Android malware classification based on permission categories using extreme gradient boosting

Mobile malware has become the centerpiece of most security and privacy threats on the Internet. Especially with the openness of the Android market, many malicious apps are hiding in a large number of applications, which makes malware detection more challenging. In this study, eXtreme Gradient Boosting (XGBoost) is used to establish the Android-based malware detection and classification framework. The framework utilizes APK permission categories extracted from Android applications. The comparison of modeling results demonstrates that the XGBoost is especially suitable for Android malware classification and can achieve 74.40% of F1-score with real-world Android application sets.