{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,22]],"date-time":"2026-07-22T19:22:54Z","timestamp":1784748174860,"version":"3.55.0"},"reference-count":53,"publisher":"PeerJ","license":[{"start":{"date-parts":[[2024,12,23]],"date-time":"2024-12-23T00:00:00Z","timestamp":1734912000000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"abstract":"<jats:p>Today, a great number of attack opportunities for cybercriminals arise in Android, since it is one of the most used operating systems for many mobile applications. Hence, it is very important to anticipate these situations. To minimize this problem, the analysis of malware search applications is based on machine learning algorithms. Our work uses as a starting point the features proposed by the DREBIN project, which today constitutes a key reference in the literature, being the largest public Android malware dataset with labeled families. The authors only employ the support vector machine to determine whether a sample is malware or not. This work first proposes a new efficient dimensionality reduction of features, as well as the application of several supervised machine learning algorithms for prediction purposes. Predictive models based on Random Forest are found to achieve the most promising results. They can detect an average of 91.72% malware samples, with a very low false positive rate of 0.13%, and using only 5,000 features. This is just over 9% of the total number of features of DREBIN. It achieves an accuracy of 99.52%, a total precision of 96.91%, as well as a macro average F1-score of 96.99%.<\/jats:p>","DOI":"10.7717\/peerj-cs.2616","type":"journal-article","created":{"date-parts":[[2024,12,23]],"date-time":"2024-12-23T09:59:57Z","timestamp":1734947997000},"page":"e2616","source":"Crossref","is-referenced-by-count":9,"title":["Machine learning models and dimensionality reduction for improving the Android malware detection"],"prefix":"10.7717","volume":"10","author":[{"given":"Pablo","family":"Mor\u00e1n","sequence":"first","affiliation":[{"name":"Departamento de Sistemas de Comunicaci\u00f3n y Control, Universidad Nacional de Educaci\u00f3n a Distancia, Madrid, Spain"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5181-0199","authenticated-orcid":true,"given":"Antonio","family":"Robles-G\u00f3mez","sequence":"additional","affiliation":[{"name":"Departamento de Sistemas de Comunicaci\u00f3n y Control, Universidad Nacional de Educaci\u00f3n a Distancia, Madrid, Spain"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0619-8615","authenticated-orcid":true,"given":"Andres","family":"Duque","sequence":"additional","affiliation":[{"name":"Departamento de Lenguajes y Sistemas Inform\u00e1ticos, Universidad Nacional de Educaci\u00f3n a Distancia, Madrid, Spain"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Llanos","family":"Tobarra","sequence":"additional","affiliation":[{"name":"Departamento de Sistemas de Comunicaci\u00f3n y Control, Universidad Nacional de Educaci\u00f3n a Distancia, Madrid, Spain"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4089-9538","authenticated-orcid":true,"given":"Rafael","family":"Pastor-Vargas","sequence":"additional","affiliation":[{"name":"Departamento de Sistemas de Comunicaci\u00f3n y Control, Universidad Nacional de Educaci\u00f3n a Distancia, Madrid, Spain"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"4443","published-online":{"date-parts":[[2024,12,23]]},"reference":[{"issue":"4","key":"10.7717\/peerj-cs.2616\/ref-1","doi-asserted-by":"publisher","first-page":"2347","DOI":"10.1109\/COMST.2015.2444095","article-title":"Internet of things: a survey on enabling technologies, protocols, and applications","volume":"17","author":"Al-Fuqaha","year":"2015","journal-title":"IEEE Communications Surveys Tutorials"},{"key":"10.7717\/peerj-cs.2616\/ref-2","doi-asserted-by":"crossref","DOI":"10.14722\/ndss.2014.23247","article-title":"DREBIN: effective and explainable detection of android malware in your pocket","author":"Arp","year":"2014"},{"key":"10.7717\/peerj-cs.2616\/ref-3","article-title":"How to remove viruses from an android phone. Avast","author":"Belcic","year":"2024"},{"key":"10.7717\/peerj-cs.2616\/ref-4","doi-asserted-by":"crossref","first-page":"255","DOI":"10.1515\/9781400874668","volume-title":"Adaptive control processes: a guided tour. (A RAND Corporation Research