Stealthy No More: An Effective Ensemble Learning Approach for Detecting Android RATs

Android Remote Access Trojans (RATs) pose a significant cybersecurity threat due to their stealthy behavior, sophisticated evasion techniques, and ability to grant attackers unauthorized access to compromised devices. Existing detection mechanisms, including signature-based and heuristic approaches, often struggle to effectively identify RATs due to their polymorphic nature and continuous evolution. To address these challenges, we propose an ensemble learning-based detection framework that leverages both static and dynamic analysis techniques to improve detection accuracy. Our evaluation results on a large publicly available Android malware benchmark dataset demonstrate that XGBoost model outperforms other models, achieving an F1-measure of 99.2%, with the lowest false positive rate. Additionally, we evaluate the capability of ensemble models in classifying RATs into specific families, with XGBoost again demonstrating superior classification performance. These findings highlight the effectiveness of ensemble learning in detecting Android RAT threats and offering a scalable and robust solution for enhancing mobile security.