical application or mask it as an authentic document in
an SMS or email. Social engineering is to control exploited people Scareware is the type of malware that aims to scare the end-
from introducing malicious APKs and executing functions [13]. user paying for useless applications [54]. Scareware is made to
Ransomware is a file that can encrypt the files and lock the scare or to trap users with some phishing website to steal their
device, then demand payment from the end-users for decryption information [55]. Scareware trick the user by presenting scam
of files or to unlock the device [51]. When the files are encrypted as legitimate applications that typically take on the appearance
once, these cannot be recovered with the decryption key even if of security applications for example, ‘‘against malware program-
the ransomware is removed from the system [52]. Ransomware ming" or more explicitly ‘‘hostile to infection programming".
works with permissions and intents on the android system [21]. Scareware is particularly made to incorporate phony filtering
Ransomware can also use identity or label for an authentic crime exchanges, fake advancement bars, and phony alarms. Scareware
investigation organization (USA Crime investigation or FBI) and may show counterfeit arrangements of virus records That are so
make fake claims to mislead target users [53]. produced incorporate documents that may not exist on the PC or
847
S.I. Imtiaz, S.u. Rehman, A.R. Javed et al. Future Generation Computer Systems 115 (2021) 844–856

Table 4 4.2. Feature extraction

Families with their count samples with respect to their designated category.
Key: Captured Samples — CS.
CICInvesAndMal2019 [46] is a two-layered dataset consisting
Adware Ransomware Scareware SMS Malware
of Static and Dynamic layers for malware detection. The first
Family CS Family CS Family CS Family CS
layer is the Static layer that analyzes malware applications and
Dowgin 10 Charger 10 AndroidDefender 17 BeanBot 9 if it detects any malicious application then that application is
Ewind 10 Jisut 10 AndroidSpy.277 6 Biige 11
also considered malware for the Dynamic layer. If the Static-base
Feiwo 15 Koler 10 AV for Android 10 FakeInst 10
Gooligan 14 LockerPin 10 AVpass 10 FakeMart 10 first layer detects a suspicious malware, there is more possibility
Kemoge 11 Simplocker 10 FakeApp 10 FakeNotify 10 of malicious intentions in that sample. We believe if a sample
koodous 10 Pletor 10 FakeApp.AL 11 Jifake 10 is detected suspicious with a Static layer, the analyzer should
Mobidash 10 PornDroid 10 FakeAV 10 Mazarbot 9 consider it as malware for the next layer as well. As a result, we
Selfmite 4 RansomBO 10 FakeJobOffer 9 Nandrobox 11
Shuanet 10 Svpeng 11 FakeTaoBao 9 Plankton 10
can reduce the risk of trusting unknown samples. In the dataset,
Youmi 10 WannaLocker 10 Penetho 10 SMSsniffer 9 there are testing as well as training samples of both Static and
– – – – VirusShield 10 Zsone 10 Dynamic layers.

4.3. Machine learning models

they might be inconsistent with the working framework. Attack-
In this study, we use the following machine learning algo-
ers can steal the credentials of organizations and individuals to
rithms to evaluate and compare the effectiveness of our proposed
cause harm or breach security [14].
DeepAMD approach:
Naive Bayes (NB): This is the most straightforward and fast
3.4. SMS malware
classification algorithm suitable for a large chunk of data. It uses
Bayes theorem of probability for prediction of unknown class.
SMS malware takes control of messages on an Android device
Sequential Minimal Optimization (SMO): This algorithm
and sends unwanted messages. This malware is being used by the
works by separating hyperplane and the input to SMO is rep-
owner to send messages by the infected mobile phones on his
command [56]. SMS attacks include the making and spreading of resented as a set of points in the space that are mapped such
malware by attackers, intended to focus on a hacked individual’s that each point belonging to a class is separated efficiently by
smartphone. The trojan can be intended to make unapproved calls analyzing gaps. SMO comprises of kernel function that provides
or send unapproved messages without the client’s information or information a gap between points.
assent. These calls and messages are consequently coordinated Multilayer Perceptron (MLP): This is a class of Artificial Neu-
to chargeable SMS content administrations or premium-charge ral Networks that uses backpropagation for training and its multi-
numbers used by the cyber-criminal for creating huge income ple layers and non-linear activation distinguishes it from a linear
streams for cyber-criminal systems [57] (see Table 4). perceptron algorithm [9].
Decision tree (DT/J48): This supervised learning algorithm
4. Android malware detection and identification continuously split data according to a certain parameter. The tree
can be explained by two entities, namely decision nodes and
In this section, we present our proposed approach named leaves. The leaves are the decisions or outcomes. and the decision
DeepAMD for malicious application detection. DeepAMD com- nodes are points where the data is split.
prises feature extraction, classification of application as malicious Deep Artificial Neural Networks (Deep ANN): Artificial Neu-
or benign, classification of malware category, and malware fam- ral Networks (ANN) are multi-layer fully-connected neural nets
ily. Fig. 1 summarizes our proposed approach which consists of and consist of an input layer, multiple hidden layers, and an
Static binary classification and Dynamic malware classification. output layer. Every node in one layer is connected to every
First, in the Static layer, the samples are classified as malware other node in the next layer. We make the network deeper by
and benign. Then in the Dynamic layer, the samples that are increasing the number of hidden layers. Deep ANNs are used
classified by the Static layer as malware are further classified into for many real-world applications nowadays due to their effi-
different 4 categories (Adware, Ransomware, SMS Malware, and cient performance. The success of deep learning during the last
Scareware) and 39 families. decade is due to a combination of improved theory starting with
unsupervised pre-training and deep belief nets and improved
4.1. Pre-processing hardware resources such as general-purpose graphics processing
units (GPGPUs). Deep ANNs are now routinely used with impres-
Pre-processing is a preliminary step to obtain the best per- sive results in areas such as image analysis, pattern recognition,
formance in any machine learning model. Pre-processing steps object detection, natural language processing, and self-driving
typically include removal of NaN, duplicate instances, and nor- cars to name a few areas.
malization/scaling. The selected dataset has low variance and
ambiguities therefore, we choose MinMax scaling for feature 4.4. Hyper-parameter tuning for android malware detection and
normalization. Normalizing refers to the re-scaling of real-valued identification using Deep ANN
numeric attributes to a fixed range (e.g., 0 and 1). It is highly
important to scale the input attributes for a model that relies on We use Deep ANN such that the 8114-axis data that corre-
the magnitude of values. MixMax scaling normalizes data using sponds to the input layer of 8114 dimensions correspond to the
the formula mentioned in (1). 2, 4, and 42 axes of the output layer for the malware binary classi-
fication of malware and benign class labels, category classification
Xi − Xmin
Xnorm = (1) of ‘‘adware’’, ‘‘ransomware’’, ‘‘scareware’’ and ‘‘SMS Malware’’ and
Xmax − Xmin family classification of families i.e, ‘‘dowgin’’, ‘‘ewind’’, ‘‘feiwo’’,
where Xi is the original value of the feature that is subtracted and others respectively for the detection and identification of
from minimum value of that feature and divided by subtracted attack over Static layer network traffic. For attack detection and
result of maximum and minimum of the feature. identification over network traffic on the Dynamic layer, the
848
S.I. Imtiaz, S.u. Rehman, A.R. Javed et al. Future Generation Computer Systems 115 (2021) 844–856

