Explaining Machine Learning Classifiers For Android Malware Detection

Abstract

The prevalence of Android malware continues to rise, and traditional approaches are proving ineffective against the evolving tactics of direct attacks. Manually inspecting applications is no longer a practical solution. Machine learning has demonstrated success in various domains, and its high performance in Android malware detection positions it to be effectively deployed in real-world scenarios. However, real-world results have yet to align with experimental findings, and the unique requirements of the security field have led to a lack of trust in its practical application. This research aims to address this issue by utilizing best practices for conducting experiments to eliminate experimental bias and employing explanation methods to enhance the transparency and robustness of the classifier. These measures are critical for building trust among security experts, with transparent, learning-based malware detection being a paramount necessity in the security system. Providing thorough explanations is key to informed decision- making. The research utilizes activities, services and receivers feature sets from Drebin feature extraction to explore the significance of feature sets and employs explanation methods to gain deeper insights into the model.