A Multimodal Malware Detection Technique for Android IoT Devices Using Various Features

• Main Authors: Rajesh Kumar, Xiaosong Zhang, Wenyong Wang, Riaz Ullah Khan, Jay Kumar, Abubakar Sharif
• Format: Article
• Language: English
• Published: IEEE 2019-01-01
• Series: IEEE Access
• Subjects: Android malware detection; blockchain; Internet of Things (IoT); clustering; secure machine learning
• Online Access: https://ieeexplore.ieee.org/document/8721053/

Internet of things (IoT) is revolutionizing this world with its evolving applications in various aspects of life such as sensing, healthcare, remote monitoring, and so on. Android devices and applications are working hand to hand to realize dreams of the IoT. Recently, there is a rapid increase in threats and malware attacks on Android-based devices. Moreover, due to extensive exploitation of the Android platform in the IoT devices creates a task challenging of securing such kind of malware activities. This paper presents a novel framework that combines the advantages of both machine learning techniques and blockchain technology to improve the malware detection for Android IoT devices. The proposed technique is implemented using a sequential approach, which includes clustering, classification, and blockchain. Machine learning automatically extracts the malware information using clustering and classification technique and store the information into the blockchain. Thereby, all malware information stored in the blockchain history can be communicated through the network, and therefore any latest malware can be detected effectively. The implementation of the clustering technique includes calculation of weights for each feature set, the development of parametric study for optimization and simultaneously iterative reduction of unnecessary features having small weights. The classification algorithm is implemented to extract the various features of Android malware using naive Bayes classifier. Moreover, the naive Bayes classifier is based on decision trees for extracting more important features to provide classification and regression for achieving high accuracy and robustness. Finally, our proposed framework uses the permissioned blockchain to store authentic information of extracted features in a distributed malware database blocks to increase the run-time detection of malware with more speed and accuracy, and further to announce malware information for all users.