Fig. 1. Graphical representation of proposed android malware application detection and identification approach.

Table 5 Table 6
Details of the optimal hyper-parameters deep artificial neural network. Computing environment.
Parameter Value Parameter Value
Initial Bias 0 Operating System Windows 10 Professional 1909
Internal layer 3 CPU Intel(R) Core(TM)i7-6700HQ
Dropout Dynamic RAM 16 GB
Activation function at all layers Relu GPU NVIDIA GeForce 1060
Activation function at output layer Sigmoid CUDA Version 9.0
Batch size Dynamic Python Version 3.8
Learning optimizer Adam
Error function Binary & Categorical Cross Entropy

5.1. Evaluation measures and experimental setup

919-axis data correspond to the input layer of 919 dimensions

correspond to the 4 and 40 axes of the output layer for the Evaluation measure and experimental setup play a vital role
category classification of ‘‘adware’’, ‘‘ransomware’’, ‘‘scareware’’ to analyze the performance of a machine learning model. For the
and ‘‘SMS malware’’ and family classification of families i.e, ‘‘dow- experiment, we split data and 80% of data is used for training, and
gin’’, ‘‘ewind’’, ‘‘feiwo’’ and others respectively. Neurons on the the rest 20% for testing. We computed accuracy, precision, recall,
internal layer are computed using the ‘‘Relu’’ unit. The output and f-score to evaluate the performance of the proposed method.
layer is defined by a ‘‘sigmoid’’ function, error, and cross-entropy Details can be seen in the Equations given below. Table 6 presents
function. Details of this Deep ANN are summarized in Table 5 the computing environment used for experiments.
TPAnoamly + TNNormal
4.5. Comparative methods accuracy = (2)
TPAnoamly + FNAnoamly + TNNormal + FPNormal
Machine learning algorithms are used for the detection and
identification of Android malware. These algorithms include MLP, TPAnoamly
NB, J48, SMO. These algorithms are used to compare the results precision = (3)
TPAnoamly + FPAnoamly
with our proposed DeepAMD technique. The SMO is used with
various parameters and finally set to the PUK kernel and the
value of gamma and alpha is set to 1.0. NB is used with a kernel TPAnoamly
recall = (4)
estimator. J48 is used with a confidence factor of 2.5. Last, we TPAnoamly + FNNormal
analyze the performance of these algorithms using evaluation
measures explained in Section 5.1.
TPAnoamly TPAnoamly
TPAnoamly +FNNormal
× TPAnoamly +FPAnoamly
5. Evaluation and results f − score = 2 × TPAnoamly TPAnoamly
(5)
TPAnoamly +FNNormal
+ TPAnoamly +FPAnoamly

To evaluate the performance of the proposed DeepAMD, we Here:

perform two major tasks: (i) detection and identification, aims
at checking if a given app is a malware or not, (ii) attribution, • True Positives (TP): Predicted case to be in YES and is actu-
which aims at determining the family of detected malware. CI- ally in it.
CInvesAndMal2019 [46] has multiple levels of classification. At • False Positives (FP): Predicted case to be in YES but is not
the first level, the dataset is classified into malware and benign actually in it.
samples. In the second level, the dataset is classified into 4 cate- • True Negative (TN): Predicted case not to be in YES and is
gories of malware that are adware, ransomware, scareware, SMS not actually in it.
malware, and benign samples. The dataset is further labeled into • False Negative (FN): Predicted case not to be in YES, but is
42 Families of these 4 malware categories. The previous version actually in it.
of the dataset CICAndMal2017 [29] initially had 39 categories.
849
S.I. Imtiaz, S.u. Rehman, A.R. Javed et al. Future Generation Computer Systems 115 (2021) 844–856

Fig. 2. Model accuracy and loss of binary classification on Static layer using train and validation datasets.

Table 7
Binary malware classification performance on static layer.
Accuracy (%) F-score (%) Recall (%) Precision (%)
J48 0.905 0.906 0.905 0.906
NB 0.620 0.634 0.620 0.809
SMO 0.918 0.913 0.918 0.926
MLP 0.905 0.906 0.905 0.906
DeepAMD 0.934 0.932 0.934 0.935

