A Novel Intelligent-Hybrid Framework for Android Malware Detection

Abstract

The growing incidence and complexity of Android malware pose serious challenges to mobile security. Since obfuscation and zero-day threats usually go beyond the scope of detection by signature or heuristic solutions, the researchers considered a hybrid approach to malware detection that integrates static and dynamic analysis with machine learning classifiers to enhance the accuracy and robustness of the detection mechanism. Permissions, API calls, and runtime behaviors were extracted from APK files and subjected to classification by Random Forest and XGBoost. The experimental results favoured the Random Forest and XGBoost classifiers, with 100% accuracy, precision, recall, and F1-score, thus far better than the traditional methods. The interpretability of the models through SHAP (SHapley Additive exPlanations) further improved by pinpointing key features that influence the final detection decision. The proposed framework is scalable and flexible, making it suitable for real-time mobile security use cases and app store screening procedures. The framework instigates the furtherance of proactive and intelligent Android malware detection, thus contributing to mobile ecosystem security.