LSTM-Based Hierarchical Denoising Network for Android Malware Detection

Table 3

Comparing HDN with related works.

Methods	Features	Dataset	Benignware	Malware	Accuracy (%)	Precision	Recall	1-score	TPR (%)	FPR (%)
DroidSIFT [34]	API dependency graph	BD1 (Genome)	13,500	1,260	-	-	-	-	98	5.15
CNN [35]	opcode patterns	BD1 (Genome)	863	1,260	98	0.99	0.95	0.97	-	-
DroidDetective [36]	permission-combination	BD1 (Genome)	741	1,260	96	0.89	0.96	0.92	-	-
Yerima et al. [37]	API calls, permissions, cmnds	BD1 (Genome)	1,000	1,000	91	0.94	0.91	0.92	-	-
Jerome et al. [7]	opcode -grams	BD1 (Genome)	1,260	1,246	-	-	-	0.98	-	-
CSBD [38]	CFG	BD1 (Genome)	1,247	1,247	-	0.93	0.905	0.91	-	-
HDN	opcode patterns	BD1 (Genome)	1,260	1,260	99.2	0.993	0.985	0.989	97.87	0.5
Opcode ngrams [21]	opcode -grams	BD2 (Drebin)	5,560	5,560	96.88	0.957	0.981	0.963	-	-
ICCDetector [12]	ICC-related feature	BD2 (Drebin)	12,026	5,264	97.4	-	-	-	93.1	0.67
RCP [39]	permissions	BD2 (Drebin)	123,453	5,560	-	-	-	-	17	1
KIRIN [40]	permissions	BD2 (Drebin)	123,453	5,560	-	-	-	-	39	5
Peng et al. [6]	permissions	BD2 (Drebin)	123,453	5,560	88.2	-	-	-	45	1
Drebin [13]	API calls, intents, permissions, cmnds	BD2 (Drebin)	123,453	5,560	-	-	-	-	93.9	1
HDN	opcode patterns	BD2 (Drebin)	5,600	5,560	98.82	0.991	0.977	0.984	97.44	0.5
2-gram SVM	opcode -grams	ITW (Androzoo)	20,000	20,000	95.17	-	-	-	88.67	0.5
3-gram SVM	opcode -grams	ITW (Androzoo)	20,000	20,000	96.14	-	-	-	90.02	0.5
HDN	opcode patterns	ITW (Androzoo)	20,000	20,000	99.42	-	-	-	98.18	0.5

Note. - means that the authors did not evaluate this index or did not mention it in the paper.