5.2. Malware binary detection on Static layer

Table 7 demonstrates the result on Static Malware Binary

dataset. DeepAMD approach gets the best accuracy of 93.41%
using DeepAMD. Other conventional techniques: J48, NB, SMO
and MLP achieves the accuracy of 90.5%, 62.0%, 91.8% and 90.5%
respectively. NB obtained the least accuracy because NB needs Fig. 3. Confusion matrix of binary classification on Static layer.
more data instances to work better as it works on probability
distribution. J48, SMO and MLP perform quite well on Static bi- Table 8
nary dataset. The Cohens Kappa of DeepAMD is reported as 82.7%. Malware category classification performance on static layer.
DeepAMD show a significant gain of performance in comparison Accuracy (%) F-score (%) Recall (%) Precision (%)
with existing methodologies. DeepAMD shows a proficient gain of J48 0.893 0.893 0.893 0.893
0.3% and 0.6% in terms of accuracy and f-score respectively. NB 0.561 0.61 0.561 0.561
SMO 0.868 0.868 0.868 0.868
Fig. 2a depicts the accuracy convergence of DeepAMD concern-
MLP 0.724 0.724 0.724 0.724
ing epochs. DeepAMD achieves the highest test accuracy of 0.934% DeepAMD 0.925 0.921 0.925 0.922
at the 6th epoch. Training accuracy starts at 0.7% and goes up
to 0.985%. Then the convergence of training accuracy becomes
stable. Test accuracy starts at 0.75% and goes up to 0.934%. It
slightly went down at the 4th and 6th epoch. Fig. 2b depicts NB needs more data instances as it works on the probability
the convergence of loss of DeepAMD concerning epochs. DeepAMD distribution. The Cohens Kappa is calculated to be 0.824% and the
achieves the lowest loss of 0.25% at the 2nd epoch. Training loss ROC AUC curve is 0.941% in this analysis for Category as a feature
starts at 0.6 and goes down to 0.05%. Then the convergence of in malware dataset. DeepAMD shows a significant gain of per-
training loss becomes stable. Test loss starts at 0.41% and goes formance in comparison with existing methodologies. DeepAMD
shows a proficient gain of 0.038% in terms of f-score.
up to 0.33%. Then the convergence of test loss becomes irregular
Fig. 4a depicts the accuracy convergence of DeepAMD with re-
against the test data as epochs increase.
spect to epochs. DeepAMD achieve the highest accuracy of 0.925%
Fig. 3 depicts the confusion matrix of the DeepAMD. It shows
at 14th epoch. Training accuracy starts at 0.75% and goes up to
how many instances of normal applications are getting confused
0.97% and then becomes stable. Test accuracy starts at 0.75% and
with instances of malicious application. Only 0.0697% of the nor-
goes up to 0.925%. It slightly went down at the 8th epoch. Fig. 4b
mal instances are getting confused with malicious instances while
depicts the convergence of the accuracy of DeepAMD concerning
on the other hand only 0.0533% of the malicious instances are epochs. DeepAMD achieves the lowest loss of 0.1% at 17th epoch.
getting confused with normal instances. Training loss starts at 0.9% and goes down to 0.05%. Then the
convergence of training loss becomes stable. Test loss starts at
5.3. Malware category detection on Static layer 0.72% and goes down to 0.45%. Fig. 5 depicts the confusion matrix
of the category classification on static layer.
Table 8 demonstrates the result of the Static Malware Category
dataset. DeepAMD achieves the best accuracy of 0.925% using 5.4. Malware family detection and identification on Static layer
DeepAMD. Other conventional techniques: J48, NB, SMO, and MLP
achieve the accuracy of 0.893%, 0.561%, 0.868%, and 0.724% re- Table 9 demonstrates the result of the Static Malware Family
spectively. NB achieves the minimum accuracy of 0.561% because feature set. DeepAMD achieves the best accuracy of 0.90% in the
850
S.I. Imtiaz, S.u. Rehman, A.R. Javed et al. Future Generation Computer Systems 115 (2021) 844–856

Fig. 4. Model accuracy and loss of category classification using train and validation datasets on Static layer.

Table 10
Malware category classification performance on dynamic layer.
Accuracy (%) F-score (%) Recall (%) Precision (%)
J48 0.712 0.713 0.712 0.720
NB 0.727 0.723 0.727 0.731
SMO 0.681 0.701 0.681 0.781
MLP 0.575 0.538 0.575 0.512
DeepAMD 0.803 0.805 0.803 0.822

5.5. Malware category detection and identification on Dynamic layer

Table 10 shows the result of the Dynamic Malware Category

feature set. DeepAMD achieves the best accuracy of 0.803% us-
ing DeepAMD. Other conventional techniques: J48, NB, SMO, and
MLP achieve the accuracy of 0.712%, 0.727%, 0.681%, and 0.575%
respectively. DeepAMD shows a significant gain of performance
Fig. 5. Confusion matrix of category classification on Static layer. in comparison with existing methodologies. DeepAMD shows a
proficient gain of 0.076%, 0.092%, 0.076% and 0.041% in terms of
Table 9 accuracy, f-score, recall, and precision respectively. The Cohens
Malware family classification performance on static layer. Kappa is calculated to be 0.727% and the ROC AUC curve is 0.823%
Accuracy (%) F-score (%) Recall (%) Precision (%) in this analysis for the family as a feature in the malware dataset.
J48 0.862 0.863 0.862 0.884 Fig. 7a depicts the convergence of the accuracy of DeepAMD
NB 0.695 0.753 0.695 0.855 concerning epochs. DeepAMD achieves the highest accuracy of
SMO 0.836 0.780 0.836 0.756 0.803% at the 12th epoch. Training accuracy starts at 0.1% and
MLP 0.692 0.685 0.692 0.683
DeepAMD 0.900 0.896 0.899 0.904
goes up to 0.90%. Then the convergence of training accuracy
becomes stable. Test accuracy starts at 0.33% and goes up to
0.82%. It slightly went down at the 4th epoch. Fig. 7b depicts
the convergence of the accuracy of DeepAMD concerning epochs.
Static layer for family malware detection. Other conventional DeepAMD achieves the lowest loss of 0.6% at the 8th epoch.
techniques: j48, NB, SMO and MLP achieves the accuracy of Training loss starts at 0.014% and goes down to 0.2%. Then the
0.862%, 0.695%, 0.836%, and 0.692% respectively. In this case, the convergence of training loss becomes stable. Test loss starts at
Algorithm Naive Bayes achieves the minimum accuracy of 0.695% 0.014% and goes down to 0.62%. Fig. 8 depicts the confusion
because Naive Bayes needs more data instances as it works on matrix of the category classification on dynamic layer.
the probability distribution. The Cohens Kappa is calculated to
be 0.783% and the ROC AUC curve is 0.918% in this analysis for 5.6. Malware family detection and identification on Dynamic layer
Family as a feature in the malware dataset.
Table 11, shows the result on Dynamic Malware Family feature
Fig. 6a depicts the convergence of the accuracy of DeepAMD
set we get the best accuracy of 0.59% using DeepAMD. Other con-
concerning epochs. DeepAMD achieves the highest accuracy of
ventional techniques: J48, SMO, MLP and NB achieves the accu-
0.90% at the 14th epoch. Training accuracy starts at 0.75% and
racy of 0.459%, 0.262%, 0.49% and 0.524% respectively. DeepAMD
goes up to 0.95%. The convergence of training accuracy increases
show a significant gain of performance in comparison with ex-
after each epoch. Test accuracy starts at 0.75% and goes up to isting methodologies. DeepAMD shows a proficient gain of 0.07%,
0.95%. It slightly went down at the 8th epoch. Fig. 6b depicts 0.058%, and 0.066% in terms of accuracy, f-score, and recall re-
the convergence of the accuracy of DeepAMD concerning epochs. spectively. The Cohens Kappa is calculated to be 0.507% and the
DeepAMD achieves the lowest loss of 0.80% at the 14th epoch. ROC AUC curve is 0.558% in this analysis for family as feature in
Training loss starts at 0.016% and goes down to 0.2%. Then the malware dataset.
convergence of training loss becomes stable. Test loss starts at Fig. 9a depicts the convergence of the accuracy of DeepAMD
0.013% and goes down to 0.8%. concerning epochs. DeepAMD achieves the highest accuracy of
851
S.I. Imtiaz, S.u. Rehman, A.R. Javed et al. Future Generation Computer Systems 115 (2021) 844–856

