Optimizing Android Malware Detection with Joint Feature Selection and Hidden Node Tuning: A BIGSA-HNO-ELM Framework

Abstract

The growing complexity and scale of Android malware present significant challenges for the development of detection systems that are both accurate and computationally efficient. Traditional machine learning methods often struggle with high-dimensional feature spaces and poorly optimized model architectures, leading to degraded accuracy and excessive resource consumption. To address these limitations, we propose a unified malware detection framework—BIGSA-HNO-ELM—that integrates Binary Improved Gravitational Search Algorithm (BIGSA) for robust feature selection with Hidden Node Optimization (HNO) applied to an Extreme Learning Machine (ELM) classifier. Evaluated on the KronoDroid dataset comprising over 78,000 Android applications with 464 hybrid static and dynamic behavioural features, the proposed framework achieves a 77% reduction in feature dimensionality, significantly lowering computational overhead while preserving high detection accuracy. Through HNO, the optimal number of ELM hidden neurons is dynamically determined, enhancing generalization and reducing overfitting. Comprehensive experiments demonstrate that the BIGSA-HNO-ELM model achieves 98.0% accuracy, 97.4 % precision, 96.2 % recall, 96.8 % F1-Score and an AUC-ROC of 97.0%, substantially outperforming baseline methods. Statistical significance testing (paired t-tests and Wilcoxon signed-rank tests, p < 0.01) confirms the robustness of these performance gains and demonstrates superior stability across 10-fold cross-validation with minimal variance in performance metrics. This integrated optimization approach not only improves predictive performance but also supports deployment in resource-constrained and real-time environments, making BIGSA-HNO-ELM a compelling solution for modern Android malware detection.