Enhancing Android Malware Detection through Swarm Intelligence and Autoencoder Techniques Applied to API Call Analysis

Summary

A hybrid Android malware detection framework is proposed, leveraging learned feature representations and traditional classifiers to enhance detection accuracy, reduce manual feature engineering, and counter evolving malware threats effectively.

Abstract

Malware Security Intelligence involves analyzing applications and their metadata to identify potential security threats. Application Programming Interface (API) calls serve as a valuable source of information for detecting malware. Reducing the feature space in malware analysis enhances the efficiency of threat identification. This research seeks to identify the most significant API call features to enhance the precision of Android malware detection. Three swarm intelligence-based optimization techniques-Firefly Optimization, Cuckoo Search Optimization, and Ant Colony Optimization -are employed alongside Auto-Encoders to extract the most significant features. To evaluate these nature-inspired wrapper-based methods, popular machine learning classifiers, including K-Nearest Neighbour (KNN), Random Forest (RF), Support Vector Machine (SVM), Decision Tree (DT), and Linear Regression (LR), are used. Furthermore, a hybrid artificial neural classifier is shown to improve the performance of malware categorization. Effectiveness of the suggested method is demonstrated by experimental results, which show an accuracy of 98.87% using only 7 out of 100 API call features.

Introduction

The most popular mobile operating system is Android, which is based on Linux and has a 72.55% global market share¹. In contrast to other operating systems that are subject to stringent laws and copyrights, Android is an open-source platform that welcomes contributions from developers worldwide. But because of its large user base, virus assaults target it frequently. Malware is the term for malicious software intended to compromise the operation of computer systems or take advantage of private information. The most common method of malware infiltration in the Android ecosystem is through application downloads. While applications obtained from trusted sources are generally secure, those downloaded from unverified or malicious platforms may contain harmful software. Cybercriminals often exploit security vulnerabilities in devices, deploying malware to compromise their integrity².

As the number of users continues to grow, the volume of valuable data accessible to cyber attackers also increases. An attacker may exploit this by distributing a malicious application on official mobile application marketplaces. Once an unsuspecting user installs the app, they inadvertently grant the attacker access to their device. Given the increasing prevalence of such threats, advanced malware detection techniques are essential to counter the vast number of malicious applications^3,4,5. Several existing technologies have been developed to predict Android malware^6,7. However, these approaches primarily rely on signature-based detection, which involves identifying digital traces embedded within the application code. Extracted from the Android Package Kit (APK) of the software, these signatures are matched against a database of known hostile patterns. Although this approach is successful in detecting malware that has already been reported, it is unable to recognize new threats that have not yet been added to the database.⁸

As malware keeps developing, with the growing prevalence of malware, it is crucial to develop a solution capable of accurately detecting various types of malware⁹ while optimizing time and computational resources. To improve malware detection on Android smartphones, a lot of work has been done. Conventional signature-based detection techniques match the signature of an APK file with malicious signatures that have been identified and stored in a database. But this method does not work for malware that has not been found yet, which emphasizes the need for more sophisticated detection systems^10,11,12.

The hypothesis this article aims to test is: Identifying suspicious API calls to improve the classification accuracy of benign and malicious Android applications. Developing and implementing a hybrid classification model that integrates Auto-Encoders with Artificial Neural Networks. Formulating an objective function for swarm intelligence optimization, which enhances the learning process by introducing penalties to facilitate the discovery of near-optimal solutions. Examining several performance metrics and selecting the optimal method for Android malware prediction.

Related work

A notable increase in malware diversity and volume has resulted from the widespread use of the Android platform, which has prompted researchers to create efficient detection and prevention techniques^13,14,15. Through statistical research, Deckard and Rasoolzadegan¹⁶ tackled the issue of unbalanced datasets in Android malware detection. To preprocess and balance the data, they used the Synthetic Minority Oversampling Technique (SMOTE), under-sampling, and ranking techniques. Using KNN, SVM, and Iterative Dichotomiser 3 (ID3) classifiers, their detection model achieved a greater accuracy of 98.69% when the SMOTE approach was paired with the KNN classifier¹⁶.

The usage of Term Frequency-Inverse Document Frequency (TF-IDF) for Android malware identification was investigated by Priya and Visalakshi¹⁷ in a different study. They created a permission grader to score and grade permissions, which were subsequently classified using artificial neural networks. This method outperformed existing systems with an accuracy of 94.22%. Additionally, in order to improve Android malware classification performance, based on linear regression, a feature selection method was devised by Yildiz et al.¹⁸. Their method reduced training time and produced a 96.1% increase in accuracy. In order to increase accuracy and efficiency in Android malware detection, this research collectively highlights the significance of tackling issues like feature selection and unbalanced datasets.

