Hybrid AI-Powered Android Malware Detection System

A hybrid static and dynamic Android malware analysis platform using machine learning classifiers (Random Forest & XGBoost). Built as a final year academic project to demonstrate multi-modal mobile security verification.

---

📸 App Preview

---

📐 System Architecture

The platform performs dual-channel analysis to determine malware verdicts:

graph TD
    A[Upload APK File] --> B(Static Analysis Engine)
    A --> C(Dynamic Behavior Log Parser)
    
    B --> B1[Androguard Extraction]
    B1 --> B2[Permissions & API Vectors]
    
    C --> C1[Behavioral Signature Matches]
    
    B2 --> D[Machine Learning Models]
    C1 --> D
    
    D --> D1[Random Forest Predictor]
    D --> D2[XGBoost Predictor]
    
    D1 --> E[Hybrid Consensus Verdict]
    D2 --> E
    
    E --> F[Next.js Dashboard Display]

Loading

---

✨ Features

• Static Analysis Channel:
  • Fast extraction of permissions and Android Manifest attributes using Androguard.
  • Auditing of 14 highly sensitive API signatures (e.g. sendTextMessage, getDeviceId, Runtime;->exec).
  • Optional Deep Structural Decompilation via Jadx command line integration.
• Dynamic Analysis Channel:
  • Real-time log parsing for behavioral traits: detects anomalous network socket requests, file writes, and background service execution.
• Explainable AI (XAI) Integration:
  • Integration of model prediction explanation framework (SHAP) to visualize feature contributions.
• Modern User Interface:
  • Fully responsive web interface styled with Tailwind CSS v4 and animated using Framer Motion.
  • Interactive history, metrics visualization, and live file uploads.

---

📊 Dataset & Model Performance

• Dataset Source: Meta-data obtained from Androzoo and curated samples.
• Feature Space: 21-vector static permissions and API call flags.
• Evaluation Metrics:

  Classifier	Accuracy	Precision	Recall	F1-Score
  Random Forest	94.2%	93.8%	94.5%	94.1%
  XGBoost	93.6%	92.9%	94.1%	93.5%

Note: The system implements a High Recall (Hybrid) consensus logic—if either model flags an APK as malicious, it is categorized as malware to minimize false negatives.

---

🚀 Setup & Installation

Prerequisites

• Python 3.10+
• Node.js 18+ (for frontend)
• Jadx (optional, for Deep Scan feature)

1. Run the Backend API

1. Navigate to the project directory:

   cd android-malware-detector

2. Install dependencies:

   pip install -r requirements.txt

3. Start the Flask application:

   python app.py

   The backend will boot up at http://127.0.0.1:5000.

2. Run the Next.js Frontend

1. Navigate to the frontend directory:

   cd android-malware-detector/frontend

2. Install Node modules:

   npm install

3. Start the dev server:

   npm run dev

   The frontend dashboard will be available at http://localhost:3000.

---

📁 Repository Layout

• android-malware-detector/app.py: Backend Flask Server.
• android-malware-detector/frontend/src/app/page.tsx: Frontend React layout.
• android-malware-detector/models/: Pretrained weights (.pkl files).
• android-malware-detector/src/: Source modules for feature extraction, predictions, and models.
• android-malware-detector/scripts/: Dataset setup and testing utilities.
• android-malware-detector/tests/: Placeholder for unit test cases.

---

📜 License

Licensed under the MIT License.