Fig. 6. Model accuracy and loss on train and validation datasets of family classification on Static layer.

Fig. 7. Model accuracy and loss of category classification using train and validation datasets on Dynamic layer.

0.64%. It slightly went down at the 40th epoch. Fig. 9b depicts

the convergence of the accuracy of DeepAMD concerning epochs.
DeepAMD achieves the lowest loss of 0.75% at the 9th epoch.
Training loss starts at 0.016% and goes down to 0.2%. Then the
convergence of training loss becomes stable. Test loss starts at
0.013% and goes down to 0.8%.

6. Comparative analysis

In Tables 12, 13, 14, precision and recall are compared with
2 different versions of a dataset. Case A represents the dataset
CICAndMal2017 [29]. Case B represents the second version of
CICAndMal2017 [46]. The research was conducted by author [22],
Fig. 8. Confusion matrix of category classification on Dynamic layer. in which they used random forest algorithm to calculate the
precision and recall of dataset. Our approach DeepAMD achieves
Table 11 the highest accuracy using the DeepAMD algorithm. As compared
Malware family classification performance of DeepAMD on dynamic layer. to other studies [22,27,32], we improve our results in both the
Accuracy (%) F-score (%) Recall (%) Precision (%) Static and Dynamic layers with our analysis. We achieve the
J48 0.442 0.479 0.442 0.603 highest precision 93.5% as shown in Table 12 for malware binary
NB 0.590 0.581 0.590 0.650 classification, slightly low accuracy from state-of-the-art for mal-
SMO 0.262 0.259 0.262 0.334 ware category classification, and best accuracy of 65.1% using our
MLP 0.049 0.040 0.049 0.076
DeepAMD 0.557 0.540 0.55 0.591
approach as shown in Table 14. on the Static layer, we improve
the performance of binary classification of binary malware by
3.0% and on the Dynamic layer, we improve the performance of
classification of malware family by 6.1% within comparison with
0.590% at the 44th epoch. Training accuracy starts at 0.05% and state-of-the-art.
goes up to 0.9%. Then the convergence of training accuracy In Table 12, DeepAMD achieve the highest precision of 98.3%
becomes stable. Test accuracy starts at 0.1% and goes up to using SMO for Static layer malware binary classification. Other
852
S.I. Imtiaz, S.u. Rehman, A.R. Javed et al. Future Generation Computer Systems 115 (2021) 844–856

Fig. 9. Model accuracy and loss of family classification using train and validation datasets on Dynamic layer.

