DFRMIdroid: A Comprehensive Fusion Approach Utilizing Permissions and Intents Analysis with the DFR-MI Algorithm for Enhanced Malware Detection on Android Devices

Smartphones based on the Android operating system are increasingly popular due to their multifunctional capabilities in various fields.However, these functions have also encouraged intruders to develop applications that perform malicious actions, including stealing sensitive data, encrypting files for ransom, and sending unauthorized SMS messages without user consent.In this study, we proposed a new and comprehensive dataset containing 32,170 samples distributed equally between malicious and benign applications developed on different API levels.The dataset includes two categories of features: permissions and intents.We also proposed a new feature selection method called Discriminative Feature Ranking-Mutual Information (DFR-MI) which selects optimal features from the more frequent features in the dataset and this helped the predictive model to achieve high performance.Nine machine-learning algorithms were tested, and the results show that our dataset outperforms the Drebin dataset by at least 2.22% in combining permissions with intents for detecting malicious apps.Additionally, the DFR-MI algorithm obtained better results in selecting features and took less time than the mutual information algorithm.Among all tested machine-learning algorithms, the random forest algorithm achieved high scores in terms of accuracy, precision, recall, and F1 score, which were 98.52%, 98.62%, 98.41%, and 98.52%, respectively.Our proposed method enhances mobile security by scrutinizing an app's declared permissions and communication patterns between its components.This approach allows for a more comprehensive understanding of an app's behavior, enabling early detection of potential threats generated from Android applications.