XEnDroid: Explainable Stacking Ensemble Learning for Dynamic Android Malware Detection
TL;DR
XEnDroid (Xplainable Ensemble Droid), an advanced stacking ensemble approach for detecting malware on Android phones by combining random forest, convolution neural network, and transformer models under a logistic regression model is proposed.
Abstract
Android malware attributes to the increasing usage of code obfuscation, polymorphism, and dynamic execution. In this study, we propose XEnDroid (Xplainable Ensemble Droid), an advanced stacking ensemble approach for detecting malware on Android phones by combining random forest, convolution neural network, and transformer models under a logistic regression model. Dynamic behavioral features such as API, system call, and network activities are used for extracting features that are later reduced using PCA and processed through SMOTE. Model transparency is ensured by incorporating SHAP and LIME, which helps in understanding both global feature significance and prediction explanation locally. An experimental analysis using the CICMalDroid2020 dataset proves the effectiveness of the proposed method, as it results in 94.6% accuracy, 94.1% precision, 94.2% recall, 94.1% F1-score, and 0.986 AUC score.