Wordcloud: Detecting mobile malware with deep learning and word of cloud

Mobile malware poses an increasing threat as it operates covertly and jeopardises user data and device functionality. Security professionals adopt two forms of analysis (static and dynamic) to detect malware. Dynamic analysis requires a significant amount of computational power and time to monitor, whereas static analysis uses fewer resources and processes more efficiently. However, finding the relevant features in static analysis is challenging, as the categories of features (permission, system calls, and intent) are constantly evolving, with too many options to choose from, and obfuscation presents additional challenges. In this paper, we present Wordcloud, a framework that uses static analysis, deep learning, and visual semantic representation to overcome these challenges. Our approach reverse-engineers Android APK files to smali code, then converts it into visual Wordcloud patterns that encode token frequency and structural patterns of the malware. These images are then classified using a convolutional neural network (CNN) to determine whether a sample is benign or malicious. Wordcloud survives obfuscation as it transforms the smali code into a visual “signature” that reflects statistical and structural traits of malware. We evaluated a real-world dataset of 50,000 Android samples from AMD and Androzoo, achieving 99.48% accuracy with high precision, recall, specificity, and F1 score metrics. Statistical tests were also performed to validate the performance improvement from our filtering process. This work contributes to a scalable, efficient malware prediction and detection solution for early threat identification in mobile security systems.