A recent report indicates that there is a new malicious app introduced every
4 seconds. This rapid malware distribution rate causes existing malware
detection systems to fall far behind, allowing malicious apps to escape vetting
efforts and be distributed by even legitimate app stores. When trusted
downloading sites distribute malware, several negative consequences ensue.
First, the popularity of these sites would allow such malicious apps to quickly
and widely infect devices. Second, analysts and researchers who rely on machine
learning based detection techniques may also download these apps and mistakenly
label them as benign since they have not been disclosed as malware. These apps
are then used as part of their benign dataset during model training and
testing. The presence of contaminants in benign dataset can compromise the
effectiveness and accuracy of their detection and classification techniques. To
address this issue, we introduce PUDROID (Positive and Unlabeled learning-based
malware detection for Android) to automatically and effectively remove
contaminants from training datasets, allowing machine learning based malware
classifiers and detectors to be more effective and accurate. To further improve
the performance of such detectors, we apply a feature selection strategy to
select pertinent features from a variety of features. We then compare the
detection rates and accuracy of detection systems using two datasets; one using
PUDROID to remove contaminants and the other without removing contaminants. The
results indicate that once we remove contaminants from the datasets, we can
significantly improve both malware detection rate and detection accuracy