Kamal Acharya

Postdoctoral Research Associate at Baylor University

Back to Publications

Conference Paper

Decoding Android Malware with a Fraction of Features: An Attention-Enhanced MLP-SVM Approach

By Safayat Bin Hakim Muhammad Adil Kamal Acharya Houbing Herbert Song

An LNCS/NSS 2024 paper on Android malware detection that combines attention-enhanced MLP feature learning, LDA dimensionality reduction, RBF-kernel SVM classification, and SHAP interpretability.

2025 NSS 2024 (LNCS 15564, 2025) DOI: 10.1007/978-981-96-3531-3_10

Android Malware Cybersecurity Machine Learning

Open Repository Copy DOI Publisher Page Cite

Abstract

The escalating sophistication of Android malware poses significant challenges to traditional detection methods, necessitating innovative approaches that can efficiently identify and classify threats with high precision. This paper introduces a novel framework that synergistically integrates an attention-enhanced Multi-Layer Perceptron (MLP) with a Support Vector Machine (SVM) to make Android malware detection and classification more effective. By carefully analyzing a mere 47 features out of over 9,760 available in the comprehensive CCCS-CIC-AndMal-2020 dataset, our MLP-SVM model achieves an impressive accuracy over 99% in identifying malicious applications. The MLP, enhanced with an attention mechanism, focuses on the most discriminative features and further reduces the 47 features to only 14 components using Linear Discriminant Analysis (LDA). Despite this significant reduction in dimensionality, the SVM component, equipped with an RBF kernel, excels in mapping these components to a high-dimensional space, facilitating precise classification of malware into their respective families. Rigorous evaluations, encompassing accuracy, precision, recall, and F1-score metrics, confirm the superiority of our approach compared to existing state-of-the-art techniques. The proposed framework not only significantly reduces the computational complexity by leveraging a compact feature set but also exhibits resilience against the evolving Android malware landscape.

In brief

What This Work Does

The paper shows that Android malware can be detected and classified accurately using only a small fraction of available features, making the model more efficient and easier to interpret.

Research impact

Why It Matters

The work supports efficient Android malware detection pipelines that remain accurate while reducing feature dimensionality, computational cost, and interpretability barriers.

Paper at a glance

Research Scope

4Research stages
5Methods or application areas
6Future research directions

Attention-Enhanced Malware Classification Pipeline

1

Select Features

Selects 47 discriminative static and dynamic features from more than 9,760 available CCCS-CIC-AndMal-2020 features.

2

Learn Attention

Uses an attention-enhanced MLP to learn weighted representations that emphasize the most informative malware signals.

3

Compress Representation

Applies Linear Discriminant Analysis to reduce the learned representation to 14 components.

4

Classify Malware

Uses an RBF-kernel SVM for malware family classification and evaluates accuracy, precision, recall, and F1-score.

Key Contributions

  • Combines an attention-enhanced MLP with an RBF-kernel SVM for Android malware detection and family classification.
  • Reduces the feature set from more than 9,760 Android malware features to 47 selected features, then to 14 LDA components.
  • Uses attention to focus representation learning on the most discriminative malware features.
  • Applies SHAP analysis to improve model transparency and explain classification behavior.
  • Reports over 99% malware detection accuracy with a compact and computationally efficient feature pipeline.

Method Components

Attention-Enhanced MLP

Learns nonlinear representations and dynamically weights important Android malware features.

Linear Discriminant Analysis

Reduces the MLP representation to 14 class-separating components before SVM training.

Support Vector Machine

Uses an RBF kernel to separate malware families in a transformed high-dimensional feature space.

SHAP Interpretability

Explains feature contributions to SVM decisions with beeswarm and waterfall visualizations.

Compact Feature Pipeline

Improves deployability by reducing thousands of original features to a small, high-value representation.

Research Gaps

  1. Compact feature sets
  2. Deployment efficiency
  3. Family-level classification
  4. Adversarial robustness
  5. Dataset drift
  6. Real-time detection

Publication Details

Type
Conference Paper
Venue
NSS 2024 (LNCS 15564, 2025)
Year
2025
Pages
1-17

Research Topics

Android Malware Cybersecurity Machine Learning Attention Mechanism Explainable AI

Citation

@inproceedings{hakim2025decoding,
  author={Hakim, Safayat Bin and Adil, Muhammad and Acharya, Kamal and Song, Houbing Herbert},
  title={Decoding Android Malware with a Fraction of Features: An Attention-Enhanced MLP-SVM Approach},
  booktitle={Network and System Security},
  year={2025},
  pages={1--17},
  doi={10.1007/978-981-96-3531-3_10}
}