Table 12 malicious or benign application, classification of malware cate-

Result comparison of malware binary classification on static layer. gory, and classification of a malware family. In pre-processing,
Dataset Precision Recall we removed NaN values, duplicate instances, and applying nor-
A [22] 85.8% (RF) 88.3% (RF) malization. We observed that our dataset has low variance and
A [27] 89% (RF) 83.22% (RF) ambiguities therefore, we choose MinMax scaling for feature
A [58] 85.4% (KNN) 88.1% (KNN)
normalization. We used CICInvesAndMal2019 is a two-layered
A [58] 85.1% (DT) 88% (DT)
A [27] 85.7% (DT) 86.1% (DT) framework. The first layer is the Static layer that analyzes mal-
B [22] 95.3% (RF) 95.3% (RF) ware applications and if it detects any malicious then that ap-
B DeepAMD 93.5% 93.4% plication is also considered malware for a Dynamic layer. If the
Static-base first layer detects a suspicious malware, there is more
Table 13
possibility of malicious intentions in that sample. We believe that
Result comparison of malware category classification on dynamic layer. if a sample is detected suspicious with a Static layer, the analyzer
Dataset Precision Recall should consider it as malware for the next layer. As a result, we
A [22] 49.9% (RF) 48.5% (RF)
can reduce the risk of trusting unknown samples. In the dataset,
A [27] 80.2% (RF) 79.6% (RF) there are testing and training samples of Static and Dynamic
A [58] 49.5% (KNN) 48% (KNN) layers.
A [58] 47.8% (DT) 45.9% (DN) The results in Table 7 demonstrate that the accuracy and
A [27] 77% (DT) 77% (DT) F1-score for classification of malware from benign are highest
B [22] 83.3% (RF) 81% (RF)
B DeepAMD 82.2% 80.3%
using DeepAMD on the Static layer. The DeepAMD can classify
malware from benign with 93.4% accuracy and 87.8% F1-score.
When we applied DeepAMD on malware category features on
Table 14 the Static layer comprising of different categories of malware
Result comparison of malware family classification on dynamic layer.
which include adware, ransomware, scareware, SMS malware,
Dataset Precision Recall
premium SMS, and benign. Table 8 deduce that DeepAMD is the
A [22] 27.5% (RF) 27.5% (RF) ideal algorithm for classification and it worked with the accuracy
A [58] 26.66% (DT) 20.06% (DT)
of 93.1%. In Table 9 the accuracy obtained using the DeepAMD
A [58] 27.24% (KNN) 23.74% (KNN)
B [22] 59.7% (RF) 61.2% (RF) algorithm is 93.4% when DeepAMD classifies different malware
B DeepAMD 65% (NB) 59% (NB) families on the Static layer. On the Dynamic layer, in Table 10,
the DeepAMD performed well for classification with an accuracy
of 93.4% while Table 11 shows the best accuracy of malware
family classification. DeepAMD outperforms all other algorithms
studies [22,27,58] achieve the highest precision of 95.3%, 86.6%, and achieves the highest accuracy of 59%. The results of the
85.4% respectively. In Table 13, DeepAMD achieve the highest proposed research concluded that with our approach DeepAMD,
precision of 82.2% using Deep_ANN for Dynamic layer malware the highest accuracy achieved is with the DeepAMD. As compared
category classification. Other studies [22,27,58] achieve the high- to other studies [22,32], DeepAMD improves the results on both
est precision of 83.3%, 80.2%, 49.5% respectively. In Table 14, Deep- Static and Dynamic layers. On the Static layer, DeepAMD improves
AMD achieve the highest precision of 65.1% using Deep_ANN for the precision of binary classification of binary malware to 98.3%
Dynamic layer malware family classification. Other studies [22, and on the Dynamic layer, DeepAMD improves the precision of
58] achieve the highest precision of 59.7% and 27.24% respec- family classification to 65.1% with our research.
tively. F-score is a better measure to analyze the efficiency of ma-
chine learning models in case of imbalanced data than the ac-
7. Discussion curacy matrix [59]. The existing studies did not unitize this fac-
tor for this dataset. According to the results shown in existing
Existing studies present various approaches to analyzing the studies, they only considered precision and recall which is an
permission structures but have certain limitations. We performed important point to note. In this research, the DeepAMD approach
both Static and Dynamic analysis on the features to determine achieves the highest f-score of 93.2% for the Static layer in binary
the efficiency of the dataset. For malicious application detection malware classification. Similarly in the Static layer, DeepAMD
and identification, DeepAMD applies a series of steps: feature achieves the f-score for malware category and family classifica-
extraction, data balancing, classification of application into the tion performance of 92.1% and 89.6% respectively. In the case
853
S.I. Imtiaz, S.u. Rehman, A.R. Javed et al. Future Generation Computer Systems 115 (2021) 844–856

