Explainable Lightweight Hybrid Ensemble Learning for Android Malware Detection Using Optimized Permission Features

Abstract

The increase in the number of Android applications being developed and used has increased the potential threat of malware attacks on mobile devices and Internet of Things (IoT) devices that have little processing power available to them. The current methods for detecting malware use two different types of techniques. One uses deep learning-based models that perform computations in a resource-intensive way and are not suited for real-time execution. The other uses less resource-intensive machine-learning-based techniques that do not provide a high level of accuracy or provide interpretability. This paper developed a new lightweight and explainable hybrid ensemble framework named Adaptive Confidence Weighted Soft Voting (ACWSV) specifically for detecting malware in Android applications. This framework uses combinations of Chi-square based feature selection, adaptive confidence-based ensemble learning, and SHAP-based explainability to enhance accuracy while maintaining efficient computation. The use of feature optimization reduced the size of the Drebin dataset's permission feature set from 87 to only 20 attributes. This decreased the computational complexity of classifying Android applications without reducing the discriminative power of the feature set. Using the Drebin dataset containing a total of 29,332 applications, experiments using the ACWSV framework resulted in accuracies of 95.51%, F1-scores of 0.9556, and area under the curve (AUC) scores of 0.9863, which are statistically significantly better than the each of the individual classifiers used to perform train/test splits using the Wilcoxon signed-rank test $(p=0.031)$. The extensive ablation studies performed using the ACWSV framework were verified using 10-fold stratified cross-validation (95.48 ± 0.41%), and were subjected to runtime analysis (average inference time of 4.7 ms with an average memory usage of 94 MB). In addition to supporting the validity of the developed framework, the results from this research illustrate the use of the ACWSV framework for performing real-time, explainable malware detection in Android applications through a deployed Flask application.