Integrating Built-in Feature Importance and Mutual Information for Efficient Android Malware Classification Model

Abstract

The rapid growth of the Android operating system in the global market demands efficient and accurate malware detection solutions. This study proposes an Android malware classification approach based on machine learning with a focus on feature selection optimization to achieve an optimal balance between performance and computational efficiency. Using the CICMalDroid2020 dataset, consisting of 11598 samples and 470 dynamic features, this study evaluates four machine learning algorithms (LightGBM, XGBoost, Random Forest, and K-Nearest Neighbours) combined with two feature selection methods: Mutual Information (MI) and Embedded Feature Importance (FI). Experiments were conducted with automatic feature selection over 50-475 features to identify the optimal configuration for each model. The research results show that LightGBM with Feature Importance achieves the best performance, with an accuracy of 96.49%, an F1-score of 95.74%, using only 270 features (a 42.6% reduction), and the fastest test time of 0.036 seconds. XGBoost FI achieves 96.31% accuracy with 225 features (52.1% reduction), Random Forest MI achieves 95.62% with 240 features, while KNN MI achieves 91.37% with 135 features. Feature overlap analysis reveals that the 135 core features selected by KNN MI are a subset of features from other models, with dominant categories including system calls (40%), Android API (25%), network operations (15%), file system patterns (10%), and behavioural patterns (10%). This research shows that the Feature Importance method from tree-based algorithms outperforms Mutual Information by 5-6% in capturing non-linear dependencies and complex interactions in malware behaviour. Feature Importance can detect contextual patterns, such as the combination of getDeviceId and NETWORK_ACCESS, that are only dangerous when occurring simultaneously, which are more easily detected by tree-based methods. The optimal range of 225-270 features provides a sweet spot between comprehensiveness and efficiency; XGBoost with 225 features is only 0.18% below LightGBM but 16.7% more computationally efficient, making it ideal for real-time scanning. The main contribution of this research is the development of a light-weight yet reliable model without destructive sampling techniques, providing a practical solution for real-time malware detection on Android devices with limited resources. This approach successfully reduces dimensions by up to 52% while maintaining, or even improving, performance, making significant contributions to the development of efficient, accurate, and applicable Android malware detection techniques for real-time security systems. For further development, exploring LightGBM-XGBoost ensembles could increase accuracy beyond 97%, along with advanced feature engineering and periodic evaluation of the latest malware variants.