of a Dynamic layer, the highest f-score of malware category is [6] K. Sharma, B. Gupta, Towards privacy risk analysis in android applications
80.5% achieved by DeepAMD and for the highest f-score of mal- using machine learning approaches, Int. J. E-Serv. Mob. Appl. (IJESMA) 11
(2) (2019) 1–21.
ware family classification is 58.1% achieved by the Naive Bayes
[7] A.R. Javed, M.U. Sarwar, S. Khan, C. Iwendi, M. Mittal, N. Kumar, Analyzing
algorithm. the effectiveness and contribution of each axis of tri-axial accelerometer
sensor for accurate activity recognition, Sensors 20 (8) (2020) 2216.
8. Conclusion [8] C. Wang, Q. Xu, X. Lin, S. Liu, Research on data mining of permissions
mode for android malware detection, Cluster Comput. 22 (6) (2019)
13337–13350.
The evolution of the Internet of Things (IoT) and smart devices
[9] A.R. Javed, M.O. Beg, M. Asim, T. Baker, A.H. Al-Bayatti, Alphalogger:
has brought a new range of challenges to device vendors, soft- detecting motion-based side-channel attack using smartphone keystrokes,
ware developers as well as cybersecurity professionals. Previously J. Ambient Intell. Humaniz. Comput. (2020) 1–14.
unobserved Android malware is being identified and new mal- [10] M. Mittal, C. Iwendi, S. Khan, A. Rehman Javed, Analysis of security and
ware is evolving. To counter malware in Android devices, in this energy efficiency for shortest route discovery in low-energy adaptive
clustering hierarchy protocol using levenberg-marquardt neural network
paper, a novel DeepAMD approach is proposed. DeepAMD achieved
and gated recurrent unit for intrusion detection system, Trans. Emerg.
the highest accuracy of 93.4% on the Static layer to classify binary Telecommun. Technol. (2020) e3997.
malware and then categorize malware using DeepAMD. DeepAMD [11] N.T. Cam, V.-H. Pham, T. Nguyen, Detecting sensitive data leakage via inter-
achieved an accuracy of 93.1% on the Static layer to classify applications on android using a hybrid analysis technique, Cluster Comput.
malware families using the DeepAMD. Secondly, on the Dynamic 22 (1) (2019) 1055–1064.
[12] I. Ideses, A. Neuberger, Adware detection and privacy control in mobile
layer, we achieved the highest accuracy of 80.3% for malware devices, in: 2014 IEEE 28th Convention of Electrical & Electronics Engineers
category classification. We achieved an accuracy of 59.0% for in Israel (IEEEI), IEEE, 2014, pp. 1–5.
malware family classification on the Dynamic layer. The DeepAMD [13] J.-S. Ko, J.-S. Jo, D.-H. Kim, S.-K. Choi, J. Kwak, Real time android
is evaluated using the state-of-the-art CICAndMal2019 dataset ransomware detection by analyzed android applications, in: 2019 Interna-
and experimental results demonstrated that DeepAMD is the most tional Conference on Electronics, Information, and Communication (ICEIC),
IEEE, 2019, pp. 1–5.
efficient method for detecting and identifying Android malware [14] M. Sikorski, A. Honig, Practical Malware Analysis: The Hands-On Guide to
on the Static as well as Dynamic layer. In the future, we intend to Dissecting Malicious Software, no starch press, 2012.
make an online service through which the user would be able to [15] F. Faghihi, M. Abadi, A. Tajoddin, Smsbothunter: A novel anomaly detection
see if an application is benign or malicious before downloading technique to detect sms botnets, in: 2018 15th International ISC (Iranian
Society of Cryptology) Conference on Information Security and Cryptology
it. This step would contribute positively to ensure the security of
(ISCISC), IEEE, 2018, pp. 1–6.
an android smartphone device. [16] A. Arora, S. Garg, S.K. Peddoju, Malware detection using network traffic
analysis in android based mobile devices, in: 2014 Eighth International
CRediT authorship contribution statement Conference on Next Generation Mobile Apps, Services and Technologies,
IEEE, 2014, pp. 66–71.
[17] C. Iwendi, Z. Jalil, A.R. Javed, T. Reddy, R. Kaluri, G. Srivastava, O. Jo,
Syed Ibrahim Imtiaz: Acquisition of data, Writing - original
Keysplitwatermark: Zero watermarking algorithm for software protection
draft. Saif ur Rehman: Acquisition of data, Analysis and/or inter- against cyber-attacks, IEEE Access 8 (2020) 72650–72660.
pretation of data, Writing - original draft. Abdul Rehman Javed: [18] M. Shafiq, Z. Tian, A.K. Bashir, X. Du, M. Guizani, Iot malicious traffic
Conception and design of study, Acquisition of data, Writing identification using wrapper-based feature selection mechanisms, Comput.
- original draft. Zunera Jalil: Conception and design of study, Secur. (2020) 101863.
[19] J. Yu, T. Yamauchi, Access control to prevent attacks exploiting vul-
Analysis and/or interpretation of data, Writing - original draft,
nerabilities of webview in android os, in: 2013 IEEE 10th International
Writing - review & editing. Xuan Liu: Writing - review & editing. Conference on High Performance Computing and Communications & 2013
Waleed S. Alnumay: Writing - review & editing. IEEE International Conference on Embedded and Ubiquitous Computing,
IEEE, 2013, pp. 1628–1633.
Declaration of competing interest [20] Y. Nishimoto, N. Kajiwara, S. Matsumoto, Y. Hori, K. Sakurai, Detection
of android api call using logging mechanism within android framework,
in: International Conference on Security and Privacy in Communication
The authors declare that they have no known competing finan- Systems, Springer, 2013, pp. 393–404.
cial interests or personal relationships that could have appeared [21] S. Song, B. Kim, S. Lee, The effective ransomware prevention technique
to influence the work reported in this paper. using process monitoring on android platform, Mob. Inf. Syst. 2016 (2016).
[22] L. Taheri, A.F.A. Kadir, A.H. Lashkari, Extensible android malware detection
and family classification using network-flows and api-calls, in: 2019
Acknowledgment
International Carnahan Conference on Security Technology (ICCST), IEEE,
2019, pp. 1–8.
This research is supported by Researchers Supporting Project [23] F. Tchakounté, A.D. Wandala, Y. Tiguiane, Detection of android malware
number (RSP-2020/250), King Saud University, Riyadh, Saudi Ara- based on sequence alignment of permissions, Int. J. Comput. (IJC) 35 (1)
bia. All authors approved the version of the manuscript to be (2019) 26–36.
[24] Z. Yuan, Y. Lu, Y. Xue, Droiddetector: android malware characterization
published. and detection using deep learning, Tsinghua Sci. Technol. 21 (1) (2016)
114–123.
References [25] Z. Yuan, Y. Lu, Z. Wang, Y. Xue, Droid-sec: deep learning in android
malware detection, in: Proceedings of the 2014 ACM Conference on
[1] Gartner says worldwide sales of smartphones recorded first ever decline SIGCOMM, 2014, pp. 371–372.
during the fourth quarter of 2017, 2020, https://www.gartner.com/en/ [26] Number of smartphone users worldwide from 2016 to 2021, 2020,
newsroom/ (Accessed: 2020-03-12). https://www.statista.com/statistics/330695/number-of-smartphone-users-
[2] G. Raja, A. Ganapathisubramaniyan, S. Anbalagan, S.B.M. Baskaran, K. Raja, worldwide/ (Accessed: 2020-04-3).
A.K. Bashir, Intelligent reward-based data offloading in next-generation [27] M.K.A. Abuthawabeh, K.W. Mahmoud, Android malware detection and
vehicular networks, IEEE Internet Things J. 7 (5) (2020) 3747–3758. categorization based on conversation-level network traffic features, in:
[3] A. Rehman Javed, Z. Jalil, S. Atif Moqurrab, S. Abbas, X. Liu, Ensemble 2019 International Arab Conference on Information Technology (ACIT),
adaboost classifier for accurate and fast detection of botnet attacks in IEEE, 2019, pp. 42–47.
connected vehicles, Trans. Emerg. Telecommun. Technol. (2020) e4088. [28] F. Noorbehbahani, F. Rasouli, M. Saberi, Analysis of machine learning
[4] E. Lavoie, L. Hendren, Personal volunteer computing, in: Proceedings of techniques for ransomware detection, in: 2019 16th International ISC
the 16th ACM International Conference on Computing Frontiers, 2019, pp. (Iranian Society of Cryptology) Conference on Information Security and
240–246. Cryptology (ISCISC), IEEE, 2019, pp. 128–133.
[5] The mobile economy 2020, 2020, https://www.gsma.com/mobileeconomy/ [29] Android malware dataset (cicandmal2017 - first part), 2020, https://www.
(Accessed: 2020-03-12). unb.ca/cic/datasets/andmal2017.html (Accessed: 2020-03-12).

