{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,21]],"date-time":"2025-11-21T10:01:30Z","timestamp":1763719290866,"version":"3.45.0"},"reference-count":66,"publisher":"MDPI AG","issue":"12","license":[{"start":{"date-parts":[[2025,11,21]],"date-time":"2025-11-21T00:00:00Z","timestamp":1763683200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Umm Al-Qura University, Saudi Arabia","award":["25UQU4361220GSSR03"],"award-info":[{"award-number":["25UQU4361220GSSR03"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>Mobile devices are frequent targets of malware due to the large volume of sensitive personal, financial, and corporate data they process. Traditional static, dynamic, and hybrid analysis methods are increasingly insufficient against evolving threats. This paper proposes a resilient deep learning framework for Android malware detection, integrating multiple models and a CPU-aware selection algorithm to balance accuracy and efficiency on mobile devices. Two benchmark datasets (i.e., the Android Malware Dataset for Machine Learning and CIC-InvesAndMal2019) were used to evaluate five deep learning models: DNN, CNN, RNN, LSTM, and CNN-LSTM. The results show that CNN-LSTM achieves the highest detection accuracy of 97.4% on CIC-InvesAndMal2019, while CNN delivers strong accuracy of 98.07%, with the lowest CPU usage (5.2%) on the Android Dataset, making it the most practical for on-device deployment. The framework is implemented as an Android application using TensorFlow Lite, providing near-real-time malware detection with an inference time of under 150 ms and memory usage below 50 MB. These findings confirm the effectiveness of deep learning for mobile malware detection and demonstrate the feasibility of deploying resilient detection systems on resource-constrained devices.<\/jats:p>","DOI":"10.3390\/fi17120532","type":"journal-article","created":{"date-parts":[[2025,11,21]],"date-time":"2025-11-21T09:50:26Z","timestamp":1763718626000},"page":"532","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["A Resilient Deep Learning Framework for Mobile Malware Detection: From Architecture to Deployment"],"prefix":"10.3390","volume":"17","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1490-2633","authenticated-orcid":false,"given":"Aysha","family":"Alfaw","sequence":"first","affiliation":[{"name":"College of Information Technology, University of Bahrain, Sakhir P.O. Box 32038, Bahrain"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-8635-5239","authenticated-orcid":false,"given":"Mohsen","family":"Rouached","sequence":"additional","affiliation":[{"name":"College of Information Technology, University of Bahrain, Sakhir P.O. Box 32038, Bahrain"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1781-2908","authenticated-orcid":false,"given":"Aymen","family":"Akremi","sequence":"additional","affiliation":[{"name":"College of Computing, Umm Al-Qura University (UQU), Makkah 21955, Saudi Arabia"}]}],"member":"1968","published-online":{"date-parts":[[2025,11,21]]},"reference":[{"key":"ref_1","unstructured":"Khanachivskyi, O. (2025, September 10). How Many Apps Are in the Google Play Store in 2025? A Look at the Mobile Landscape. Available online: https:\/\/litslink.com\/blog\/how-many-apps-are-in-the-google-play-store."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1155\/2022\/9797604","article-title":"Machine learning and applied cryptography","volume":"2022","author":"Anees","year":"2022","journal-title":"Secur. Commun. Netw."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"100014","DOI":"10.1016\/j.csa.2023.100014","article-title":"A review of deep learning models to detect malware in Android applications","volume":"1","author":"Mbunge","year":"2023","journal-title":"Cyber Secur. Appl."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"140","DOI":"10.3390\/jcp1010008","article-title":"Sharing machine learning models as indicators of compromise for cyber threat intelligence","volume":"1","author":"Preuveneers","year":"2021","journal-title":"J. Cybersecur. Priv."