ISOLATION FOREST PARAMETER TUNING FOR MOBILE APP ANOMALY DETECTION BASED ON PERMISSION REQUESTS

Ensuring mobile app security needs the capability to detect apps that request excessive or inappropriate permissions. This research proposes an anomaly detection approach using Isolation Forest, enhanced through hyperparameter tuning, to identify suspect apps based on permission request patterns. The dataset is processed into binary features, followed by exploratory data analysis (EDA) to examine the distribution and highlight sensitive permissions. The Isolation Forest model is then optimized by tuning parameters such as contamination level, number of estimators, and sample size. The fine-tuned model achieved a more accurate separation between normal and anomaly applications, detecting 10 anomalies out of 200 applications, with anomaly applications averaging 125.10 permits compared to 42.76 in normal applications. These anomalies often requested permissions related to network, storage, contacts and microphone, indicating potential privacy risks. The results show that parameter tuning improves the detection performance of Isolation Forest, providing a practical solution for mobile security monitoring. After tuning, the number of false positives decreased by 50%, and the model successfully reduced detected anomalies from 20 to 10, increasing the precision of anomaly detection from 70% to 90%. Future work could include improving feature selection and integration into real-time detection systems.