A Multi-stage Android Malware Detection Framework Using GRU and Semi-Supervised Autoencoder

Android has become the top targeted smartphone operating system prone to malware attacks.Existing static and dynamic feature analysis methods each have strengths but often fall short when use in isolation.Thus, in this paper a multi stage detection framework is presented that integrates static and dynamic methods together with deep learning models.In the first stage a Gated Recurrent Unit (GRU) classifier is trained on features extracted statically from Android applications to filter out known malwares.While in the second stage applications predicted as benign will undergo further evaluation to extract their dynamic features using the Frida tool.The Autoencoder will be trained solely on dynamic features of benign applications, by learning their normal behaviours and setting a threshold value.The GRU model achieves 99.88% accuracy for static classification.While the Autoencoder derives a threshold value that can detect any unseen malware with accuracy of 97% for a test set of 300 unseen applications.