Jul 2026· Journal of Computer Virology and Hacking Techniques· Vol 22· 0 citations· 16 references
Computer Science
TL;DR
The results have shown how well-engineered static features coupled with overfitting-aware ensemble design can give robust results of multi-class malware classification in the absence of dynamic traces, to develop additional resilience from obfuscation and runtime-evasive threats.
The swift growth in the quantity of Android applications has resulted in a similar increase in the threat of malware, compromising the privacy and security of users. This research introduces a framework aimed at efficiently identifying malware within Android applications through machine learning techniques. Various classification models, including Logistic Regression, Support Vector Machine, Random Forest, Gradient Boosting, and an Ensemble model, were utilized and tested in this study. The framework utilizes a publicly available dataset from the Kaggle platform, consisting of both benign and malicious APK files. Based on the experimental results, we have noted that the Ensemble model outperformed than other classification models in our research, we got the markable accuracy rate of 92.56%.
S. Ramya, Baratam Sahith, Bokka Teenanjani et al.· 2026 4th International Confe...· 0 citations
Despite outstanding results, machine learning-based Android malware detection models struggle with concept drift, where rapidly evolving malware characteristics degrade model effectiveness. This study examines the impact of concept drift on Android malware detection, evaluating two datasets and nine machine learning and deep learning algorithms, as well as Large Language Models (LLMs). Various feature types—static, dynamic, hybrid, textual, and image-based—were considered. The results showed that concept drift is widespread and significantly affects model performance. Factors influencing the drift include feature types, data environments, and detection methods. Balancing algorithms help with class imbalance but do not fully address drift, which primarily stems from the dynamic nature of malware. No strong link was found between the type of algorithm used and concept drift; the impact was relatively minor compared to other variables because hyperparameters were not fine-tuned, and the default algorithm configurations were used. The LLM evaluation is treated as an exploratory baseline because the original feature spaces were compressed using PCA to satisfy token-length constraints. Under this setting, LLMs showed promising few-shot performance but remained sensitive to temporal drift.
Ahmed Sabbah, Mohammed F. Kharma, Radi Jarrar et al.· Journal of Cybersecurity and...· 0 citations
FUADroid is proposed, a static malware detection method that fuses structural and statistical-semantic views and achieves strong detection performance and exhibits improved robustness under cross-year evaluation settings.
Jiyun Yang, Fan Mei, Zheng-Dong Wan et al.· International Journal of Mac...· 0 citations
An intelligent Android malware detection framework that combines deep learning with the Equilibrium Optimizer to improve detection performance is presented, providing an effective and reliable solution for securing Android devices against evolving malware threats.
Aishwarya Eklar, G.Rajini· International Journal of Eng...· 0 citations
The increasing sophistication of Android malware attacks has created significant challenges for accurate malware family classification, particularly under highly imbalanced data distributions where minority malware families are frequently misclassified. This study presents a robust multiclass Android malware family classification framework by combining SMOTE-Tomek Links hybrid resampling with an optimized Extreme Gradient Boosting (XGBoost) classifier. The proposed framework addresses two critical issues in previous studies: ineffective handling of minority classes and potential data leakage during resampling and model validation. Experiments were conducted using the CCCS-CIC-AndMal-2020 After Reboot dataset containing 25,059 malware samples distributed across 14 malware families. The proposed approach applies stratified data partitioning, leakage-free SMOTE-Tomek Links integration within an imbalanced-learn pipeline, and RandomizedSearchCV-based hyperparameter optimization with 5-fold stratified cross-validation. Evaluation on an independent holdout test set demonstrates that the optimized framework achieves 80.09% accuracy, 79.85% weighted F1-score, 74.00% macro F1-score, and 97.48% OvR ROC-AUC, outperforming baseline XGBoost and Random Forest models. The results confirm that hybrid resampling combined with optimized gradient boosting improves classification reliability, especially in addressing severe class imbalance and enhancing recognition capability across diverse Android malware families.
Ali Nur Ikhsan, Adam Prayogo Kuncoro, Debby Ummul Hidayah et al.· Journal of Information Syste...· 0 citations
Android malware has become a significant cybersecurity threat due to the open nature of the Android platform. To address this issue, the present study proposes a hybrid malware detection model that combines static and dynamic features with feature selection and ensemble learning. Three feature selection methods, including L1, L2, and ElasticNet, were applied and evaluated using stratified 10-fold cross-validation. In addition, an ensemble model combining Support Vector Machine (SVM) and Random Forest (RF) was used to improve classification performance. Experiments were conducted on a hybrid dataset with almost 3,239 Android applications and 675 combined static and dynamic features. The experimental results demonstrate that hybrid features outperform both static and dynamic features. Among the tested feature selection methods, L2 demonstrated comparatively consistent performance and stable results, obtaining the highest accuracy of 0.9880 ± 0.0059, an F1-score of 0.9875 ± 0.0062, and an MCC value of 0.9759 ± 0.0119. However, Wilcoxon signed-rank testing indicated that the differences between the feature selection methods were not statistically significant ( > 0.05). The ensemble model demonstrated slightly more stable predictions. These findings indicate that the use of hybrid feature representation can be beneficial for Android malware detection. Future research should use more diverse datasets and explore deep learning techniques.
H. Alharbi, R. Marie· Engineering, Technology &...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