Recursive Feature Selection (RFS) and an ensemble classifier were used in a model presented by Al Sarahh et al.¹⁹ to improve Android malware detection. In this method, the LightGBM algorithm is used to classify the most relevant features that RFS has identified. Results from the experiment showed that the model was effective, with a 99.5% classification accuracy. For Android malware categorization, Ding et al.²⁰ also suggested a deep learning architecture that uses a Convolutional Neural Network (CNN). In their process, bytecode files are extracted from Android APKs and converted into two-dimensional bytecode matrices. These matrices are used to train the CNN model, which, in experiments, achieved a 95.1% accuracy rate. This research highlights how deep learning models and feature selection techniques can be combined with ensemble classifiers to increase the accuracy of Android malware detection systems.

By using deep learning techniques, Elayan and Mustafa²¹ overcame the shortcomings of conventional malware detection methods in updated Android systems. They outperformed traditional techniques by using a Gated Recurrent Unit (GRU) to differentiate between malicious and benign apps, attaining an accuracy of 98.2%. The Analytical Hierarchy Process (AHP) was also integrated into a risk-based fuzzy technique for mobile virus detection that was proposed by Arif et al.²². In addition to identifying malware, their system evaluates risk levels and divides them into four groups: extremely low, low, medium, and high. With this thorough technique, the overall accuracy was 90.54%. The effectiveness of sophisticated machine learning methods, like fuzzy AHP frameworks and GRU-based deep learning models, in improving the precision and resilience of Android malware detection systems is demonstrated by these studies.

In order to overcome the drawbacks of signature-based approaches, Mercaldo and Santone²³ used audio signal processing techniques to extract numerical information from application executables by turning them into audio files. Their method, which used a neural network classifier, produced a 95.2% detection accuracy. In order to overcome the difficulties associated with laborious feature engineering, Zhang et al.²⁴ presented TC-Droid, an automatic framework that makes use of text classification techniques. With a 96.6% accuracy rate, this method analyzes text sequences from application analysis reports using convolutional neural networks.

With an accuracy of 93.4%, Imtiaz et al.²⁵ presented DeepAMD, an artificial neural network-based technique intended for the effective categorization and early detection of Android malware. Firdaus et al.²⁶ created a genetic search-based feature selection technique for static analysis in Android malware detection. With a 95% accuracy rate, functional trees outperformed other machine learning classifiers in the tests. A feature selection method called Delta_IDF was presented by Peynirci et al.²⁷. It computes inverse document frequency values based on string occurrences in APK files. Compared to other algorithms, their experiments produced encouraging results.

Shi et al.²⁸ proposed a hybrid CNN-DNN framework that demonstrated strong detection accuracy by combining the strengths of convolutional and dense layers for feature extraction and classification. Similarly, Shu et al.²⁹ provided a comprehensive survey on CNN-based Android malware detection methods, highlighting their strengths in capturing spatial dependencies within API and opcode sequences. In the Internet of Things (IoT) context, Naeem et al.³⁰ developed a stacked ensemble of deep convolutional networks for malware classification, which improved robustness across heterogeneous IoT threat environments. More recently, Shu and Dong³¹ introduced LG-PN, a local-global fusion approach in prototypical networks, to enhance the detection of previously unseen Android malware. While these methods achieved notable success, they largely rely on deep convolutional architectures and require substantial computational resources. In contrast, the present work integrates swarm intelligence with autoencoder-based feature selection to reduce dimensionality and improve efficiency, thereby providing a complementary and lightweight alternative to deep CNN-based solutions.

Several prior studies have also focused specifically on API call-based Android malware detection, as API sequences are strong behavioral indicators of malicious activity. For instance, Karbab et al.³² proposed using deep learning on sequences of API method calls to identify malicious applications, demonstrating that temporal patterns in API usage can effectively distinguish malware from benign apps. Similarly, Muzaffar et al.³³ evaluated various machine learning models on API call features and highlighted the importance of feature selection and representation in improving detection performance. Although these works highlight the utility of API-level features, most rely either on deep sequence models or handcrafted feature engineering, which can be computationally expensive or less generalizable. In contrast, this study leverages swarm intelligence algorithms combined with autoencoders to automatically reduce API feature dimensionality and then employs a hybrid Artificial Neuronal Classifier to enhance detection performance. This positions our approach as a lightweight yet effective alternative that directly addresses the challenges of high-dimensional API call data.

