Intelligent malware detection on Android smartphones via a hybrid approach using gradient boosting and convolutional neural network
TL;DR
Evaluation using metrics such as accuracy, precision, F1 score, and false positive rate indicates that CNN-GBM outperforms existing deep learning models, and enhancements stem from the effective integration of CNN feature extraction with GBM’s boosting capabilities.
Abstract
Malware is malicious software that infiltrates systems without user consent. Effective detection involves identifying such software and distinguishing it from benign programs. While machine learning has shown promise in malware detection, many existing techniques demand extensive feature engineering and representation, leading to higher computation times and error rates. To address these limitations, we propose CNN-GBM, a hybrid model combining Convolutional neural networks (CNN) with Gradient Boosted Machines (GBM), aimed at improving Android malware detection. The approach begins by constructing a dataset comprising malware and benign files, represented as numerical feature vectors through n-grams, opcode sequences, or byte-level features. CNN processes the raw data to learn hierarchical patterns, while an entropy-based feature selection technique identifies the most informative attributes. These selected features are then fed into the GBM, trained to classify files as malware or benign. Evaluation using metrics such as accuracy, precision, F1 score, and false positive rate indicates that CNN-GBM outperforms existing deep learning models. Notable improvements include accuracy (+ 3%), precision (+ 1%), recall (+ 5%), AUC (+ 3.5%), and significant reductions in false positive rate (− 52%), false negative rate (− 15%), and error rate (− 35%). These enhancements stem from the effective integration of CNN feature extraction with GBM’s boosting capabilities.