Optimizing Android Malware Detection for Resource-Constrained Devices via a Two-Stage ML Pipeline

The rapid rise of Android malware has intensified the need for lightweight yet accurate detection methods for mobile devices. This study evaluates machine learning models for Android malware detection using the CIC-MALDROID 2020 dataset, comprising frequency-based static features. The dataset underwent preprocessing steps including duplicate removal, correlation filtering, and class balancing using SMOTE. Feature selection was conducted via Random Forest filtering and Recursive Feature Elimination with Cross-Validation (RFECV), yielding 195 optimal features. Four models, Random Forest, XGBoost, CatBoost, and Logistic Regression were assessed using classification metrics and efficiency indicators. XGBoost emerged as the top performer, achieving 98.27% accuracy, a ROC-AUC of 0.9970, an average inference time of 0.000004 seconds per sample, and a memory footprint of just 5.45 KB. These results demonstrate that through efficient preprocessing and feature selection, high-performing malware detection systems can be made suitable for real-time deployment on resource-constrained Android devices.