A PERMISSION-BASED MACHINE LEARNING MODEL FOR ANDROID RANSOMWARE DETECTION

Abstract

Ransomware is among the most disruptive types of malware that present a threat to the Android ecosystem, blocking access to a victim's files or device with the aim of extorting ransom in return. The permission list provided in an Application's manifest—available without code execution or dynamic instrumentation, but requiring the application to explicitly say what sensitive capabilities it will use—is a lightweight, static and computationally inexpensive signal for distinguishing malicious intent from legitimate functionality. In this research, a balanced dataset consisting of 995 benign and 995 ransomware application samples is decompiled and analyzed to extract 365 distinct attributes based on permissions, and a machine learning model that detects the ransomware is developed by using these attributes. The data-mining suite (Weka) was used to create and test four classifiers: Logistic Regression, Random Tree, Decision Table and Bayes Network, using the 10-fold cross validation method. The overall accuracy for Logistic Regression was the highest (97.69%), followed by Bayes Network (96.88%), Random Tree (96.53%) and Decision Table (95.73%). A second comprehensive permission-level analysis also pinpoints RECEIVE_BOOT_COMPLETED, SYSTEM_ALERT_WINDOW and MOUNT_UNMOUNT_FILESYSTEMS as the most powerful permissions that distinguish between benign and ransomware activities. The findings show that permission-based features provide high accuracy ransomware classification and can be a viable first-line defense in resource-limited pre-installation detection pipelines, like app-store vetting.