Advanced Android Malware Detection: Merging Deep Learning and XGBoost Techniques

Esra Kavalcı Yılmaz; Rezan Bakır

Makale detayları

Advanced Android Malware Detection: Merging Deep Learning and XGBoost Techniques

Yazarlar:

Esra Kavalcı Yılmaz | Rezan Bakır

Yayıncı:

Gazi University

Ana Başlıklar:

Yapay Zeka (Diğer)

Dergi:

Bilişim Teknolojileri Dergisi Vol.18 Issue 1, pp.45-61

Belge Tipi:

Makale

Yayın Tarihi:

1/2025

Belge Dili:

İngilizce

Document ID (Org No.):

2001339774

pISSN:

1307-9697

Anahtar kelimeler:

Özet:

 The increasing importance of Android devices in our lives brings with it the need to secure personal information stored on these devices, such as contact details, documents, location data, and browser data. These devices are often targeted by attacks and malware designed to steal this data. In response, this work takes a novel approach to Android malware detection by integrating deep learning with traditional machine learning algorithms. An extensive experimental study was conducted using the DroidCollector network traffic analysis dataset. Eight different deep learning methods are analysed for malware classification. In the first phase, experiments were conducted on both original and stabilised datasets and the most effective methods were identified. In the second phase, the best performing deep learning methods were combined with XGBoost for classification. This hybrid approach increased classification success by 3-4. The highest F1 and accuracy values obtained after 150 epochs of training with BiLSTMXGBoost were 95.12 and 99.33 respectively. These results highlight the superiority of combining deep learning and traditional machine learning techniques over individual models and significantly improve classification accuracy. This integrated method provides a very important strategy for developing high-performance models for various applications.

 The increasing importance of Android devices in our lives brings with it the need to secure personal information stored on these devices, such as contact details, documents, location data, and browser data. These devices are often targeted by attacks and malware designed to steal this data. In response, this work takes a novel approach to Android malware detection by integrating deep learning with traditional machine learning algorithms. An extensive experimental study was conducted using the DroidCollector network traffic analysis dataset. Eight different deep learning methods are analysed for malware classification. In the first phase, experiments were conducted on both original and stabilised datasets and the most effective methods were identified. In the second phase, the best performing deep learning methods were combined with XGBoost for classification. This hybrid approach increased classification success by 3-4. The highest F1 and accuracy values obtained after 150 epochs of training with BiLSTMXGBoost were 95.12 and 99.33 respectively. These results highlight the superiority of combining deep learning and traditional machine learning techniques over individual models and significantly improve classification accuracy. This integrated method provides a very important strategy for developing high-performance models for various applications.

 The increasing importance of Android devices in our lives brings with it the need to secure personal information stored on these devices, such as contact details, documents, location data, and browser data. These devices are often targeted by attacks and malware designed to steal this data. In response, this work takes a novel approach to Android malware detection by integrating deep learning with traditional machine learning algorithms. An extensive experimental study was conducted using the DroidCollector network traffic analysis dataset. Eight different deep learning methods are analysed for malware classification. In the first phase, experiments were conducted on both original and stabilised datasets and the most effective methods were identified. In the second phase, the best performing deep learning methods were combined with XGBoost for classification. This hybrid approach increased classification success by 3-4. The highest F1 and accuracy values obtained after 150 epochs of training with BiLSTMXGBoost were 95.12 and 99.33 respectively. These results highlight the superiority of combining deep learning and traditional machine learning techniques over individual models and significantly improve classification accuracy. This integrated method provides a very important strategy for developing high-performance models for various applications.

 Android cihazların hayatımızdaki artan önemi, bu cihazlarda depolanan kişisel bilgileri iletişim bilgileri, belgeler, konum verileri ve tarayıcı verileri gibi güvence altına alma ihtiyacını beraberinde getirir. Bu cihazlar genellikle bu verileri çalmak için tasarlanmış saldırılar ve kötü amaçlı yazılımların hedefi olur. Bu duruma önlem olarak, bu çalışma derin öğrenmeyi geleneksel makine öğrenimi algoritmalarıyla entegre ederek Android kötü amaçlı yazılım tespitine yeni bir yaklaşım sunmaktadır. DroidCollector ağ trafiği analizi veri kümesi kullanılarak kapsamlı bir deneysel çalışma yürütülmüştür. Kötü amaçlı yazılım sınıflandırması için sekiz farklı derin öğrenme yöntemi analiz edilmiştir. İlk aşamada, hem orijinal hem de önişlemden geçirilmiş SMOTE, SMOTETomek, ClusterCentroids veri kümeleri üzerinde deneyler yürütülmüş ve en etkili yöntemler belirlenmiştir. İkinci aşamada, en iyi performans gösteren derin öğrenme yöntemleri sınıflandırma için XGBoost ile birleştirilmiştir. Bu hibrit yaklaşım, sınıflandırma başarısını 3-4 oranında artırmıştır. BiLSTM  XGBoost modelinin 150 epoch ile eğitilmesiyle elde edilen en yüksek F1-score ve doğruluk değerleri sırasıyla 95,12 ve 99,33 olmuştur. Bu sonuçlar, derin öğrenme ve geleneksel makine öğrenimi tekniklerinin bireysel modellere göre birleştirilmesinin üstünlüğünü vurgular ve sınıflandırma doğruluğunu önemli ölçüde iyileştirir. Bu hibrit yöntem, çeşitli uygulamalar için yüksek performanslı modeller geliştirmek amacıyla önemli bir strateji sunmaktadır.

Makale detayları

Advanced Android Malware Detection: Merging Deep Learning and XGBoost Techniques

Yazarlar:

Esra Kavalcı Yılmaz | Rezan Bakır

Yayıncı:

Gazi University

Ana Başlıklar:

Yapay Zeka (Diğer)

Dergi:

Bilişim Teknolojileri Dergisi Vol.18 Issue 1, pp.45-61

Belge Tipi:

Makale

Yayın Tarihi:

1/2025

Belge Dili:

İngilizce

Document ID (Org No.):

2001339774

pISSN:

1307-9697

Malware detection

machine learning

deep learning

XGBoostKötü amaçlı yazılım tespiti

makine öğrenmesi

derin öğrenme

XGBoost

Sayı

Makale detayları

Yazarlar: Esra Kavalcı Yılmaz | Rezan Bakır

Yayıncı: Gazi University

Ana Başlıklar: Yapay Zeka (Diğer)

Dergi: Bilişim Teknolojileri Dergisi Vol.18 Issue 1, pp.45-61

Belge Tipi: Makale

Yayın Tarihi: 1/2025

Belge Dili: İngilizce

Document ID (Org No.): 2001339774

pISSN: 1307-9697

Sayı

Yazarlar:

Esra Kavalcı Yılmaz | Rezan Bakır

Yayıncı:

Gazi University

Ana Başlıklar:

Yapay Zeka (Diğer)

Dergi:

Bilişim Teknolojileri Dergisi Vol.18 Issue 1, pp.45-61

Belge Tipi:

Makale

Yayın Tarihi:

1/2025

Belge Dili:

İngilizce

Document ID (Org No.):

2001339774

pISSN:

1307-9697