Through the integration of Artificial Neural Networks (ANNs), the suggested methodology in this study seeks to improve Android malware detection and categorization. First, auto-encoders are used in wrapper-based feature selection techniques to find the most important characteristics that distinguish dangerous apps from benign ones. To increase the effectiveness of Android malware classification, a unique Artificial Neuronal Classifier that combines ANNs with induction classifiers is then assessed.

Protocol

The wrapper-based feature selection method using auto-encoders is used in the suggested architecture for Android malware detection, as shown in Figure 1. The dataset is divided into 70:30 training and testing subsets. Classification and feature selection are the two main steps in the malware analysis process.

Feature selection (FS): This step is iteratively searching for the best feature subsets (see Definition 1) using swarm intelligence-based algorithms, notably Cuckoo Search Optimization (CSO), Ant Lion Optimization (ALO), and Firefly Optimization (FO). After that, auto-encoders process the chosen features to produce a compressed representation of the incoming data. An induction approach then uses the output from the auto-encoders to assess how well these features differentiate between dangerous and benign apps. In order to enable precise categorization of subsequent cases, the induction algorithm builds a classifier by mapping the feature space to a collection of class labels.

Classification: Using the suggested Artificial Neuronal Classifier and well-known induction methods, the reduced feature set from the feature selection stage is evaluated in this phase to see how effectively it can detect Android malware.

By using sophisticated classification approaches and concentrating on the most informative features, this methodology seeks to improve the accuracy and efficiency of Android malware detection.

Feature selection

A crucial step in machine learning is feature selection, which entails determining which features are most reliable, pertinent, and non-redundant for model construction. Reducing feature sets in a methodical manner becomes more crucial as datasets continue to grow in size and complexity. Feature selection's main goal is to maximize model performance while lowering computational expenses. Repetitive and unnecessary features are removed, allowing the process to concentrate on variables that are most significant to the model. Instead of depending on the machine learning algorithm to identify significant features, the following are the benefits of feature selection before model training:

Simplified models: Reducing the number of input variables leads to more straightforward models that are easier to interpret and understand.

Variance reduction: By focusing on essential features, feature selection helps decrease model variance, thereby mitigating overfitting and enhancing generalization to new data.

Decreased training time: A smaller feature set reduces the computational burden, resulting in faster model training and evaluation.

Mitigation of the Curse of Dimensionality: High-dimensional data can pose challenges such as increased complexity and overfitting; feature selection addresses these issues by limiting the feature space to the most informative variables.

Definition 1 of feature selection

Think of an inducer I and a dataset D that has a distribution D over a labelled instance space and contains features (x₁,x₂,x₃,... ,x_n). The subset of features that optimizes the classifier C=I(D)'s accuracy is known as the Optimal feature subset X_opt.

In unsupervised feature selection, wrapper-based approaches aim to identify the optimal combination of features that enhance model performance. By systematically adding or removing features, often through greedy algorithms, these methods evaluate various models to select the most impactful features for model development. This process is depicted in Figure 2.

For feature selection, swarm intelligence algorithms like Firefly Optimization (FO), Cuckoo Search Optimization (CSO), and Ant Lion Optimization (ALO) are used to outperform conventional greedy tactics. The objective function selected at the fitness evaluation stage has a significant impact on the effectiveness of these algorithms. Both the quantity of features picked and the model's error at the end of each iteration are taken into account in the iterative wrapper-based feature selection procedure to evaluate the appropriateness of the features selected. Equation (1) formalizes this evaluation.

(1)

The learning algorithm's penalty for errors made during fitness evaluation is represented by τ in this equation, where τ ∈ [0,1]. The length of the chosen feature subset is denoted by the variable l, and the total number of features is represented by the variable u.

Auto encoders

Neural networks that specialize in learning compressed representations of input data are called autoencoders. An encoder and a decoder are the two main parts of them. While the decoder tries to recover the original input from this compressed form, the encoder processes the input data and compresses it into a latent space representation. Machine learning model training is made easier by the encoder's ability to extract valuable features from unprocessed data once it has been trained.

