# Detection of Malicious Android Applications: Classical Machine Learning vs. Deep Neural Network Integrated with Clustering

arXiv: https://arxiv.org/abs/2103.00637 · HTML: https://mlsanity.com/paper/2103.00637/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 3 of its 30 references that are in the map.
- First posted on arXiv 28 Feb 2021.

## Builds on (most cited first, 3 of 3)

- [DOOM: A Novel Adversarial-DRL-Based Op-Code Level Metamorphic Malware Obfuscator for the Enhancement of IDS](https://mlsanity.com/paper/2010.08608/) (2020)
- [An investigation of the classifiers to detect android malicious apps](https://mlsanity.com/paper/1802.08611/) (2018)
- [An investigation of a deep learning based malware detection system](https://mlsanity.com/paper/1809.05888/) (2018)

## Built on by (most cited first, 4 of 4)

- [Deep Reinforcement Learning for Cybersecurity Threat Detection and Protection: A Review](https://mlsanity.com/paper/2206.02733/) (2022)
- [LSTM Hyper-Parameter Selection for Malware Detection: Interaction Effects and Hierarchical Selection Approach](https://mlsanity.com/paper/2109.11500/) (2021)
- [ADVERSARIALuscator: An Adversarial-DRL Based Obfuscator and Metamorphic Malware SwarmGenerator](https://mlsanity.com/paper/2109.11542/) (2021)
- [DRo: A data-scarce mechanism to revolutionize the performance of Deep Learning based Security Systems](https://mlsanity.com/paper/2109.05470/) (2021)

## Abstract (arXiv)

Today anti-malware community is facing challenges due to the ever-increasing sophistication and volume of malware attacks developed by adversaries. Traditional malware detection mechanisms are not able to cope-up with next-generation malware attacks. Therefore in this paper, we propose effective and efficient Android malware detection models based on machine learning and deep learning integrated with clustering. We performed a comprehensive study of different feature reduction, classification and clustering algorithms over various performance metrics to construct the Android malware detection models. Our experimental results show that malware detection models developed using Random Forest eclipsed deep neural network and other classifiers on the majority of performance metrics. The baseline Random Forest model without any feature reduction achieved the highest AUC of 99.4%. Also, the segregating of vector space using clustering integrated with Random Forest further boosted the AUC to 99.6% in one cluster and direct detection of Android malware in another cluster, thus reducing the curse of dimensionality. Additionally, we found that feature reduction in detection models does improve the model efficiency (training and testing time) many folds without much penalty on the effectiveness of the detection model.