Ai-assisted malware detection and performance analysis in android software

Nowadays, as smart devices have become an integral part of our lives, the android operating system, which is predominantly used in these devices, is becoming increasingly widespread. In parallel with this situation, the interest of cyber attackers is turning towards android-based applications. According to Kaspersky's 2022 mobile threat report, more than 1.5 million malware have been detected in the android environment in the last year. Therefore, malware detection has become one of the most important issues in the fields of cybercrime and cyber security. Machine learning based studies are of great importance in malware detection. The aim of this thesis is to perform malware detection using the features obtained through static analysis on an original dataset containing current threats and compare the performance outputs of various machine learning methods. The dataset used in this study consists of 3,098 malicious and 11,000 benign android installation files published in the 3rd quarter of 2022. In total, 528 distinctive permission features specific to the android operating system were extracted from 14098 installation files with static analysis methods and a data matrix was obtained. First, malware detection was performed on our dataset with support vector machines, k-nearest neighbor, random forest, naive bayes, multilayer perceptron network, LightGBM and XGBoost classifiers. In the second stage, in order to improve the detection performance, feature selection methods (genetic algorithm, ant colony, hill climbing) and the specified classification algorithms were tested and their performance outputs were analyzed. The LightGBM algorithm showed the highest performance with an accuracy of 0.98, precision of 0.96 and sensitivity of 0.90.