The rapid rise in Android applications has fueled a significant surge in the creation and distribution of malicious apps by cybercriminals. Numerous tools and applications are utilized to detect Android malware apps. However, they cannot effectively detect the latest or zero-day Android malware apps because these tools rely on conventional signature-based approaches. Therefore, more advanced intelligent techniques are investigated to overcome the inherent limitations of the traditional signature-based detection techniques. Nevertheless, the use of intelligent machine learning techniques with a large number of features is resource-intensive and time-consuming in resource-constrained mobile environments. This paper proposes a novel hybrid intelligent approach for Android malware detection that integrates a two-stage Correlation–Differential Evolution-based feature selection (Corr-DE) with gradient-boosting tree ensembles, including LightGBM and XGBoost. In the first stage, a correlation-based filter is employed to reduce feature redundancy by selecting the top 30% of most relevant static and dynamic features. In the second stage, Differential Evolution is utilized to identify an optimal subset of discriminative features, thereby enhancing detection performance. Accordingly, LightGBM and XGBoost are trained effectively using the optimal features and then employed to maximize the detection performance of Android malware apps. The experimental results demonstrate that both LightGBM and XGBoost with Corr-DE feature selection achieved high levels of Android malware detection, with overall accuracy of 95.78% and 95.51%, respectively, while the LightGBM and XGBoost with Corr-DE contributed to reducing the feature space substantially by 83% (reducing the feature space from 420 to 72 features).
Waleed Ali (Sun,) studied this question.