Application of Symbolic Classifiers and Multi-Ensemble Threshold Techniques for Android Malware Detection

作     者：Andelic, Nikola Segota, Sandi Baressi Mrzljak, Vedran 

作者机构：Univ Rijeka Fac Engn Dept Automat & Elect Rijeka 51000 Croatia Univ Rijeka Fac Engn Dept Thermodynam & Energy Engn Rijeka 51000 Croatia 

出 版 物：《BIG DATA AND COGNITIVE COMPUTING》 (Big Data Cogn. Computing)

年 卷 期：2025年第9卷第2期

页      面：27-27页

核心收录：

主　　题：Android malware detection data preprocessing genetic programming symbolic classifier threshold based voting ensembles 

摘      要：Android malware detection using artificial intelligence today is a mandatory tool to prevent cyber attacks. To address this problem in this paper the proposed methodology consists of the application of genetic programming symbolic classifier (GPSC) to obtain symbolic expressions (SEs) that can detect if the android is malware or not. To find the optimal combination of GPSC hyperparameter values the random hyperparameter values search method (RHVS) method and the GPSC were trained using 5-fold cross-validation (5FCV). It should be noted that the initial dataset is highly imbalanced (publicly available dataset). This problem was addressed by applying various preprocessing and oversampling techniques thus creating a huge number of balanced dataset variations and on each dataset variation the GPSC was trained. Since the dataset has many input variables three different approaches were considered: the initial investigation with all input variables, input variables with high feature importance, application of principal component analysis. After the SEs with the highest classification performance were obtained they were used in threshold-based voting ensembles and the threshold values were adjusted to improve classification performance. Multi-TBVE has been developed and using them the robust system for Android malware detection was achieved with the highest accuracy of 0.98 was obtained.