What does this research mean for the field?

A Decision Tree machine learning model, enhanced by data oversampling and Random Forest feature selection, achieves 99.99% accuracy in classifying Android hybrid malware and outperforms K-Nearest Neighbors, Naive Bayes, and Logistic Regression models. Novelty: ClaimNovelty.METHODOLOGICAL. Consensus alignment: ConsensusAlignment.NEUTRAL.

What question did this study set out to answer?

This research aims to develop a model that accurately identifies and categorizes hybrid malware on Android devices using Decision Tree analysis.

May 9, 2026Open Access

View Full Paper

Classification of Hybrid Malware on Android: The Significance of Feature Importance in Decision Tree Analysis

Key Points

This research aims to develop a model that accurately identifies and categorizes hybrid malware on Android devices using Decision Tree analysis.
Utilized the CICAndMal2017 dataset for experiments.
Applied Decision Tree, K-Nearest Neighbors, Naive Bayes, and Logistic Regression models for classification.
Employed data processing techniques, including oversampling and feature engineering.
The Decision Tree model achieved 99.99% accuracy, F1-score, recall, and precision.
Demonstrated superior performance compared to other machine learning models.
Achieved a good balance between precision and recall in classifying secure applications and various malware types.

Abstract

Malicious applications provide a growing and significant threat to Android users, developers, and application platforms. Experts have endeavored to create novel detection methodologies due to the ongoing advancement in the sophistication of malware and the escalating intensity of its damaging assaults. Within the framework of these initiatives, the detection of malware encounters a significant impediment due to the lack of clean and balanced datasets. This research seeks to develop a model proficient in identifying and categorizing various forms of hybrid malware on the Android platform, utilizing the Decision Tree (DT) model as the primary analytical instrument. The purpose of study is employing Machine Learning (ML) techniques for the categorization of network traffic related to malware programs. It presents ML approaches utilizing DT, K-Nearest Neighbors (K-NN), Naive Bayes (NB), and Logistic Regression (LR) for predicting network virus traffic. It conducts experiments on the CICAndMal2017 dataset. The technique comprises many essential stages, such as data processing, which includes the raw data that is refined through cleansing and transformation from text format to numerical format. To address the problem of class imbalance among application categories, the oversampling approach was employed to ensure equal representation of all malware types in the dataset, followed by feature engineering. The features were assessed via the Random Forest (RF) model to determine the permissions and behaviors that most significantly impact application classification. This facilitated comprehension of the principal variables behind harmful acts. The findings indicated that the DT model was proficient in prediction and showed superior performance relative to other models. The last classification reports confirmed that the model achieved a good balance between precision and recall in the classification of both secure applications and various malware types. The model's performance was measured by its accuracy, F1-score, recall, and precision; it achieved a score of 99.99% in all measures utilized

Ask AI

Helpful

Bookmark

View Full Paper

Ask AI

Helpful

Bookmark

View Full Paper

Classification of Hybrid Malware on Android: The Significance of Feature Importance in Decision Tree Analysis

Key Points

Abstract

Cite This Study