854
S.I. Imtiaz, S.u. Rehman, A.R. Javed et al. Future Generation Computer Systems 115 (2021) 844–856

[30] R. Chen, Y. Li, W. Fang, Android malware identification based on traffic [56] K. Hamandi, A. Chehab, I.H. Elhajj, A. Kayssi, Android sms malware:
analysis, in: International Conference on Artificial Intelligence and Security, Vulnerability and mitigation, in: 2013 27th International Conference on
Springer, 2019, pp. 293–303. Advanced Information Networking and Applications Workshops, IEEE,
[31] Intrusion detection evaluation dataset (cicids2017), 2020, https://www. 2013, pp. 1004–1009.
unb.ca/cic/datasets/ids-2017.html (Accessed: 2020-03-12). [57] SMS attacks and mobile malware threats, 2020, https://www.kaspersky.
[32] I. Sharafaldin, A.H. Lashkari, A.A. Ghorbani, Toward generating a new com/resource-center/threats/sms-attacks (Accessed: 2020-03-12).
[58] A.H. Lashkari, A.F.A. Kadir, L. Taheri, A.A. Ghorbani, Toward developing
intrusion detection dataset and intrusion traffic characterization, in: ICISSP,
a systematic approach to generate benchmark android malware datasets
2018, pp. 108–116.
and classification, in: 2018 International Carnahan Conference on Security
[33] M. Samara, E.-S.M. El-Alfy, Benchmarking open-source android mal-
Technology (ICCST), IEEE, 2018, pp. 1–7.
ware detection tools, in: 2019 2nd IEEE Middle East and North Africa
[59] M. Usman Sarwar, A. Rehman Javed, F. Kulsoom, S. Khan, U. Tariq,
COMMunications Conference (MENACOMM), IEEE, 2019, pp. 1–6.
A. Kashif Bashir, Parciv: Recognizing physical activities having complex
[34] D. Maiorca, F. Mercaldo, G. Giacinto, C.A. Visaggio, F. Martinelli, R- interclass variations using semantic data of smartphone, Softw. - Pract.
PackDroid: API package-based characterization and detection of mobile Exp. (2020).
ransomware, in: Proceedings of the Symposium on Applied Computing,
2017, pp. 1718–1723.
[35] P.P. Chan, W.-K. Song, Static detection of android malware by using
Syed Ibrahim Imtiaz is a MS scholar at National
permissions and api calls, in: 2014 International Conference on Machine
Center for CyberSecurity , Air University, Islamabad,
Learning and Cybernetics, Vol. 1, IEEE, 2014, pp. 82–87.
Pakistan. He is currently pursuing his degree in Masters
[36] D.-J. Wu, C.-H. Mao, T.-E. Wei, H.-M. Lee, K.-P. Wu, Droidmat: Android from Air University, Islamabad, Pakistan. His current
malware detection through manifest and api calls tracing, in: 2012 Seventh research interests include but are not limited to
Asia Joint Conference on Information Security, IEEE, 2012, pp. 62–69. cybersecurity, artificial intelligence, computer vision,
[37] M. Zhang, Y. Duan, H. Yin, Z. Zhao, Semantics-aware android mal- network security, IoT, smart city, and application de-
ware classification using weighted contextual api dependency graphs, velopment for smart living. He aims to contribute
in: Proceedings of the 2014 ACM SIGSAC Conference on Computer and to interdisciplinary research of computer science and
Communications Security, 2014, pp. 1105–1116. human-related disciplines.
[38] Y. Zhou, X. Jiang, Dissecting android malware: Characterization and evo-
lution, in: 2012 IEEE Symposium on Security and Privacy, IEEE, 2012, pp.
95–109.
[39] A.H. Lashkari, A.F.A. Kadir, H. Gonzalez, K.F. Mbah, A.A. Ghorbani, Towards Saif ur Rehman is a student at the Faculty of Comput-
a network-based framework for android malware detection and character- ing and AI, Air University, Islamabad, Pakistan. He is
ization, in: 2017 15th Annual Conference on Privacy, Security and Trust currently pursuing his degree in Bachelor of Science
(PST), IEEE, 2017, pp. 233–23309. in Computer Science from Air University, Islamabad,
[40] G. Draper-Gil, A.H. Lashkari, M.S.I. Mamun, A.A. Ghorbani, Characterization Pakistan. His current research interests include but
of encrypted and vpn traffic using time-related, in: Proceedings of the are not limited to cybersecurity, artificial intelligence,
2nd International Conference on Information Systems Security and Privacy computer vision, network security, IoT, smart city, and
(ICISSP), 2016, pp. 407–414. application development for smart living. He aims to
[41] A. Feizollah, N.B. Anuar, R. Salleh, G. Suarez-Tangil, S. Furnell, Androdialy- contribute to interdisciplinary research of computer
sis: Analysis of android intent effectiveness in malware detection, Comput. science and human-related disciplines.
Secur. 65 (2017) 121–134.
[42] W.Z. Zarni Aung, Permission-based android malware detection, Int. J. Sci.
Technol. Res. 2 (3) (2013) 228–234.
Abdul Rehman Javed is a lecturer at the Department
[43] C.-Y. Huang, Y.-T. Tsai, C.-H. Hsu, Performance evaluation on permission-
of CyberSecurity, Air University, Islamabad, Pakistan.
based detection for android malware, in: Advances in Intelligent Systems
He worked with National Cybercrimes and Forensics
and Applications-Volume 2, Springer, 2013, pp. 111–120.
Laboratory, Air University, Islamabad, Pakistan. He re-
[44] G. Canfora, E. Medvet, F. Mercaldo, C.A. Visaggio, Detecting android ceived his Master’s degree in Computer Science from
malware using sequences of system calls, in: Proceedings of the 3rd National University of Computer and Emerging Sci-
International Workshop on Software Development Lifecycle for Mobile, ences, Islamabad, Pakistan. He is a reviewer of many
2015, pp. 13–20. well-known journals, including, Sustainable cities and
[45] M.K. Alzaylaee, S.Y. Yerima, S. Sezer, Emulator vs real phone: Android society (Elsevier), Journal of Information Security and
malware detection using machine learning, in: Proceedings of the 3rd ACM Applications (Elsevier) and IEEE Access. His current
on International Workshop on Security and Privacy Analytics, 2017, pp. research interests include but are not limited to mobile
65–72. and ubiquitous computing, data analysis, knowledge discovery, data mining,
[46] Investigation of the android malware (cicinvesandmal2019), 2020, https: natural language processing, smart homes, and their applications in human
//www.unb.ca/cic/datasets/invesandmal2019.html (Accessed: 2020-03-12). activity analysis, human motion analysis and e-health. He aims to contribute
[47] M.T. Ahvanooey, Q. Li, M. Rabbani, A.R. Rajput, A survey on smart- to interdisciplinary research of computer science and human-related disciplines.
phones security: Software vulnerabilities, malware, and attacks, 2020, He has authored more than over 10 peer-reviewed articles on topics related to
arXiv preprint arXiv:2001.09406. cybersecurity, mobile computing and digital forensics.
[48] E. Erturk, A case study in open source software security and privacy:
Android adware, in: World Congress on Internet Security (WorldCIS-2012),
IEEE, 2012, pp. 189–191.
[49] Android malware genome project, 2020, http://www.malgenomeproject. Dr. Zunera Jalil received the B.Sc. degree from Pun-
org/ (Accessed: 2020-01-12). jab University, Lahore, Pakistan, in 1999, and then
Master2̆019s degree in computer science from Interna-
[50] W. Zhou, Y. Zhou, X. Jiang, P. Ning, Detecting repackaged smartphone
tional Islamic University, Islamabad, Pakistan. She later
applications in third-party android marketplaces, in: Proceedings of the
earned scholarship from Higher Education Commission
Second ACM Conference on Data and Application Security and Privacy,
of Pakistan to pursue M.S. degree in computer science
2012, pp. 317–326.
and then Ph.D. degree in computer science with infor-
[51] Q. Liao, Ransomware: a growing threat to smes, in: Conference Southwest
mation security specialization from the FAST-National
Decision Science Institutes, 2008.
University of Computer and Emerging Sciences, Islam-
[52] T. Micro, Ransomware Definition—Security Intelligence, TREND Micro,
abad, Pakistan, in 2007 and 2010, respectively. She
Irving, Tex, USA, 2015.
served at International Islamic University, Islamabad,
[53] P. Zavarsky, D. Lindskog, et al., Experimental analysis of ransomware on Iqra University, Islamabad and then Saudi Electronic University, Riyadh, Saudi
windows and android platforms: Evolution and characterization, Procedia Arabia. She is currently with the Department of CyberSecurity and is involved
Comput. Sci. 94 (2016) 465–472. with National Cybercrimes and Forensics Laboratory, Air University, Islamabad,
[54] S. Gupta, Types of malware and its analysis, Int. J. Sci. Eng. Res. 4 (1) Pakistan. Her current research interests include but are not limited to computer
(2013). forensics, intelligent systems, and data privacy protection.
[55] S. Omeleze, H.S. Venter, Testing the harmonised digital forensic investiga-
tion process model-using an android mobile phone, in: 2013 Information
Security for South Africa, IEEE, 2013, pp. 1–8.

