A Performance Evaluation on Distance Measures in KNN for Mobile Malware Detection
Gianmarco Baldini, Dimitris Geneiatakis · 2019
Most of the related works on mobile malware detection for Android Operating System (OS) that are based on machine learning often use classifiers' default settings, and focus on opting either the optimal features or classifier. Even if this approach is understandable and it has proven to provide valuable results classifiers different hyper-parameters should be configured properly in order to achieve classifier's best performance. Thus, this paper investigates the performance of one of the most simple machine learning classifier, such as K Nearest Neighbor (KNN), considering its different hyper-parameters with emphasis on different distance measures. The authors have performed an extensive comparison using various well known distance measures over the Drebin data set. Results show that the proper choice of the distance measure can provide a significant enhancement to the classification accuracy. Specifically, the Euclidean distance that is mostly used for KNN is not the optimal option, instead other distance measures i.e., Hamming, CityBlock, can boost classifier's performance in the context of mobile malware detection. For instance, CityBlock can improve KNN false positive rate up to 33% in comparison to the Euclidean distance.