Enhancing Android Malware Detection: A Grid-Tuned Two-Layered Stacking Approach

Android malware detection is critical for protecting users from cybercrime by automatically identifying potentially harmful applications before they can affect devices. This study explores the efficacy of various machine learning techniques, including ensemble and voting algorithms, for enhancing malware detection. Traditional methods face challenges due to the increasing number of attributes and the dynamic nature of certain features, necessitating more robust solutions. The proposed model addresses these challenges by initially transforming class labels into numerical format and applying normalization to independent attributes, thereby reducing variance and improving computational efficiency. The methodology involves a two-layered stacking approach rather than a single-layer model to minimize the risk of misclassification and improve the handling of unknown malware. At the base level, hyperparameters of traditional classifiers such as SVM, KNN, and Bernoulli Naive Bayes are finely tuned using repeated cross-validation, creating a diverse meta data repository. The stacking classifier employs a voting mechanism that considers all possible true and false classification rates, enhancing predictive accuracy. The next layer (meta classifier-1) utilizes tuned ensemble methods to generate numerical predictions, which are then processed by a final logistic regression layer (meta classifier-2). The proposed model demonstrates a significant improvement, achieving a +0.9% increase in accuracy compared to standalone tuning algorithms, thereby offering a more reliable and efficient approach to Android malware detection. This study utilizes the Drebin dataset, which includes 15,036 samples comprising 5,560 malware and 9,476 benign applications, to evaluate the model's performance.