DyBAnd: Dynamic Behavior Based Android Malware Detection

Android is the most popular widely accessible smartphone operating system, yet its permission declaration and access control systems cannot detect malicious activities. Advanced malware uses cutting-edge obfuscation techniques to mask its true intentions from scanning engines, and traditional malware detection approaches are no longer effective in such cases. In this paper we propose DyBAnd, an Android malware detection approach based on Multilayer Perceptron, a neural network-based model for recognising dynamic malware activity. DyBAnd makes use of behavioural characteristics gleaned via dynamic analysis of a program running in an emulated environment, allowing it to detect malicious code in real time environment. The proposed system is tested against 17,341 contemporary applications from various domains, including Banking, Riskware, Adware, SMS, and Benign. Experimental results show that DyBAnd detects malware with a 98.98% accuracy and a false positive rate of 1.02%, significantly higher than Linear Programming. DyBAnd also outperforms conventional machine learning techniques.