Hybrid Machine Learning Framework for Android Vulnerability Detection and Risk Scoring

Abstract

As the number of Android devices increases, the threat to these devices has also risen to new heights, making it necessary to use advanced assessment techniques that enable proactive threat identification and mitigation. Currently used Android scanners are mainly based on either static or dynamic analysis technologies, which only allows them to detect simple or known malicious applications with low accuracy. In this paper, a machine learning based Android Application Vulnerability Scanner for comprehensive risk assessment is proposed to address these challenges. Android Package Kit (APK) files are first pre-processed, such as decompiling, validating and normalizing the data prior to analysis. It is then followed by Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) to derive attributes like permissions, API calls, runtime behaviours, network activities, system calls and more. The most relevant characteristics are retained by extracting them and optimizing with Chi-Square feature selection technique. The features selected are then given to a Random Forest classifier for precise identification and categorization of potential weaknesses. Lastly, an Enhanced Common Vulnerability Scoring System (CVSS) based mechanism is used to assess the severity of the issues identified and create a prioritized report and remediation suggestions. The results show that the classification accuracy, risk prioritization capability and assessment performance were better than traditional standalone scanning methods.