HFS-SVE: A Hybrid Feature Selection and Soft Voting Ensemble for Android Malware Detection

Abstract

Android malware continues to evolve in complexity, creating challenges for detection systems that must distinguish malicious applications from increasingly heterogeneous benign applications. Although machine learning provides effective mechanisms for learning malware characteristics, the high dimensionality of Android malware datasets can introduce redundant and weakly informative features and increase computational requirements. To address this problem, this paper proposes a Hybrid Feature Selection and Soft-Voting Ensemble (HFS-SVE) framework that integrates complementary feature-selection and ensemble-learning strategies. The proposed framework sequentially applies Random Forest (RF) feature importance, Chi-square-based SelectKBest, correlation filtering, and L1 regularisation, reducing the original 489-feature representation to 13 selected features. These features are subsequently classified using RF, XGBoost, and LightGBM, whose probability outputs are combined through soft voting. Experimental results on the KronoDroid dataset demonstrate that the proposed HFS-SVE achieves 99.41% accuracy, 99.52% precision, 99.30% recall, 99.40% F1-score, and 99.41% ROC-AUC. The proposed framework also records the lowest measured detection time among the evaluated feature-selection strategies. Cross-dataset evaluation on Malgenome, TUANDROMD, and Drebin achieves accuracy above 98% on each dataset. The findings demonstrate that the proposed HFS-SVE can combine substantial feature-space reduction with strong Android malware detection performance, while the cross-dataset results highlight the importance of dataset variation and feature provenance when assessing generalisation.

1. Introduction

Mobile phones have evolved from communication devices into highly capable computing platforms that support financial transactions, healthcare services, enterprise activities, authentication, social interaction, and the storage of increasingly sensitive personal information. Among mobile operating systems, Android remains the dominant platform, accounting for approximately 72% of the global mobile operating-system market in 2026 [1]. Its broad adoption is supported by its open ecosystem, extensive application availability, hardware diversity, and accessibility across a wide range of devices. However, the scale and openness of the Android ecosystem also create a substantial attack surface in which malicious applications can be distributed and executed across heterogeneous devices and environments [2]. Hence, the security of Android applications has become an important component of contemporary mobile and cyber security research.

Android malware represents a persistent and evolving threat because malicious applications can abuse application permissions, system services, communication mechanisms, sensitive data, and device resources to conduct activities such as information theft, financial fraud, surveillance, privilege abuse, and unauthorised access [2]. The evolution of Android malware has also resulted in increasingly sophisticated behaviours and evasion mechanisms, making reliable identification more challenging for conventional detection techniques [3]. Malware creators can modify application characteristics, employ obfuscation, exploit legitimate Android functionality, and introduce new variants that may not match previously observed signatures. These challenges have motivated a transition from predominantly signature- and rule-based detection towards Machine Learning (ML) approaches capable of learning discriminative patterns from application characteristics [4]. ML-based malware detection can exploit static, dynamic, or hybrid evidence and has consequently become an established direction for Android malware analysis [5,6].

Despite this progress, an important methodological problem remains. Android malware datasets can contain hundreds of heterogeneous features derived from application structure, permissions, metadata, system calls, and runtime behaviour [7]. Although a large feature space may contain useful discriminative information, it can introduce irrelevant and redundant attributes, increase computational requirements, complicate model interpretation, and potentially reduce the efficiency and robustness of subsequent classification [8]. Therefore, feature selection is critical for determining whether malware can be accurately detected using a substantially smaller, more informative representation. Existing research has demonstrated the effectiveness of individual feature-selection mechanisms, dimensionality-reduction approaches, and ML classifiers, while broader studies have established the increasing role of ML in malware detection [9,10]. However, the use of a single selection criterion does not necessarily address the different characteristics of a heterogeneous feature space: predictive importance, statistical relevance, redundancy, and sparsity represent distinct selection objectives. Similarly, employing a single classifier may not fully exploit complementary decision boundaries present in heterogeneous malware data. The research problem addressed in this paper is how to systematically reduce a high-dimensional Android malware feature space while preserving discriminative information and, at the same time, exploit complementary classification models to obtain accurate and computationally efficient detection.