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Su, X., Xiao, L., Li, W., Liu, X., Li, K.C., and Liang, W. (2020). DroidPortrait: Android malware portrait construction based on multidimensional behavior analysis. Appl. Sci., 10.","DOI":"10.3390\/app10113978"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Yerima, S.Y. (2023). High Accuracy Detection of Mobile Malware Using Machine Learning. Electronics, 12.","DOI":"10.3390\/books978-3-0365-7174-4"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Chowdhury, M.N.U.R., Haque, A., Soliman, H., Hossen, M.S., Fatima, T., and Ahmed, I. (2023). Android malware Detection using Machine learning: A Review. arXiv.","DOI":"10.36227\/techrxiv.22580881.v1"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"104361","DOI":"10.1016\/j.cose.2025.104361","article-title":"M2FD: Mobile malware federated detection under concept drift","volume":"152","author":"Augello","year":"2025","journal-title":"Comput. Secur."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"020031","DOI":"10.1063\/5.0246042","article-title":"A review on machine learning in cryptography: Future perspective and application","volume":"Volume 3224","author":"Nayak","year":"2025","journal-title":"AIP Conference Proceedings"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Catakoglu, O., Balduzzi, M., and Balzarotti, D. (2016, January 11\u201315). Automatic extraction of indicators of compromise for web applications. Proceedings of the 25th International Conference on World Wide Web, Montreal, QC, Canada.","DOI":"10.1145\/2872427.2883056"},{"key":"ref_11","unstructured":"Zhou, S., Long, Z., Tan, L., and Guo, H. (2018). Automatic identification of indicators of compromise using neural-based sequence labelling. arXiv."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3587255","article-title":"Understanding indicators of compromise against cyber-attacks in industrial control systems: A security perspective","volume":"7","author":"Asiri","year":"2023","journal-title":"ACM Trans.-Cyber-Phys. Syst."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"e841","DOI":"10.7717\/peerj-cs.841","article-title":"A forensic-driven data model for automatic vehicles events analysis","volume":"8","author":"Akremi","year":"2022","journal-title":"PeerJ Comput. Sci."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Rouached, M., Akremi, A., Macherki, M., and Kraiem, N. (2024). Policy-Based Smart Contracts Management for IoT Privacy Preservation. Future Internet, 16.","DOI":"10.3390\/fi16120452"},{"key":"ref_15","first-page":"1","article-title":"Deep learning for android malware defenses: A systematic literature review","volume":"55","author":"Liu","year":"2022","journal-title":"ACM Comput. Surv."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"99","DOI":"10.1186\/s40537-025-01157-y","article-title":"Application of deep learning in malware detection: A review","volume":"12","author":"Song","year":"2025","journal-title":"J. Big Data"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"100372","DOI":"10.1016\/j.cosrev.2021.100372","article-title":"Comparative analysis of Android and iOS from security viewpoint","volume":"40","author":"Garg","year":"2021","journal-title":"Comput. Sci. Rev."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Senanayake, J., Kalutarage, H., and Al-Kadri, M.O. (2021). Android mobile malware detection using machine learning: A systematic review. Electronics, 10.","DOI":"10.3390\/electronics10131606"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"62","DOI":"10.4018\/ijisp.2014010104","article-title":"An efficient intrusion alerts miner for forensics readiness in high speed networks","volume":"8","author":"Akremi","year":"2014","journal-title":"Int. J. Inf. Secur. Priv. (IJISP)"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"6249","DOI":"10.1109\/ACCESS.2019.2963724","article-title":"A comprehensive review on malware detection approaches","volume":"8","author":"Aslan","year":"2020","journal-title":"IEEE Access"},{"key":"ref_21","first-page":"1","article-title":"Dynamic detection of mobile malware using smartphone data and machine learning","volume":"3","author":"Bucur","year":"2022","journal-title":"Digit. Threat. Res. Pract. (DTRAP)"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3556974","article-title":"Android source code vulnerability detection: A systematic literature review","volume":"55","author":"Senanayake","year":"2023","journal-title":"ACM Comput. Surv."