用混合特征+梯度提升模型，实现高精度安卓恶意软件检测。
Comparison of Multiple Classifiers for Android Malware Detection with Emphasis on Feature Insights Using CICMalDroid 2020 Dataset
- 结合静态与动态特征构建564维混合向量，用梯度提升分类器建模。
- XGBoost在原始特征上达97.47%准确率，误判极少且可解释性好。
- 适合安全研究者与移动设备防护系统开发者参考部署。
准确的安卓恶意软件检测对大规模用户保护至关重要。传统签名扫描难以跟上应用商店快速发布节奏。本文通过结合全面的数据集与严谨透明的评估，构建可信检测器，并揭示决策的关键驱动因素。使用CICMalDroid2020数据集，包含17,341个应用（良性、广告软件、银行木马、短信木马、风险软件）。提取301个静态特征与263个动态特征，形成564维混合向量，评估七种分类器在三种方案下的表现：原始特征、主成分分析（PCA）、线性判别分析（LDA），训练/测试比例为70%/30%。结果表明，基于原始特征的梯度提升表现最佳：XGBoost达到0.9747准确率、0.9703精确率、0.9731召回率、0.9716 F1，混淆矩阵显示恶意应用被误判为良性的情况极少见。HistGradientBoosting获0.9741准确率和0.9708 F1；CatBoost与随机森林分别达0.9678与0.9687准确率，F1为0.9636与0.9637；KNN与SVM性能较差。PCA导致所有模型性能下降，其中XGBoost降至0.9164准确率与0.8988 F1；LDA保持中等90%级准确率，并在投影中清晰展现可分簇。深度为两层的代理树揭示包名、主活动、目标SDK是关键决策因素。研究确立了高保真监督基线，表明丰富混合特征配合梯度提升可为实际部署提供高效且可解释的解决方案。
原文摘要 · Abstract (English)
Accurate Android malware detection was critical for protecting users at scale. Signature scanners lagged behind fast release cycles on public app stores. We aimed to build a trustworthy detector by pairing a comprehensive dataset with a rigorous, transparent evaluation, and to identify interpretable drivers of decisions. We used CICMalDroid2020, which contained 17,341 apps across Benign, Adware, Banking, SMS malware, and Riskware. We extracted 301 static and 263 dynamic features into a 564 dimensional hybrid vector, then evaluated seven classifiers under three schemes, original features, principal component analysis, PCA, and linear discriminant analysis, LDA, with a 70 percent training and 30 percent test split. Results showed that gradient boosting on the original features performed best. XGBoost achieved 0.9747 accuracy, 0.9703 precision, 0.9731 recall, and 0.9716 F1, and the confusion matrix indicated rare benign labels for malicious apps. HistGradientBoosting reached 0.9741 accuracy and 0.9708 F1, while CatBoost and Random Forest were slightly lower at 0.9678 and 0.9687 accuracy with 0.9636 and 0.9637 F1. KNN and SVM lagged. PCA reduced performance for all models, with XGBoost dropping to 0.9164 accuracy and 0.8988 F1. LDA maintained mid 90s accuracy and clarified separable clusters in projections. A depth two surrogate tree highlighted package name, main activity, and target SDK as key drivers. These findings established high fidelity supervised baselines for Android malware detection and indicated that rich hybrid features with gradient boosting offered a practical and interpretable foundation for deployment.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。