A precise method of identifying Android application family

Abstract

AbstractImplementing the necessary countermeasures to detect the growing and highly destructive family of malware is an urgent obligation. The proliferation and diversity of malware make these problems more challenging. For beginners, it is arduous to attain crucial features for multi‐class family classification and extract valuable information from the obtained features. Another issue is that building a classification model that effectively absorbs multi‐class samples and adapts to various features is challenging. This work indicates a precise identification method for Android application families (ANDF) to tackle these issues. It perceptively analyzes the features that multi‐class families can utilize to identify members and further excavates the relationship between implicit information and the severity of those distinctions. A more appropriate classification model is developed for the heterogeneous file formats, and a more beneficial feature with a diverse array of heterogeneous information is chosen as the replacement representation of the sample. It is capable of upgrading learning ability and mastering the multi‐modal traits of the family malware. The application of ANDF to real data sets yields effective classification results. It is capable of 0.9800 in f1‐macro and has a classification accuracy of 98.61%. It performs, respectively, 0.0088 points better than the two‐feature comparison classification model and 0.0872 points better than the single‐feature comparison classification model. The kappa coefficient can also exceed 0.9830, which is at least 0.1044 higher than other contrasting classifiers and is 0.0105 greater than that of the contrasted model containing two features, which is 0.1046 larger than the classifier with a contrasting single feature.