To address this problem, this paper proposes a Hybrid Feature Selection and Soft-Voting Ensemble (HFS-SVE) framework that combines hybridisation at both feature-selection and classification levels. The proposed HFS-SVE first applies four complementary feature-selection mechanisms sequentially to the original Android malware representation. Random Forest (RF) feature importance performs an initial model-based screening of potentially informative attributes, SelectKBest using the Chi-square criterion subsequently identifies features with strong statistical association with the target, correlation-based filtering removes highly redundant variables, and L1-regularised logistic regression provides a final sparse selection stage. Rather than treating these techniques as independent alternatives, HFS-SVE uses them as successive decision stages, with each stage addressing a distinct characteristic of high-dimensional malware representations. This creates a progressively refined representation in which predictive importance, statistical relevance, redundancy, and sparsity are considered jointly. This progressive process reduces the reported 489-feature representation to a compact set of 13 features. The resulting representation is then supplied to three heterogeneous tree-based classifiers whose probability outputs are combined through soft voting. This two-level hybridisation is intended to jointly address representation complexity and classifier dependence: the feature-selection stages reduce unnecessary and overlapping information before classification, while probability-level ensemble learning combines complementary classifier outputs rather than relying on a single decision function.

The resulting HFS-SVE framework is evaluated systematically on KronoDroid as the principal dataset and subsequently examined across Malgenome, TUANDROMD, and Drebin. The evaluation is designed to establish whether the proposed architecture provides value beyond the use of its individual established components, including through analysis of the contribution of the feature-selection stages and the consistency of the resulting representation across datasets. This paper does not define contribution solely by achieving the highest classification score; rather, it investigates whether substantial dimensionality reduction can be achieved while maintaining strong detection performance and whether the resulting compact representation remains effective across different dataset conditions. Accordingly, the key contribution is the empirical validation of a compact, multi-stage feature-selection and heterogeneous soft-voting architecture for Android malware detection, rather than the introduction of another standalone feature-selection or classification algorithm.

The main contributions of this paper can be summarised as follows:

• Proposing a hybrid feature-selection framework that sequentially integrates RF importance, Chi-square-based SelectKBest, correlation filtering, and L1 regularisation to identify relevant and non-redundant malware features.
• Developing a compact HFS-SVE detection framework that reduces the reported 489-feature representation to 13 features and combines RF, XGBoost, and LightGBM through soft voting for accurate malware classification.
• Evaluating the proposed HFS-SVE comprehensively through classification performance, feature-selection comparisons, computational-efficiency analysis, and benchmarking against conventional classifiers across four Android malware datasets.
• Demonstrating the effectiveness and boundaries of compact malware detection, showing that strong classification performance can be maintained with substantial feature reduction while revealing the effects of dataset variation and feature provenance on generalisation.

The remainder of this paper is organised as follows. Section 2 reviews the existing literature and discusses related work in Android malware detection. Section 3 presents the proposed HFS-SVE detection framework. Section 4 describes the datasets, data preparation, experimental configuration, evaluation metrics, and experimental design. Section 5 presents and analyses the experimental results. Section 6 discusses the overall findings, contribution, limitations, and directions for future research. Finally, Section 7 concludes the paper.

2. Related Work

Android malware detection has evolved from signature-based and manually engineered techniques toward ML and Deep Learning (DL) approaches capable of learning discriminative patterns from static, dynamic, and hybrid application characteristics. This evolution has improved detection capability but has also increased the dimensionality and complexity of malware representations, creating challenges related to computational efficiency, redundant information, model interpretability, and generalisation to evolving malware. This section reviews existing research and discusses related work in Android malware detection.

2.1. Static, Dynamic, and Hybrid Detection

Static analysis remains one of the most widely adopted approaches to Android malware detection because application characteristics can be extracted without executing the application. Existing studies have exploited permissions, API calls, intents, opcodes, application metadata, and structural characteristics as inputs to ML classifiers. The seminal DREBIN approach demonstrated the effectiveness of combining multiple static feature types for lightweight Android malware detection [11], while DroidMat investigated static application characteristics for malware classification [12]. Pan et al. [13] further reviewed static-analysis-based Android malware detection and highlighted the extensive use of application-level characteristics and ML techniques. The key advantage of static analysis is scalability since features can be extracted without the execution, instrumentation, and environmental requirements associated with dynamic analysis. However, static approaches can be weakened by obfuscation, encryption, dynamic code loading, native code, and other mechanisms designed to conceal malicious functionality. For example, Ouk and Pak [14] investigated static analysis in the presence of obfuscated and native Android malware, demonstrating the continuing difficulty of obtaining reliable discriminative characteristics from applications designed to resist conventional analysis.

