Assessment of the Detection Capacity of Normalized Gammachirp Cepstral Coefficients in Android Malware

Android has grown to become the leading mobile operating system on the market due, in part, to its popularity and open-source nature. On the other hand, the Android ecosystem has become a fertile ground for malware, posing substantial security risks to ordinary mobile users. This is hardly surprising given the sheer number of devices it controls. Despite several research efforts over the years, Android malware detection remains a challenge. This is largely due to the fact that it is still unknown which features or combination of features can effectively distinguish malicious Android applications from benign ones. To this end, this research explores an Android malware detection system that uses the low-level audio Normalized Gammachirp Cepstral Coefficients as features to classify malware with machine learning techniques. First, we convert the Android Application Package datasets into audio datasets, then extract the audio features. To evaluate our approach, twenty-four machine learning algorithms were implemented, and results were collected. The experimental results show that the proposed malware features achieved the highest accuracy, precision, recall, f1-score and AUC and with respective values of 97.6%, 98.3%, 98.6%, 98.4% and 96.4%%. It also achieved 98% area under the precision-recall curve indicating that Normalized Gammachirp Cepstral Coefficients are effective for Android malware classification. Moreover, the processing and detection times were also reasonably short. Amongst the best-performing models were Extratrees, Random forest, CatBoost, XGBoost and KNeighbors.