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Alromaihi, N., Rouached, M., and Akremi, A. (2025). Design and Analysis of an Effective Architecture for Machine Learning Based Intrusion Detection Systems. Network, 5.","DOI":"10.3390\/network5020013"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"123","DOI":"10.1016\/j.cose.2018.11.001","article-title":"Survey of machine learning techniques for malware analysis","volume":"81","author":"Ucci","year":"2019","journal-title":"Comput. Secur."},{"key":"ref_25","first-page":"290","article-title":"A review on machine-learning based code smell detection techniques in object-oriented software system (s)","volume":"14","author":"Kaur","year":"2021","journal-title":"Recent Adv. Electr. Electron. Eng. (Former. Recent Patents Electr. Electron. Eng."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"1153","DOI":"10.1109\/COMST.2015.2494502","article-title":"A survey of data mining and machine learning methods for cyber security intrusion detection","volume":"18","author":"Buczak","year":"2015","journal-title":"IEEE Commun. Surv. Tutorials"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"80","DOI":"10.1109\/MC.2017.201","article-title":"DDoS in the IoT: Mirai and other botnets","volume":"50","author":"Kolias","year":"2017","journal-title":"Computer"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Meng, G., Xue, Y., Xu, Z., Liu, Y., Zhang, J., and Narayanan, A. (2016, January 18\u201320). Semantic modelling of android malware for effective malware comprehension, detection, and classification. Proceedings of the 25th International Symposium on Software Testing and Analysis, Saarbr\u00fccken, Germany.","DOI":"10.1145\/2931037.2931043"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3313391","article-title":"Mamadroid: Detecting android malware by building markov chains of behavioral models (extended version)","volume":"22","author":"Onwuzurike","year":"2019","journal-title":"ACM Trans. Priv. Secur. (TOPS)"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"13271","DOI":"10.1007\/s11042-020-10367-w","article-title":"FSDroid:-A feature selection technique to detect malware from Android using Machine Learning Techniques: FSDroid","volume":"80","author":"Mahindru","year":"2021","journal-title":"Multimed. Tools Appl."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"106569","DOI":"10.1016\/j.infsof.2021.106569","article-title":"MEGDroid: A model-driven event generation framework for dynamic android malware analysis","volume":"135","author":"Hasan","year":"2021","journal-title":"Inf. Softw. Technol."},{"key":"ref_32","first-page":"1","article-title":"Software security static analysis false alerts handling approaches","volume":"12","author":"Akremi","year":"2021","journal-title":"Int. J. Adv. Comput. Sci. Appl"},{"key":"ref_33","unstructured":"Liu, L., and Wang, B. (2017, January 22\u201324). Automatic malware detection using deep learning based on static analysis. Proceedings of the Data Science: Third International Conference of Pioneering Computer Scientists, Engineers and Educators, ICPCSEE 2017, Changsha, China. Proceedings, Part I."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Saxe, J., and Berlin, K. (2015, January 20\u201322). Deep neural network based malware detection using two dimensional binary program features. Proceedings of the 2015 10th International Conference on Malicious and Unwanted Software (MALWARE), Fajardo, PR, USA.","DOI":"10.1109\/MALWARE.2015.7413680"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Xu, K., Li, Y., Deng, R.H., and Chen, K. (2018, January 24\u201326). DeepRefiner: Multi-layer Android Malware Detection System Applying Deep Neural Networks. Proceedings of the 2018 IEEE European Symposium on Security and Privacy, London, UK.","DOI":"10.1109\/EuroSP.2018.00040"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s13677-022-00349-8","article-title":"A malware detection system using a hybrid approach of multi-heads attention-based control flow traces and image visualization","volume":"11","author":"Ullah","year":"2022","journal-title":"J. Cloud Comput."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"112","DOI":"10.1016\/j.future.2019.07.070","article-title":"Static malware detection and attribution in android byte-code through an end-to-end deep system","volume":"102","author":"Amin","year":"2020","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Oak, R., Du, M., Yan, D., Takawale, H., and Amit, I. (2019, January 15). Malware detection on highly imbalanced data through sequence modeling. Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security, London, UK.","DOI":"10.1145\/3338501.3357374"},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"101663","DOI":"10.1016\/j.cose.2019.101663","article-title":"DL-Droid: Deep learning based android malware detection using real devices","volume":"89","author":"Alzaylaee","year":"2020","journal-title":"Comput. Secur."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"5183","DOI":"10.1007\/s00521-020-05309-4","article-title":"MLDroid\u2014framework for Android malware detection using machine learning techniques","volume":"33","author":"Mahindru","year":"2021","journal-title":"Neural Comput. Appl."},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"39680","DOI":"10.1109\/ACCESS.2021.3063748","article-title":"AdMat: A CNN-on-matrix approach to Android malware detection and classification","volume":"9","author":"Vu","year":"2021","journal-title":"IEEE Access"},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Arp, D., Spreitzenbarth, M., Hubner, M., Gascon, H., Rieck, K., and Siemens, C. (2014, January 23\u201326). Drebin: Effective and explainable detection of android malware in your pocket. Proceedings of the NDSS, San Diego, CA, USA.","DOI":"10.14722\/ndss.2014.23247"},{"key":"ref_43","unstructured":"Wei, F., Li, Y., Roy, S., Ou, X., and Zhou, W. (2017, January 6\u20137). Deep ground truth analysis of current android malware. Proceedings of the Detection of Intrusions and Malware, and Vulnerability Assessment: 14th International Conference, DIMVA 2017, Bonn, Germany. Proceedings 14."},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Lashkari, A.H., Kadir, A.F.A., Taheri, L., and Ghorbani, A.A. (2018, January 22\u201325). Toward Developing a Systematic Approach to Generate Benchmark Android Malware Datasets and Classification. Proceedings of the 2018 International Carnahan Conference on Security Technology (ICCST), Montreal, QC, Canada.","DOI":"10.1109\/CCST.2018.8585560"},{"key":"ref_45","unstructured":"Chen, K., Wang, P., Lee, Y., Wang, X., Zhang, N., Huang, H., Zou, W., and Liu, P. (2015, January 12\u201314). Finding unknown malice in 10 seconds: Mass vetting for new threats at the google-play scale. Proceedings of the 24th {USENIX} Security Symposium ({USENIX} Security 15), Washington, DC, USA."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Allix, K., Bissyand\u00e9, T.F., Klein, J., and Le Traon, Y. (2016, January 14\u201315). Androzoo: Collecting millions of android apps for the research community. Proceedings of the 13th International Conference on Mining Software Repositories, Austin, TX, USA.","DOI":"10.1145\/2901739.2903508"},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"453","DOI":"10.1109\/TCYB.2017.2777960","article-title":"DroidFusion: A Novel Multilevel Classifier Fusion Approach for Android Malware Detection","volume":"49","author":"Yerima","year":"2019","journal-title":"IEEE Trans. Cybern."},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Alomari, E.S., Nuiaa, R.R., Alyasseri, Z.A.A., Mohammed, H.J., Sani, N.S., Esa, M.I., and Musawi, B.A. (2023). Malware detection using deep learning and correlation-based feature selection. Symmetry, 15.","DOI":"10.3390\/sym15010123"},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"e1","DOI":"10.1017\/S026988891800036X","article-title":"Data preprocessing in predictive data mining","volume":"34","author":"Alexandropoulos","year":"2019","journal-title":"Knowl. Eng. Rev."},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"114060","DOI":"10.1016\/j.eswa.2020.114060","article-title":"Machine learning and data mining in manufacturing","volume":"166","author":"Dogan","year":"2021","journal-title":"Expert Syst. Appl."},{"key":"ref_51","doi-asserted-by":"crossref","first-page":"658","DOI":"10.1016\/j.procs.2019.09.221","article-title":"Prediction of stress levels with LSTM and passive mobile sensors","volume":"159","author":"Acikmese","year":"2019","journal-title":"Procedia Comput. Sci."