A Hybrid Feature Model for Android Malware Detection

Hadeel Khalaf Alharbi; Rashiq Rafiq Marie

doi:10.48084/etasr.17995

Authors

Hadeel Khalaf Alharbi College of Computer Science and Engineering, Taibah University, Madinah, Saudi Arabia
Rashiq Rafiq Marie College of Computer Science and Engineering, Taibah University, Madinah, Saudi Arabia

Volume: 16 | Issue: 4 | Pages: 37456-37463 | August 2026 | https://doi.org/10.48084/etasr.17995

Received: 6 February 2026 | Revised: 19 April 2026, 22 April 2026, 7 May 2026, and 23 May 2026 and | Accepted: 1 June 2026 | Online: 13 June 2026

Corresponding author: Hadeel Khalaf Alharbi

Abstract

Android malware has become a significant cybersecurity threat due to the open nature of the Android platform. To address this issue, the present study proposes a hybrid malware detection model that combines static and dynamic features with feature selection and ensemble learning. Three feature selection methods, including L1, L2, and ElasticNet, were applied and evaluated using stratified 10-fold cross-validation. In addition, an ensemble model combining Support Vector Machine (SVM) and Random Forest (RF) was used to improve classification performance. Experiments were conducted on a hybrid dataset with almost 3,239 Android applications and 675 combined static and dynamic features. The experimental results demonstrate that hybrid features outperform both static and dynamic features. Among the tested feature selection methods, L2 demonstrated comparatively consistent performance and stable results, obtaining the highest accuracy of 0.9880 ± 0.0059, an F1-score of 0.9875 ± 0.0062, and an MCC value of 0.9759 ± 0.0119. However, Wilcoxon signed-rank testing indicated that the differences between the feature selection methods were not statistically significant ( > 0.05). The ensemble model demonstrated slightly more stable predictions. These findings indicate that the use of hybrid feature representation can be beneficial for Android malware detection. Future research should use more diverse datasets and explore deep learning techniques.

Keywords:

Android malware detection, static and dynamic analysis, hybrid feature model, machine learning, feature selection, ensemble model

References

[1] A. Rawat, A. Kumar, A. K. Singh, and K. Arora, "Exploring Android Security Landscape: Threats, Vulnerabilities, and Best Practices," International Research Journal on Advanced Engineering and Management (IRJAEM), vol. 2, no. 06, pp. 1831–1839, Jun. 2024.

[2] C. Tumbleson, "APKtool." Feb. 2023, [Online]. Available: https://github.com/iBotPeaches/Apktool.

[3] E. Amer and S. El-Sappagh, "Robust Deep Learning Early Alarm Prediction Model Based on the Behavioural Smell for Android Malware," Computers & Security, vol. 116, May 2022, Art. no. 102670.

[4] G. Pitolli, G. Laurenza, L. Aniello, L. Querzoni, and R. Baldoni, "MalFamAware: Automatic Family Identification and Malware Classification Through Online Clustering," International Journal of Information Security, vol. 20, no. 3, pp. 371–386, Jun. 2021.

[5] A. Maryam, U. Ahmed, M. Aleem, J. C.-W. Lin, M. Arshad Islam, and M. A. Iqbal, "cHybriDroid: A Machine Learning-Based Hybrid Technique for Securing the Edge Computing," Security and Communication Networks, vol. 2020, pp. 1–14, Nov. 2020.

[6] R. A. M. Alsaidi, W. M. S. Yafooz, H. Alolofi, G. A.-M. Taufiq-Hail, A.-H. M. Emara, and A. Abdel-Wahab, "Ransomware Detection Using Machine and Deep Learning Approaches," International Journal of Advanced Computer Science and Applications, vol. 13, no. 11, 2022.

[7] P. Bhat and K. Dutta, "A Multi-Tiered Feature Selection Model for Android Malware Detection Based on Feature Discrimination and Information Gain," Journal of King Saud University - Computer and Information Sciences, vol. 34, no. 10, pp. 9464–9477, Nov. 2022.

[8] J. Lee, H. Jang, S. Ha, and Y. Yoon, "Android Malware Detection Using Machine Learning with Feature Selection Based on the Genetic Algorithm," Mathematics, vol. 9, no. 21, Nov. 2021, Art. no. 2813.

