A lightweight static-analysis framework with optimized feature selection for android malware detection and classification

Abstract

Android malware is growing rapidly, making detection more challenging and necessitating systems that are both accurate and efficient. This study aims to design a lightweight and reliable framework for Android malware detection and classification that reduces computational costs while maintaining strong performance. The proposed method employs static analysis and combines feature reduction, statistical feature selection, and a deep learning model. Initially, Principal Component Analysis (PCA) is used to reduce and simplify the original feature set. Subsequently, ANOVA-based ranking identifies the most important features with minimal computational effort. These selected features are then input into a CNN–BiGRU model, which learns both local patterns and sequential relationships within the data. The framework is evaluated using five-fold cross-validation on the Drebin and KronoDroid benchmark datasets for both binary and multiclass classification. Results demonstrate that the model achieves 98% accuracy on the Drebin dataset, 97% accuracy for binary classification on KronoDroid, and 96% accuracy for malware family classification. The PCA–ANOVA approach performs comparably to tree-based feature selection methods but requires less computation. Overall, the findings indicate that combining efficient feature selection with a lightweight neural network offers a practical, scalable, and effective solution for real-world Android malware detection.