Android Ransomware Detection Application Using Deep Learning
摘要
The Android operating system holds the highest market share among operating systems worldwide. Aside from cyber attack, in particular, ransomware attacks and ransom payment rates increase each year. Traditional ransomware detection methods may not be able to handle increasingly sophisticated attack patterns. Thus, this research proposes the development of a ransomware detection application by implementing deep learning combined with data preprocessing and feature selection techniques through an ensemble model that integrates Deep Neural Network (DNN) and Convolutional Neural Network (CNN). The operation comprises of two approaches: (1) static analysis that examines application permissions without executing the application, and (2) dynamic detection that simulates application execution on a server, as a sandbox, to analyze API calls. The performance evaluation of our ensemble model outperformed the baseline models in terms of accuracy, precision, recall, and F1-score, i.e., 97.73%, 89.38%, 96.33%, and 92.36%, respectively, for static analysis and 98.50%, 96.39%, 96.78%, and 96.55%, respectively, for dynamic analysis. In addition, the actual testing on Android phone, real environments, with the test datasets, reveal 100% in accuracy.