EfficientNet deep learning meta-classifier approach for image-based android malware detection

Abstract

A survey of literature shows that transforming the application files into images and employing deep learning-based models for image classification has been considered as one of the significant directions for malware detection and classification. Mainly, convolutional neural networks (CNN)-based models are successfully employed for Android malware detection and classification. This is mainly due to the reason that this type of malware detection and classification approach is platform independent and has the capability to detect metamorphic and polymorphic malware. The Image-based Android malware detection is resilient to both unpacked and packed malware. Following, this work employs various 26 CNN-based pretrained models and the detailed investigation and analysis of experiments are shown on the Image-based Android malware dataset. Each of these models have the capability to extract its own optimal features and these features are distinct to each other. The penultimate layer features of best performed CNN-based pretrained models are extracted and dimensionality of the features were reduced using kernel principal component analysis (KPCA). The reduced features were fused together and passed into a meta-classifier or stacked classifier for classification. This classifier has two levels; in the first level support vector machine (SVM) and random forest (RForest) machine learning classifier were included for prediction and logistic regression in the second level for classification. The four combinations of fused models are DenseNet, ResNet, InceptionResNet, and EfficientNet. EfficientNet-based fused models showed better performances compared to other fused models and non-fused CNN-based pretrained models. Moreover, the EfficientNet-based fused models outperformed the existing approaches for Android malware detection. All the model performances were shown on two different testing datasets and the proposed model has shown the similar performances on both the testing datasets with attaining better performances during training and testing. This indicates that the proposed model is more generalizable, robust, and it can be used as tool that can be deployed in any application play store.