855
S.I. Imtiaz, S.u. Rehman, A.R. Javed et al. Future Generation Computer Systems 115 (2021) 844–856

Xuan Liu graduated from Shandong University, China, IoT, IEEE CL, Elsevier, JNCA, Elsevier FGCS, Springer WINE, Springer TELS, IET
and received M.S. degree from Wuhan Polytechnic SMC, EAI CollaborateCom, and Wiley IJCS, etc. His research interests include
University, China and Ph.D. degree in computer sci- content network and governance, collaborate networking for smart cities, aerial
ence and engineering from Southeast University, China. communication systems, etc.
Since 2020, he joins Yangzhou University, China. He
is serving as an Advisory Editor of Wiley Engineering
Reports, an Associate Editor of Springer Telecommu- Waleed S. Alnumay received his bachelor degree in
nication Systems, IET Smart Cities, Taylor& Francis Computer Science from King Saud University, Riyadh,
International Journal of Computers and Applications Saudi Arabia in the year 1993. He did his master
and KeAi International Journal of Intelligent Networks, degree in Computer Science from University of Atlanta,
an Area Editor of EAI Endorsed Transactions on Internet Atlanta, Georgia, USA in the year 1996. He completed
of Things, the Lead Guest Editor of Elsevier Internet of Things, Wiley Transactions his Ph.D. in Computer Science from Oklahoma Uni-
on Emerging Telecommunications Technologies and Wiley Internet Technology versity, Norman, Oklahoma, USA in the year 2004.
Letters, and the Chair of CollaborateCom 2020 workshop. He serves/served as a Dr. Alnumay is currently working as an Associate
TPC Member of ACM MobiCom 2020 workshop, IEEE INFOCOM 2020 workshop, Professor of Mobile Networking in Computer Science
IEEE ICC 2020/2019, IEEEGlobeCom 2019, IEEE PIMRC 2020/2019, IEEE MSN Department, King Saud University. He has published
2020, IEEE VTC 2020/2019/2018, IEEE ICIN2020, IEEE GIIS 2020, IEEE DASC 2019, research papers in reputed international conferences
APNOMS 2020/2019, Ad Hoc-Now2020, FNC 2020/2019, EAI CollaborateCom and journals. His main research interest is Computer Networks and Distributed
2020/2019, and EAI ChinaCom 2019, etc. Furthermore, he has been reviewing Computing that includes but not limited to Mobile Ad hoc and Sensor Networks,
papers for 20+ reputable conferences/journals including IEEE INFOCOM, IEEE Information-Centric Networking and Software-Defined Networking.
ICC, IEEE GlobeCom, IEEE WCNC, IEEE PIMRC, IEEE COMMAG, IEEE TII, IEEE

856