|
Amit Kumar Sanwariya
Kriti Sharma
Dr. Pradeep Jha
Keywords:
Android malware; malware categorisation; CICMalDroid 2020; system calls; random forest; ensemble learning; feature selection.
Abstract:
Android malware is produced faster than it can be analysed manually, and analysts need to know not only whether an application is malicious but which category of malware it belongs to. This paper compares seven classical and ensemble classifiers for five-class categorisation (Adware, Banking, SMS malware, Riskware, Benign) using the system-call, binder-call and composite-behaviour frequencies of the CICMalDroid 2020 dataset (11,598 applications, 470 features). A random-forest importance selector reduced the feature space to 235 features, fitted on the training partition only, and all classifiers were evaluated on a stratified 20% hold-out set of 2,320 applications with accuracy, macro precision, recall and F1-score, specificity, Matthews correlation coefficient (MCC), Cohen’s kappa, ROC-AUC and confusion matrices. Random Forest achieved the best results (94.83% accuracy, macro F1-score 0.938, MCC 0.933, ROC-AUC 0.995), followed by Extra Trees (94.48%) and Gradient Boosting (93.02%), whereas Naive Bayes reached only 60.56%. SMS malware was recognised almost perfectly, while most errors involved Adware, Riskware and Benign applications. File-system, memory-management and telephony-identifier calls were among the most informative features. The study provides a reproducible benchmark and shows that a fixed-parameter tree ensemble is a strong, inexpensive baseline for behaviour-based Android malware categorisation.
|
|
International Journal of Recent Research and Review
ISSN: 2277-8322
Vol. XIX, Issue 3
September 2026
|
PDF View
PUBLISHED
September 2026
ISSUE
Vol. XIX, Issue 3
SECTION
Articles
|