The proposed autoencoder architecture (as shown in Figure 3) features an encoder composed of an input layer with N nodes, followed by two hidden layers containing N*2 and N nodes, respectively. There is a second hidden layer with N/2 nodes called the latent space. With two hidden layers of [N, N*2] nodes, the decoder replicates this structure, ending with an output layer of N nodes.

Each hidden layer is followed by batch normalization to speed up and stabilize the training process, and all layers use the LeakyReLU activation function to handle any possible vanishing gradient problems. Equation (2) provides a mathematical definition of the LeakyReLU activation function:

 (2)

Where h_θ(x), is obtained using Equation (3)

(3)

Here, x_i=(x₁,x₂,...,x_n)  represents the input values to the nodes, while w_i=(w₁,w₂,...,w_n) denotes the weights associated with these nodes. During the learning process, the weights are adjusted after being initially allocated at random within the range [0,1]. In order to prevent the parameters from passing through the origin, a bias term is added at each layer. Equation (4) defines the threshold, and if the output obtained from Equation (3) surpasses it, a node is triggered.

 (4)

Ant lion wrapper-based feature selection optimization (ALWFSO)

Modelling antlion's natural predatory behavior, the Ant Lion Optimizer (ALO) was first presented by Seyed Ali Mirjalili³⁴. This optimization algorithm efficiently identifies optimal solutions regardless of the initial parameter values. ALO exhibits rapid convergence and effectively manages both integer and discrete constraints. Prey capture, trap creation, ant entrapment, random ant movement, and trap repair are the steps that make up the hunting process in ALO.

In the context of the Ant Lion Optimizer (ALO) algorithm, ants represent candidate solutions performing random searches in the solution space, while antlions correspond to the traps or guides influencing the ants' movements based on fitness values. This dual population models the natural predatory behavior of antlions capturing ants. At the outset, the populations of both ants and antlions are randomly initialized. Antlions are selected for each ant using the Roulette wheel selection mechanism, followed by a random walk process (as shown in Algorithm-1). Equation (5) then describes how this walk is normalized.

 (5)

At first, ant and antlion populations are created at random. An antlion is chosen for every ant using a roulette wheel mechanism, allowing for a random walk that is normalized using predetermined formulas. This process ensures that ants' movements are influenced by the positions of antlions, effectively simulating the natural hunting process. The position of each ant is then updated based on this interaction, guiding the search towards optimal solutions.

Because of its architecture, the ALO algorithm can effectively traverse intricate search spaces, making it a powerful tool for resolving a variety of optimization issues. The fitness of every ant is assessed at the conclusion of each repetition. As shown in Algorithm-1, the antlion is swapped out for the ant if the ant is more fit than its counterpart. In this case , indicates the location of the i^th ant at iteration t; I is a ratio; indicates the location of the j^th antlion at iteration t; is the elite for the random walk at iteration t, which is chosen by the Roulette wheel; and  is the antlion's random walk at iteration t, which is also determined by the Roulette wheel. After every cycle is finished, the globally optimal solution, confirmed by the integrated wrapper classifier, is given back.

Algorithm 1: ALWFSO
Define objective function: f(x):x=(x₁,x₂,...,x_d)
Initialization of the colony of ants and antlions at random
Ant and Antlion Fitness Calculation
Choose the best antlions and assume they are elite.
Repeat Until Termination Condition is Met or f(x):x=(x₁,x₂,...,x_d)
For each ant-antlion selection: Use a Roulette Wheel Selection mechanism to probabilistically choose an antlion that will influence the ant's movement
X(t) = [0,cum_sum(2r(t₁) - 1),cum_sum(2r(t₂) - 1),...,cum_sum(2r(t_n)-1)]


End of ant loop
Fitness Evaluation: Recalculate the fitness values of all ants based on their new positions.
Replace antlions with ants if the ants demonstrate superior fitness
If an antlion becomes fitter, then

End while

Cuckoo search wrapper-based feature selection optimization (CSWFSO)

Inspired by the brood parasitism behavior of some cuckoo species, which deposit their eggs in the nests of other host birds, Xin-She Yang and Susah Deb³⁵ created the Cuckoo Search algorithm in 2009. In this procedure, every cuckoo lays an egg in a nest that is selected at random. Future generations will inherit nests with the best eggs. The probability of a host bird spotting an alien egg is 0, and there are only a certain number of host nests accessible.