Study)","volume":"XVI","author":"Bellman","year":"1961"},{"issue":"1","key":"10.7717\/peerj-cs.2616\/ref-5","first-page":"1063","article-title":"Analysis of a random forests model","volume":"13","author":"Biau","year":"2012","journal-title":"The Journal of Machine Learning Research"},{"issue":"1","key":"10.7717\/peerj-cs.2616\/ref-6","doi-asserted-by":"publisher","first-page":"103582","DOI":"10.1016\/j.cose.2023.103582","article-title":"Automated machine learning for deep learning based malware detection","volume":"137","author":"Brown","year":"2024","journal-title":"Computers & Security"},{"key":"10.7717\/peerj-cs.2616\/ref-7","article-title":"Introduction to dimensionality reduction for machine learning","author":"Brownlee","year":"2020"},{"key":"10.7717\/peerj-cs.2616\/ref-8","first-page":"108","article-title":"API design for machine learning software: experiences from the scikit-learn project","author":"Buitinck","year":"2013"},{"issue":"6","key":"10.7717\/peerj-cs.2616\/ref-9","doi-asserted-by":"publisher","first-page":"1455","DOI":"10.1109\/TIFS.2018.2879302","article-title":"Droidcat: effective android malware detection and categorization via app-level profiling","volume":"14","author":"Cai","year":"2019","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"10.7717\/peerj-cs.2616\/ref-10","first-page":"1234","article-title":"On benign features in malware detection","author":"Cao","year":"2020"},{"issue":"2","key":"10.7717\/peerj-cs.2616\/ref-11","doi-asserted-by":"publisher","first-page":"262","DOI":"10.1109\/TDSC.2017.2739145","article-title":"Ec2: ensemble clustering and classification for predicting android malware families","volume":"17","author":"Chakraborty","year":"2020","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"issue":"3","key":"10.7717\/peerj-cs.2616\/ref-12","doi-asserted-by":"publisher","first-page":"273","DOI":"10.1007\/BF00994018","article-title":"Support-vector networks","volume":"20","author":"Cortes","year":"1995","journal-title":"Machine Learning"},{"issue":"2","key":"10.7717\/peerj-cs.2616\/ref-13","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3503463","article-title":"A deep dive inside drebin: an explorative analysis beyond android malware detection scores","volume":"25","author":"Daoudi","year":"2022","journal-title":"ACM Transactions on Privacy and Security"},{"issue":"4","key":"10.7717\/peerj-cs.2616\/ref-14","doi-asserted-by":"publisher","first-page":"711","DOI":"10.1109\/TDSC.2017.2700270","article-title":"Yes, machine learning can be more secure! a case study on android malware detection","volume":"16","author":"Demontis","year":"2019","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"issue":"5","key":"10.7717\/peerj-cs.2616\/ref-15","doi-asserted-by":"publisher","first-page":"7744","DOI":"10.1109\/TII.2024.3363016","article-title":"Android malware detection method based on CNN and DNN bybrid mechanism","volume":"20","author":"Dong","year":"2024","journal-title":"IEEE Transactions on Industrial Informatics"},{"key":"10.7717\/peerj-cs.2616\/ref-16","doi-asserted-by":"crossref","DOI":"10.7551\/mitpress\/1290.001.0001","volume-title":"Ant colony optimization","author":"Dorigo","year":"2004"},{"issue":"3","key":"10.7717\/peerj-cs.2616\/ref-17","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3162625","article-title":"Lightweight, obfuscation-resilient detection and family identification of android malware","volume":"26","author":"Garcia","year":"2018","journal-title":"ACM Transactions on Software Engineering and Methodology"},{"key":"10.7717\/peerj-cs.2616\/ref-18","article-title":"Google Play Protect","author":"Google","year":"2024"},{"issue":"1\u20133","key":"10.7717\/peerj-cs.2616\/ref-19","doi-asserted-by":"publisher","first-page":"389","DOI":"10.1023\/A:1012487302797","article-title":"Gene selection for cancer classification using support vector machines","volume":"46","author":"Guyon","year":"2002","journal-title":"Machine Learning"},{"issue":"1","key":"10.7717\/peerj-cs.2616\/ref-20","doi-asserted-by":"publisher","first-page":"55","DOI":"10.1080\/00401706.1970.10488634","article-title":"Ridge regression: biased estimation for nonorthogonal problems","volume":"12","author":"Hoerl","year":"1970","journal-title":"Technometrics"},{"key":"10.7717\/peerj-cs.2616\/ref-21","article-title":"State of cybersecurity 2019. part 2: current trends in attacks, awareness