[9] D. Arp, M. Spreitzenbarth, M. Hübner, H. Gascon, and K. Rieck, "Drebin: Effective and Explainable Detection of Android Malware in Your Pocket," in Proceedings 2014 Network and Distributed System Security Symposium, San Diego, CA, USA, 2014.

[10] N. Xie, Z. Qin, and X. Di, "GA-StackingMD: Android Malware Detection Method Based on Genetic Algorithm Optimized Stacking," Applied Sciences, vol. 13, no. 4, Feb. 2023, Art. no. 2629.

[11] S. Sharma, P. R. Chhikara, and K. Khanna, "An Efficient Android Malware Detection Method Using Borutashap Algorithm," International Journal of Experimental Research and Review, vol. 34, pp. 86–96, Oct. 2023.

[12] A. R. Zaidi, T. Abbas, H. Zahid, and S. A. Ramay, "Effectiveness of Detecting Android Malware Using Deep Learning Techniques," Journal of Nanoscope (JN), vol. 4, no. 2, pp. 1–21, Nov. 2023.

[13] M. Dhalaria and E. Gandotra, "Android Malware Detection and Classification." Kaggle, 2021, [Online]. Available: https://www.kaggle.com/datasets/meghnadhalaria/android-malware-detection-and-classification.

[14] M. Dhalaria, "Android Malware Dataset Consisting of Static Features." GitHub, 2019, [Online]. Available: https://github.com/Meghna-Dhalaria/Android-malware-dataset.

[15] R. Tibshirani, "Regression Shrinkage and Selection Via the Lasso," Journal of the Royal Statistical Society Series B: Statistical Methodology, vol. 58, no. 1, pp. 267–288, Jan. 1996.

[16] A. E. Hoerl and R. W. Kennard, "Ridge Regression: Biased Estimation for Nonorthogonal Problems," Technometrics, vol. 12, no. 1, pp. 55–67, Feb. 1970.

[17] H. Shah, V. Shah, N. Soni, V. Vadhavana, and K. Patel, "A Comparative Analysis for Android Malware Detection Using Machine Learning Models," in 6th International Conference on Mobile Computing and Sustainable Informatics, Goathgaun, Nepal, Jan. 2025, pp. 1040–1047.

[18] A. Museeb, Y. Hamed, Y. Baashar, A. M. Jamal Kanaan-Jebna, A. Amazigh Hamza, and R. Sokkalingam, "Android Malware Detection Using API Calls and Permissions With Random Forest Classifier," IEEE Access, vol. 14, pp. 6464–6480, 2026.

[19] W. M. S. Yafooz, "Enhancing Business Intelligence with Hybrid Transformers and Automated Annotation for Arabic Sentiment Analysis," International Journal of Advanced Computer Science and Applications, vol. 15, no. 8, 2024.

[20] V. Kouliaridis, K. Barmpatsalou, G. Kambourakis, and S. Chen, "A Survey on Mobile Malware Detection Techniques," IEICE Transactions on Information and Systems, vol. E103.D, no. 2, pp. 204–211, Feb. 2020.

[21] M. A. Haq and M. Khuthaylah, "Leveraging Machine Learning for Android Malware Analysis: Insights from Static and Dynamic Techniques," Engineering, Technology & Applied Science Research, vol. 14, no. 4, pp. 15027–15032, Aug. 2024.

[22] W. M. S. Yafooz, A. Alsaeedi, R. Alluhaibi, and A.-H. Mohamed Emara, "Enhancing Multi-Class Web Video Categorization Model Using Machine and Deep Learning Approaches," International Journal of Electrical and Computer Engineering (IJECE), vol. 12, no. 3, Jun. 2022, Art. no. 3176.

[23] E. J. Alqahtani, R. Zagrouba, and A. Almuhaideb, "A Survey on Android Malware Detection Techniques Using Machine Learning Algorithms," in Sixth International Conference on Software Defined Systems, Rome, Italy, Jun. 2019, pp. 110–117.

[24] M. S. Masari, M. A. Danladi, I. L. Onyinye, and L. K. Tohomdet, "Android Malware Detection Using Machine Learning with SMOTE-Tomek Data Balancing," Journal of Computing Theories and Applications, vol. 3, no. 3, pp. 302–313, Jan. 2026.

[25] Md. A. Hossain and Md. S. Islam, "Enhanced Detection of Obfuscated Malware in Memory Dumps: A Machine Learning Approach for Advanced Cybersecurity," Cybersecurity, vol. 7, no. 1, Jan. 2024, Art. no. 16.