Algorithm 2: CSWFSO

Define objective function: f(x):x = (x₁,x₂,...,x_d)
Randomly generate an initial population of n host nests, each corresponding to a candidate solution x_i (i=1,2,3,...,n)
Repeat Until the Stopping Condition is Satisfied or (t For a randomly selected cuckoo i, produce a new candidate solution using Lévy flight 

Compute the fitness of the newly generated solution F_i [For maximizing, F_i  α f(x_i)]
Randomly select a host nest j from the population n
if (F_i >F_j) then j is replaced with a new solution
end if
Abandon a part of the worse nets by (p_a) fraction
New nests are built in abandoned fraction (p_a) using
Set aside the best solutions or nests.
By ranking them, choose the best nest or solution available right now.
The following generation inherits the finest solution available now.
End while

At the outset, all nests are initialized randomly. As iterations progress, each cuckoo modifies its position within the solution space through Lévy flights, as outlined in Algorithm 2. The step size is adjusted by ∝, and a sigmoid operation converts the continuous values generated by the Cuckoo Search Optimization (CSO) into a binary format, as depicted in Equations (6) and (7).

  (6)

  (7)

As shown in Algorithm 2, where  and are randomly picked nests and δ ∈ [0,1], at the end of each iteration, some nests are abandoned and refreshed with new candidate solutions.

Inspired by the cuckoo bird’s brood parasitism, the Cuckoo Search Optimization (CSO) algorithm has proven to be a useful tool for feature selection tasks³⁵. The technique starts with initializing a population of nests, each of which represents a possible solution in the context of wrapper-based CSO feature selection. A preset objective function is used to assess these nests' fitness. Using fitness evaluations, the algorithm determines the optimal solution—referred to as the global best—at each iteration. In order to better explore the solution space, a portion of the nest, represented by pea, is dropped and replaced with new ones in accordance with the CSO protocol. The embedded wrapper classifier confirms that the algorithm yields the globally optimal answer after all iterations are finished.

Firefly wrapper-based feature selection optimization (FWFSO)

Algorithm 3: FWFSO
Define the Objective function: f(x):x = (x₁,x₂,...,x_d)
Generate an initial swarm of n fireflies, each representing a solution x_i  (i = 1,2,3,…,n)
Determine the light intensity I of each firefly based on the value of the objective function
Define light absorption coefficient γ
Repeat Until the Stopping Condition is Met or (t < MaxGeneration)
for each firefly i (∀ i=1,2,3,... ,n)
  for every firefly j (∀ j=1,2,3,... ,i)
Get light intensities of I_i and I_j
  if I_i < I_j then

     
  else
  Randomly move the firefly i to explore the search space
  end if
  Attractiveness decreases with distance as
   Evaluate the updated solution and adjust the firefly's intensity accordingly
  end for
end for
Rank the fireflies based on their light intensities and identify the one with the highest brightness as the current best solution

The Firefly Optimization algorithm, introduced by George Lindfield and John Penny³⁶, emulates the natural behavior of fireflies to attract others. In this algorithm, a firefly’s attractiveness is directly proportional to its brightness, while the distance between two fireflies is inversely proportional to their attractiveness. If no brighter fireflies are nearby, a firefly will move randomly.

Two fireflies are attracted to each other based on their brightness; a less bright firefly will gravitate toward a brighter one. Random movement is used when there is no brighter firefly. With β₀ denoting beauty, the distance r=0 between two fireflies is used to calculate their attractiveness. The r_jk separation between fireflies j and k is computed as follows: Here, r_ji and r_ki sidenote the spatial components of the i^th dimension for fireflies j^th and k^th, respectively, and n represents the number of dimensions. The movement of a firefly towards another is governed by the degree of attraction between them: . In this equation, r_j the current position of firefly j, γ is the light Ranard is a random number between 0 and 1, α is the mutation rate, and absorption coefficient. Should there be no more brilliant fireflies, the firefly will move at random according to αα. Following each iteration, the embedded wrapper classifier validates the global minimum solution, which is then returned.

Classifier

Both structured and unstructured datasets can be classified by breaking them up into discrete groups or classes. The goal is to use the attributes of fresh data points to forecast their class or label. This procedure determines the category to which fresh data belongs by approximating a mapping function from input variables to discrete output variables.

Random Forests, Decision Trees, K-Nearest Neighbors, Logistic Regression, and Support Vector Machines are among the induction or classification algorithms used to evaluate the suggested Android malware detection solution³⁷. Furthermore, this work presents the Artificial Neuronal Classifier, a revolutionary hybrid classifier that combines conventional induction algorithms with Artificial Neural Networks.

