Kamal Acharya

Postdoctoral Research Associate at Baylor University

Back to Publications

Book Chapter

AI for Android Malware Detection and Classification

By Safayat Bin Hakim Muhammad Adil Kamal Acharya Houbing Herbert Song

An attention-enhanced hybrid learning framework for accurate, compact, and adversarially robust Android malware detection and classification.

2025 AI for Cybersecurity: Research and Practice DOI: 10.1002/9781394293773.ch15

Cybersecurity Android Malware Artificial Intelligence

DOI Publisher Page Cite

Abstract

Android applications are deeply integrated into modern life, serving functions ranging from financial management to personal health monitoring. However, increasingly sophisticated malware targeting the Android ecosystem creates significant cybersecurity challenges. This chapter presents an enhanced hybrid framework combining an attention-enhanced multilayer perceptron with a support vector machine for Android malware detection and classification. A two-stage dimensionality-reduction process reduces more than 9,760 features to 39 critical attributes through attention-based selection and then to 14 components using linear discriminant analysis on the CCCS-CIC-AndMal-2020 dataset. The framework achieves 99.75% accuracy on clean test data and 98.22% accuracy under adversarial conditions. Fast gradient sign method adversarial training improves resilience by systematically generating and integrating adversarial examples during training, supporting scalable, interpretable, and efficient malware detection.

In brief

What This Work Does

This chapter develops an Android malware detector that keeps only the most informative application features, classifies threats with a hybrid neural-network and SVM model, and remains effective when attackers deliberately manipulate inputs.

Research impact

Why It Matters

Mobile malware defenses must be accurate without requiring thousands of features, and they must remain reliable when adversaries attempt to evade detection. The proposed framework combines aggressive feature reduction with adversarial training to improve efficiency, interpretability, and resilience.

Paper at a glance

Research Scope

4Research stages
5Methods or application areas

Android Malware Detection Pipeline

1

Attention-Based Selection

An attention-enhanced MLP identifies 39 critical attributes from a feature space containing more than 9,760 features.

2

LDA Optimization

Linear discriminant analysis further compresses the selected representation from 39 attributes to 14 components.

3

SVM Classification

An SVM uses the compact representation to detect malware and distinguish Android malware families.

4

Adversarial Training

FGSM-generated examples are incorporated during training to strengthen performance against evasion attempts.

Key Contributions

  • Develops a hybrid attention-enhanced MLP and SVM framework for Android malware detection and classification.
  • Introduces two-stage dimensionality reduction from more than 9,760 features to 39 attributes and then 14 components.
  • Integrates FGSM-based adversarial training to improve resilience against manipulated inputs.
  • Demonstrates high accuracy on both clean and adversarial test data using the CCCS-CIC-AndMal-2020 dataset.

Evidence at a glance

Key Findings

9,760+ → 39 → 14

Two-stage feature optimization produces a compact representation for efficient classification.

99.75%

Accuracy achieved on clean test data.

98.22%

Accuracy retained under adversarial conditions.

FGSM

Adversarial examples are incorporated during training to improve robustness against evolving threats.

Acknowledgment

Research Support

U.S. National Science Foundation

Partial support through Grant Nos. 2317117 and 2309760

Method Components

CCCS-CIC-AndMal-2020

Provides the extensive Android malware dataset used for training and evaluation.

Attention-Enhanced MLP

Learns feature importance and extracts a compact set of critical attributes.

Linear Discriminant Analysis

Further reduces dimensionality while preserving discriminative information.

Support Vector Machine

Performs final malware detection and family classification.

FGSM Adversarial Training

Tests and improves model resilience under adversarial perturbations.

Publication Details

Type
Book Chapter
Venue
In AI for Cybersecurity: Research and Practice
Year
2025
Published
December 27, 2025
Pages
419-450

Research Topics

Cybersecurity Android Malware Artificial Intelligence

Citation

@incollection{hakim2025android,
  author={Hakim, Safayat Bin and Adil, Muhammad and Acharya, Kamal and Song, Houbing Herbert},
  title={AI for Android Malware Detection and Classification},
  booktitle={AI for Cybersecurity: Research and Practice},
  publisher={Wiley},
  pages={419--450},
  year={2025},
  doi={10.1002/9781394293773.ch15}
}