and governance","author":"ISACA","year":"2019"},{"key":"10.7717\/peerj-cs.2616\/ref-22","doi-asserted-by":"crossref","first-page":"242","DOI":"10.1007\/978-3-030-63095-9_14","article-title":"Aomdroid: detecting obfuscation variants of android malware using transfer learning","volume-title":"Security and Privacy in Communication Networks","author":"Jiang","year":"2020"},{"key":"10.7717\/peerj-cs.2616\/ref-23","first-page":"1","article-title":"Advancing android security: leveraging stacking ensemble and bioinspired feature selection for efficient malware detection","author":"Jyothsna","year":"2024"},{"key":"10.7717\/peerj-cs.2616\/ref-24","article-title":"Self-organizing maps","volume-title":"Springer Series in Information Sciences","author":"Kohonen","year":"2001","edition":"3"},{"key":"10.7717\/peerj-cs.2616\/ref-25","article-title":"Develop Android apps with Kotlin","author":"Kotlin","year":"2024"},{"issue":"5","key":"10.7717\/peerj-cs.2616\/ref-26","doi-asserted-by":"publisher","first-page":"3357","DOI":"10.1109\/TDSC.2021.3094824","article-title":"Backdoor attack on machine learning based android malware detectors","volume":"19","author":"Li","year":"2022","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"key":"10.7717\/peerj-cs.2616\/ref-27","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2958927","article-title":"Android malware detection based on factorization machine","volume":"7","author":"Li","year":"2019","journal-title":"IEEE Access"},{"key":"10.7717\/peerj-cs.2616\/ref-28","article-title":"The Drebin Dataset","author":"Machine Learning and Security","year":"2024"},{"issue":"10","key":"10.7717\/peerj-cs.2616\/ref-29","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/s00521-020-05309-4","article-title":"Mldroid\u2014framework for android malware detection using machine learning techniques","volume":"33","author":"Mahindru","year":"2021a","journal-title":"Neural Computing and Applications"},{"issue":"8","key":"10.7717\/peerj-cs.2616\/ref-30","doi-asserted-by":"publisher","first-page":"8209","DOI":"10.1007\/s11227-020-03569-4","article-title":"Hybridroid: an empirical analysis on effective malware detection model developed using ensemble methods","volume":"77","author":"Mahindru","year":"2021b","journal-title":"The Journal of Supercomputing"},{"key":"10.7717\/peerj-cs.2616\/ref-31","doi-asserted-by":"publisher","first-page":"46","DOI":"10.1016\/j.advengsoft.2013.12.007","article-title":"Grey wolf optimizer","volume":"69","author":"Mirjalili","year":"2014","journal-title":"Advances in Engineering Software"},{"issue":"5","key":"10.7717\/peerj-cs.2616\/ref-32","doi-asserted-by":"publisher","first-page":"80","DOI":"10.1016\/j.jisa.2018.11.007","article-title":"Cyber intrusion detection by combined feature selection algorithm","volume":"44","author":"Mohammadi","year":"2019","journal-title":"Journal of Information Security and Applications"},{"issue":"3","key":"10.7717\/peerj-cs.2616\/ref-33","doi-asserted-by":"publisher","first-page":"157","DOI":"10.1109\/TETCI.2017.2699220","article-title":"Context-aware, adaptive, and scalable android malware detection through online learning","volume":"1","author":"Narayanan","year":"2017","journal-title":"IEEE Transactions on Emerging Topics in Computational Intelligence"},{"issue":"151","key":"10.7717\/peerj-cs.2616\/ref-34","doi-asserted-by":"publisher","first-page":"773","DOI":"10.1090\/S0025-5718-1980-0572855-7","article-title":"Updating quasi-newton matrices with limited storage","volume":"35","author":"Nocedal","year":"1980","journal-title":"Mathematics of Computation"},{"key":"10.7717\/peerj-cs.2616\/ref-35","first-page":"2825","article-title":"Scikit-learn: machine learning in python","volume":"12","author":"Pedregosa","year":"2011","journal-title":"Journal of Machine Learning Research"},{"key":"10.7717\/peerj-cs.2616\/ref-36","first-page":"383","article-title":"A comparative study of java and kotlin for android mobile application development","author":"Putranto","year":"2020"},{"issue":"2","key":"10.7717\/peerj-cs.2616\/ref-37","doi-asserted-by":"publisher","first-page":"339","DOI":"10.1109\/21.52545","article-title":"Decision trees and decision-making","volume":"20","author":"Quinlan","year":"1990","journal-title":"IEEE Transactions on Systems, Man, and Cybernetics"},{"key":"10.7717\/peerj-cs.2616\/ref-38","article-title":"Google