},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"841","DOI":"10.1016\/j.procs.2021.03.105","article-title":"ReDroidDet: Android malware detection based on recurrent neural network","volume":"184","author":"Almahmoud","year":"2021","journal-title":"Procedia Comput. Sci."},{"key":"ref_53","doi-asserted-by":"crossref","unstructured":"Bulut, I., and Yavuz, A.G. (2017, January 15\u201318). Mobile malware detection using deep neural network. Proceedings of the 2017 25th Signal Processing and Communications Applications Conference (SIU), Antalya, Turkey.","DOI":"10.1109\/SIU.2017.7960568"},{"key":"ref_54","doi-asserted-by":"crossref","first-page":"R231","DOI":"10.1016\/j.cub.2019.02.034","article-title":"Neural network models and deep learning","volume":"29","author":"Kriegeskorte","year":"2019","journal-title":"Curr. Biol."},{"key":"ref_55","doi-asserted-by":"crossref","first-page":"2957203","DOI":"10.1155\/2022\/2957203","article-title":"NLP technique for malware detection using 1D CNN fusion model","volume":"2022","author":"Yeboah","year":"2022","journal-title":"Secur. Commun. Netw."},{"key":"ref_56","unstructured":"Parameswaran Lakshmi, S. (2020). A lightweight 1-D CNN Model to Detect Android Malware on the Mobile Phone. [Ph.D. Thesis, National College of Ireland]."},{"key":"ref_57","doi-asserted-by":"crossref","first-page":"132306","DOI":"10.1016\/j.physd.2019.132306","article-title":"Fundamentals of recurrent neural network (RNN) and long short-term memory (LSTM) network","volume":"404","author":"Sherstinsky","year":"2020","journal-title":"Phys. D Nonlinear Phenom."},{"key":"ref_58","doi-asserted-by":"crossref","first-page":"103498","DOI":"10.1016\/j.compind.2021.103498","article-title":"A survey on anomaly detection for technical systems using LSTM networks","volume":"131","author":"Lindemann","year":"2021","journal-title":"Comput. Ind."},{"key":"ref_59","doi-asserted-by":"crossref","first-page":"22","DOI":"10.1016\/j.diin.2015.02.001","article-title":"A review on feature selection in mobile malware detection","volume":"13","author":"Feizollah","year":"2015","journal-title":"Digit. Investig."},{"key":"ref_60","doi-asserted-by":"crossref","first-page":"103126","DOI":"10.1016\/j.cose.2023.103126","article-title":"DroidRL: Feature selection for android malware detection with reinforcement learning","volume":"128","author":"Wu","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_61","doi-asserted-by":"crossref","first-page":"118630","DOI":"10.1016\/j.eswa.2022.118630","article-title":"Impact of benign sample size on binary classification accuracy","volume":"211","author":"Mimura","year":"2023","journal-title":"Expert Syst. Appl."},{"key":"ref_62","doi-asserted-by":"crossref","unstructured":"Bisong, E., and Bisong, E. (2019). Introduction to Scikit-learn. Building Machine Learning and Deep Learning Models on Google Cloud Platform: A Comprehensive Guide for Beginners, Apress.","DOI":"10.1007\/978-1-4842-4470-8"},{"key":"ref_63","first-page":"1","article-title":"pandas: A foundational Python library for data analysis and statistics","volume":"14","author":"McKinney","year":"2011","journal-title":"Python High Perform. Sci. Comput."},{"key":"ref_64","first-page":"787","article-title":"Deep learning based malware detection for android systems: A Comparative Analysis","volume":"30","author":"Dogan","year":"2023","journal-title":"Teh. Vjesn."},{"key":"ref_65","doi-asserted-by":"crossref","unstructured":"Guan, J., Jiang, X., and Mao, B. (2021). A method for class-imbalance learning in android malware detection. Electronics, 10.","DOI":"10.3390\/electronics10243124"},{"key":"ref_66","doi-asserted-by":"crossref","unstructured":"Akremi, A. (2025). ForensicTwin: Incorporating Digital Forensics Requirements Within a Digital Twin. Computers, 14.","DOI":"10.3390\/computers14040115"}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/17\/12\/532\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,21]],"date-time":"2025-11-21T09:59:26Z","timestamp":1763719166000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/17\/12\/532"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,21]]},"references-count":66,"journal-issue":{"issue":"12","published-online":{"date-parts":[[2025,12]]}},"alternative-id":["fi17120532"],"URL":"https:\/\/doi.org\/10.3390\/fi17120532","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,11,21]]}}}