LAMDEX: an explainable lightweight Android malware detection system for enhancing IoT APP security

Abstract

Abstract The widespread adoption of the Internet of Things (IoT) has led to a substantial increase in the use of Android applications (apps) designed for IoT operations. Android surpasses all other operating systems (OS) in terms of device usage due to its massive user base of approximately 2 billion active devices. Its popularity extends beyond smartphones, as it is the OS for vehicles, tablets, smart appliances, and various IoT devices. However, this pervasiveness of the Android OS has created security challenges. The rising popularity of Android has fueled the creation and distribution of numerous harmful apps, often crafted to deceive unsuspecting users. These malicious apps pose a serious threat to the security and privacy of Android users, potentially resulting in unauthorized access, data breaches, and other harmful activities. This paper introduces LAMDEX, a lightweight Android malware detection system based on explainable machine learning to improve security and transparency. The proposed system uses features extracted from apps to identify benign and malicious apps. Extensive testing has demonstrated that the proposed system delivers exceptional performance, achieving an accuracy rate of over $$98.8\%$$ , an F1 score of $$99.3\%$$ , and a testing time of just 0.33 s all while operating efficiently with minimal resource usage on the device. Furthermore, the classifier model is explained using Shapley additive Explanation scores, providing insight into the reasoning behind the classification decisions.