launches the App Defense Alliance to protect Android from malware","author":"Ranchal","year":"2019","journal-title":"MuySeguridad"},{"key":"10.7717\/peerj-cs.2616\/ref-39","volume-title":"Learning with kernels: support vector machines, regularization, optimization, and beyond","author":"Scholkopf","year":"2018"},{"key":"10.7717\/peerj-cs.2616\/ref-40","article-title":"Mobile malware evolution 2021. Securelist by Karsperky","author":"Shishkova","year":"2022"},{"key":"10.7717\/peerj-cs.2616\/ref-41","doi-asserted-by":"crossref","DOI":"10.1145\/2480362.2480701","article-title":"Mobile-sandbox: having a deeper look into android applications","author":"Spreitzenbarth","year":"2013"},{"key":"10.7717\/peerj-cs.2616\/ref-42","article-title":"Statcounter global stats","author":"Statcounter","year":"2024"},{"key":"10.7717\/peerj-cs.2616\/ref-43","first-page":"309","article-title":"Droidsieve: fast and accurate classification of obfuscated android malware","author":"Suarez-Tangil","year":"2017"},{"key":"10.7717\/peerj-cs.2616\/ref-44","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3387475","article-title":"Android malware detection based on informative syscall subsequences","author":"Surendran","year":"2024","journal-title":"IEEE Access"},{"issue":"1","key":"10.7717\/peerj-cs.2616\/ref-45","doi-asserted-by":"publisher","first-page":"267","DOI":"10.1111\/j.2517-6161.1996.tb02080.x","article-title":"Regression shrinkage and selection via the lasso","volume":"58","author":"Tibshirani","year":"1996","journal-title":"Journal of the Royal Statistical Society: Series B (Methodological)"},{"issue":"11","key":"10.7717\/peerj-cs.2616\/ref-46","first-page":"2579","article-title":"Visualizing data using t-sne","volume":"9","author":"Van der Maaten","year":"2008","journal-title":"Journal of Machine Learning Research"},{"issue":"66\u201371","key":"10.7717\/peerj-cs.2616\/ref-47","first-page":"13","article-title":"Dimensionality reduction: a comparative","volume":"10","author":"Van Der Maaten","year":"2009","journal-title":"Journal of Machine Learning Research"},{"key":"10.7717\/peerj-cs.2616\/ref-48","first-page":"1","article-title":"SecuDroid: android malware detection using ML classifier on static features","author":"Vanusha","year":"2024"},{"key":"10.7717\/peerj-cs.2616\/ref-49","article-title":"SafetyNet","author":"Xatakandroid","year":"2024"},{"issue":"1","key":"10.7717\/peerj-cs.2616\/ref-50","doi-asserted-by":"publisher","first-page":"163","DOI":"10.23919\/JSEE.2024.000018","article-title":"DCEL: classifier fusion model for android malware detection","volume":"35","author":"Xu","year":"2024","journal-title":"Journal of Systems Engineering and Electronics"},{"key":"10.7717\/peerj-cs.2616\/ref-51","article-title":"Android malware dataset for machine learning 2","author":"Yerima","year":"2018"},{"issue":"2","key":"10.7717\/peerj-cs.2616\/ref-52","doi-asserted-by":"publisher","first-page":"453","DOI":"10.1109\/TCYB.2017.2777960","article-title":"DroidFusion: a novel multilevel classifier fusion approach for android malware detection","volume":"49","author":"Yerima","year":"2019","journal-title":"IEEE Transactions on Cybernetics"},{"key":"10.7717\/peerj-cs.2616\/ref-53","article-title":"The optimality of naive bayes","volume-title":"Proceedings of the Seventeenth International Florida Artificial Intelligence Research Society Conference (FLAIRS 2004)","author":"Zhang","year":"2004"}],"container-title":["PeerJ Computer Science"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/peerj.com\/articles\/cs-2616.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/peerj.com\/articles\/cs-2616.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/peerj.com\/articles\/cs-2616.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/peerj.com\/articles\/cs-2616.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,12,23]],"date-time":"2024-12-23T10:00:05Z","timestamp":1734948005000},"score":1,"resource":{"primary":{"URL":"https:\/\/peerj.com\/articles\/cs-2616"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,23]]},"references-count":53,"alternative-id":["10.7717\/peerj-cs.2616"],"URL":"https:\/\/doi.org\/10.7717\/peerj-cs.2616","archive":["CLOCKSS","LOCKSS","Portico"],"relation":{},"ISSN":["2376-5992"],"issn-type":[{"value":"2376-5992","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,12,23]]},"article-number":"e2616"}}