Artificial neuronal classifier

The suggested Artificial Neuronal Classifier (ANC) design combines an induction classifier and Artificial Neural Networks (ANN), as seen in Figure 4. According to this architecture, the ANN is taught to identify patterns and correlations between the input features. The induction classifier uses the information that the ANN has learned to improve the precision of identifying malicious software from safe software.

After extensive testing, the ANN inside the ANC was configured with three fully connected hidden layers, each with M nodes, following an input layer with N nodes. There is an output layer that is connected to the induction classifier after a further fully connected hidden layer with M/2 nodes. Equation (8) determines the number of nodes in the hidden layers:

 (8)

where M denotes the number of nodes in a hidden layer, N represents the number of input features, and α is a parameter ranging between 2 and 10. The activation function (as shown in Equation (9)) plays a crucial role in determining whether a neuron is activated, contingent upon the output surpassing a specified threshold.

  (9)

Here, h_θ(x) is computed as per Equation (3). The ANC utilizes the Adam optimizer to adjust network weights and learning rates. In Adam, the decay rates for the first moment estimate and the second moment estimate for each weight ω_ij are denoted by β₁ and β₂, respectively. Let N represent the learning rate. The update rules for Adam are shown in Equations (10) and (11):

(10)

  (11)

The bias-corrected first and second moment estimates,   and , are computed as using Equations (12) and (13):

(12)

(13)

These computations ensure that the optimizer maintains appropriate learning rates for each weight, facilitating efficient and effective training of the ANC.

The weight update rule for each connection in the neural network is defined by Equation (14):

(14)

After updating the neural network weights, the performance is assessed using a loss function that measures the discrepancy between the predicted and actual outputs. In this model, the Mean Absolute Error (MAE), as defined in Equation (15), is employed for this purpose.:

(15)

In this context, y_i represents the actual output,  denotes the predicted output, and n is the total number of output instances. After the neural network has been trained over a defined number of epochs, the learned representations from the feature space are transferred to the induction classifier to distinguish between malware and benign software.

The proposed Artificial Neuronal Classifier (ANC) functions as a hybrid framework that combines the feature-learning capabilities of an Artificial Neural Network (ANN) with the decision-making strengths of traditional induction classifiers, such as Random Forest and Decision Tree. In this design, the ANN first processes the selected features obtained from the autoencoder to learn complex patterns and correlations between input attributes. The resulting representations learned are then passed to the induction classifier, which performs the final classification of Android applications as benign or malicious. In this way, the ANC acts as a wrapper, enhancing conventional classifiers with deep feature embeddings while preserving their interpretability. This hybrid mechanism allows the ANC to leverage both high-level feature abstraction from the ANN and robust decision-making from established machine learning classifiers, resulting in improved detection accuracy and generalization.

Experimental setup

A 64-bit Windows 10 operating system, with an i5 processor - 2.30 GHz, 8 GB of RAM, and a 2 TB hard drive, was used in the experimental setup. Python 3.7 was used as the programming language, and the Jupyter platform was set up to enable machine learning and deep learning packages.

The IEEE Dataport provided the experiment’s API call sequence data, which included 43,876 sequences - 42,797 of which were classified as malware and 1,079 as goodware. Virus Total was used for verification, and the Cuckoo Sandbox environment was used for data gathering. Table 1 provides a comprehensive explanation of the API call sequences.

Results

Several performance indicators, such as Mean Squared Error (MSE), Root Mean Squared Error (RMSE), Precision, Recall, F1-Score, and Accuracy, are used in the proposed Android malware detection system to assess classification accuracy. The following is a definition of these measures.

Discussion

Android malware threats are increasing, with adversaries employing increasingly sophisticated evasion techniques. Android-based mobile systems and applications play a crucial role in smart cities and industrial environments. Ensuring the security of these systems, particularly in such critical domains, necessitates robust malware detection mechanisms. Recently, machine learning-based malware detection research has gained significant attention¹⁸. However, many existing methods rely on feature engin...

Materials

List of materials used in this article

Name	Company	Catalog Number	Comments
Anaconda Navigator	Anaconda, Inc.	Navigator-2023
Google Colab	Google LLC	N/A
Jupyter Notebook	Project Jupyter	N/A
Python	Python Software Foundation	>=3.9
PyTorch	Facebook AI Research	>=2.0
Scikit-learn	Community Driven	>=1.0
TensorFlow	Google Brain	>=2.8
Windows Operating System	Microsoft Corporation	11