Machine Learning for Android Scareware Detection

Sikha Bagui, Hunter Brock

Source Title: Journal of Information Technology Research (JITR)15(1)

ISSN: 1938-7857|EISSN: 1938-7865|EISBN13: 9781683180340|DOI: 10.4018/JITR.298326

MLA

Bagui, Sikha, and Hunter Brock. "Machine Learning for Android Scareware Detection." JITR vol.15, no.1 2022: pp.1-15. http://doi.org/10.4018/JITR.298326

APA

Bagui, S. & Brock, H. (2022). Machine Learning for Android Scareware Detection. Journal of Information Technology Research (JITR), 15(1), 1-15. http://doi.org/10.4018/JITR.298326

Chicago

Bagui, Sikha, and Hunter Brock. "Machine Learning for Android Scareware Detection," Journal of Information Technology Research (JITR) 15, no.1: 1-15. http://doi.org/10.4018/JITR.298326

Export Reference

Favorite Full-Issue Download

View Full Text HTML

View Full Text PDF

Abstract

With the steady rise in the use of smartphones, specifically android smartphones, there is an ongoing need to build strong Intrusion Detection Systems to protect ourselves from malicious software attacks, especially on Android smartphones. This work focuses on a sub-group of android malware, scareware. The novelty of this work lies in being able to detect the various scareware families individually using a small number of network attributes, determined by a recursive feature elimination process based on information gain. No work has yet been done on analyzing the scareware families individually. Results of this work show that the number of bytes initially sent back and forth, packet size, amount of time between flows and flow duration are the most important attributes that would be needed to classify a scareware attack. Three classifiers, Decision Tree, Naïve Bayes and OneR, were used for classification. The highest average classification accuracy (79.5%) was achieved by the Decision Tree classifier with a minimum of 44 attributes.