A Hybrid Feature Model for Android Malware Detection
Android malware has become a significant cybersecurity threat due to the open nature of the Android platform. To address this issue, the present study proposes a hybrid malware detection model that combines static and dynamic features with feature selection and ensemble learning. Three feature selection methods, including L1, L2, and ElasticNet, were applied and evaluated using stratified 10-fold cross-validation. In addition, an ensemble model combining Support Vector Machine (SVM) and Random Forest (RF) was used to improve classification performance. Experiments were conducted on a hybrid dataset with almost 3,239 Android applications and 675 combined static and dynamic features. The experimental results demonstrate that hybrid features outperform both static and dynamic features. Among the tested feature selection methods, L2 demonstrated comparatively consistent performance and stable results, obtaining the highest accuracy of 0.9880 ± 0.0059, an F1-score of 0.9875 ± 0.0062, and an MCC value of 0.9759 ± 0.0119. However, Wilcoxon signed-rank testing indicated that the differences between the feature selection methods were not statistically significant ( > 0.05). The ensemble model demonstrated slightly more stable predictions. These findings indicate that the use of hybrid feature representation can be beneficial for Android malware detection. Future research should use more diverse datasets and explore deep learning techniques.