Android Malware Classifier

A Python toolkit for classifying Android malware by family. The project extracts static features from APK files and trains several machine-learning models — from raw byte images and API-call graphs to opcode n-grams and permission/intent filters — then combines them in a cascading ensemble for prediction.

Tech Stack

Layer	Technology
Language	Python 2.7
APK Analysis	Androguard (vendored), apkil
Disassembly	baksmali (Java)
ML — Classical	scikit-learn (Random Forest)
ML — Deep Learning	Keras (CNN)
Data Processing	pandas, NumPy, SciPy
Graphs	NetworkX, matplotlib
Images	Pillow, scipy.misc

Features

• Classify APK files into 4 malware families: Scareware, SMSmalware, Adware, Ransomware
• Image approach — treat the first N bytes of an APK as a grayscale image and classify with Random Forest
• Graph approach — build a call graph from API invocations, hash package-pair edges into n-gram features, classify with Random Forest
• Grayscale Image (CNN) approach — convert graph JSON into images and classify with a Keras convolutional network
• Opcode approach — extract Dalvik opcode sequences via baksmali, build n-gram features, classify with Random Forest (most effective single method)
• Permission-based approach — extract intent filters and permissions via Androguard, classify with Random Forest
• Ensemble pipeline — cascade Graph → Image → Opcode and pick the result with the highest confidence

Architecture

The project is organized as a collection of independent classification approaches under approaches/, with shared utilities and vendored analysis libraries:

android_malware_classifier/
├── approaches/
│   ├── image/              # Raw-byte image features + Random Forest
│   ├── graph/                # API call graph extraction, training, prediction
│   ├── grayscaled_image/     # Graph JSON → image → Keras CNN
│   ├── n_gram/               # Opcode n-gram extraction + Random Forest
│   ├── permission_based/     # Intent/permission features + Random Forest
│   └── combination.py        # Cascading ensemble predictor
├── androguard/               # Vendored Androguard library
├── apkil/                    # Vendored smali/APK parsing tools
├── hmmpytk/                  # Hidden Markov Model utilities
├── utils/                    # constants, opcode extraction, CSV helpers
├── csv_files/                # Precomputed feature matrices and labels
└── combine.py                # Feature fusion trainer (n-gram + image)

Prediction flow (ensemble): APK → Graph classifier → if confidence < 0.5 → Image (CNN) → if confidence < 0.5 → Opcode classifier → pick highest-confidence result

Each approach follows the same pattern: pre-processing (feature extraction → CSV/JSON) → train (fit model) → predict (classify a single APK).

Dataset Structure

Training APKs are expected in a folder hierarchy grouped by malware family:

dataset/
├── Scareware/
│   ├── sample1.apk
│   └── sample2.apk
├── SMSmalware/
│   └── ...
├── Adware/
│   └── ...
└── Ransomware/
    └── ...

Label and class mapping files live in csv_files/ (trainLabels.csv, subtrainLabels.csv, classes.csv).

Getting Started

1. Clone the repository
2. Install dependencies: Python 2.7, Java (for baksmali), scikit-learn, pandas, NumPy, Keras, NetworkX, matplotlib, Pillow, SciPy
3. Update paths in utils/constants.py — set FOLDER_ROOT, dataset locations, and MODEL_IMG_GRAYSCALE to match your environment
4. Place baksmali.jar at the path specified by BACKSMALI_PATH
5. Prepare the dataset in the folder structure described above

Training pipeline

Run scripts from their respective directories inside approaches/:

# Extract features
python approaches/image/asmimage.py
python approaches/n_gram/opcode_n-gram.py
python approaches/graph/graph_pre_processing.py
python approaches/graph/graph_train_model.py
python approaches/grayscaled_image/converter.py
python approaches/grayscaled_image/img_train_model2.py

# Train individual classifiers
python approaches/image/firstrandomforest.py
python approaches/n_gram/secondrandomforest.py

# Train combined model (n-gram + image features)
python combine.py

Or use the convenience script:

bash run.sh

Prediction

Classify a single APK with the cascading ensemble:

python approaches/combination.py

Edit the predict(...) call at the bottom of combination.py to point to your target APK file.

Approaches Overview

Approach	Feature source	Classifier	Key files
Image	First N bytes of APK as pixel matrix	Random Forest	asmimage.py, firstrandomforest.py
Graph	API call edges (package → package) hashed into n-grams	Random Forest	graph_pre_processing.py, graph_train_model.py, graph_predict.py
Grayscale Image	Graph JSON rendered as 255×255 image	Keras CNN	converter.py, img_train_model2.py
Opcode	Dalvik opcode sequences as n-grams	Random Forest	opcode_n-gram.py, secondrandomforest.py
Permission-based	Intent filters + permissions from manifest	Random Forest	pre_processing.py, train_test.py

License

MIT