Dynamic analysis addresses some of these limitations by observing application behaviour during execution. Instead of relying exclusively on properties embedded within the application package, dynamic approaches can capture runtime system calls, API activity, network behaviour, and execution traces. Andromaly investigated anomaly-based malware detection using behavioural information [15], while Chaba et al. [16] examined system-call logs for identifying malicious Android applications. Feng et al. [17] proposed EnDroid, combining dynamic analysis with ensemble learning. So, dynamic analysis can expose behavioural characteristics that may remain unavailable through static inspection. However, it introduces additional execution, instrumentation, and resource requirements, while the observed behaviour may depend strongly on the execution environment and whether malicious functionality is triggered. Guerra-Manzanares et al. [18] demonstrated that characteristics collected from emulated and real-device environments can differ substantially, highlighting the importance of considering the collection environment when evaluating malware detectors.

Hybrid analysis seeks to exploit the complementary information available from static and dynamic analysis. Tong and Yan [19] reported improvements from combining static and dynamic characteristics, while Arshad et al. [20] developed SAMADroid by integrating static analysis, dynamic analysis, and ML. Yuan et al. [21] similarly investigated deep learning using hybrid features. Dhalaria and Gandotra [22] combined static and dynamic characteristics with Chi-Square-based feature selection and multiple classifiers, showing high detection accuracy for their K-NN–RF approach. These studies demonstrate the value of combining heterogeneous sources of application information. However, increasing the number of feature sources also increases the candidate feature space and may introduce redundant, correlated, or weakly informative variables. Therefore, the challenge is not simply to incorporate more evidence but to identify a compact set of features that provides complementary and discriminative information without unnecessarily increasing computational and modelling complexity.

2.2. Deep Learning and Representation-Based Detection

The limitations associated with manually engineered representations have encouraged the adoption of DL methods capable of learning complex representations from Android application characteristics. Recent studies have investigated recurrent, graph-based, Transformer-based, and hybrid architectures. Almakayeel [23] and Shakib [24] investigated Transformer-based approaches using static Android features, reflecting the increasing use of attention mechanisms to model relationships among application characteristics. Kauser and Anu [25] proposed a DBN–GRU architecture combining a Deep Belief Network for representation learning with a Gated Recurrent Unit for sequential behavioural modelling and showed high accuracy on the Drebin dataset. Graph-based approaches provide another means of modelling structural relationships within applications. Tanveer et al. [26] proposed GIT-GuardNet, integrating static-code representations, graph information, and behavioural sequences through Transformer- and graph-based components.

These studies demonstrate that sophisticated representation learning can achieve very high classification performance. However, high predictive performance alone does not establish that increasing representational complexity is always the most appropriate solution. DL architectures may require substantial computational resources, large training datasets, complex optimisation procedures, and representations that are more difficult to interpret or reproduce. Moreover, their use does not inherently address the problem of redundant or weakly informative input characteristics.

2.3. Feature Selection for Android Malware Detection

Feature selection is particularly important in Android malware detection because application datasets can contain hundreds or thousands of candidate characteristics, including permissions, intents, API calls, opcodes, behavioural events, and application metadata. These characteristics may contain redundant, correlated, or weakly informative information. Retaining the complete feature space can increase computational requirements, complicate model interpretation, and potentially make learning more susceptible to irrelevant variation. Abawajy et al. [27] investigated the role of feature selection in Android malware detection and demonstrated the importance of evaluating feature-subset-selection techniques rather than assuming that all available characteristics contribute equally to classification.

Recent studies have explored hybrid and multi-criterion feature-selection strategies. Sharma et al. [28] proposed a Multi-Wrapper Hybrid Feature Selection Technique (MWHFST), combining filter and wrapper approaches. Using the KronoDroid dataset, the method reduced 489 candidate features to 31 while achieving good detection accuracy. This result is particularly relevant becausehany it demonstrates that substantial dimensionality reduction can be achieved without necessarily sacrificing detection capability. Connolly and Atlam [29] proposed an ensemble learning approach using hybrid feature selection, where different feature subsets were selected for individual base learners and their predictions were subsequently combined to improve phishing detection. This work further demonstrates the value of combining complementary feature-selection strategies rather than relying on a single selection mechanism Jain et al. [30] proposed EnFeSTDroid, combining multiple ranking techniques, including Information Gain, Extra Trees, Chi-Square, TF, IDF, and TF–IDF, to identify important permissions and intents. The approach achieved 96.27% classification accuracy and demonstrates the potential value of using complementary criteria rather than relying on a single feature-ranking mechanism.

Other studies have investigated optimisation-based selection. Almakayeel [19] applied Binary Grey Wolf Optimisation to identify static features before Transformer-based classification and achieved high accuracy. Arslan et al. [31] applied a hybrid selection process to Dalvik and Java opcode sequences, reducing the representation to 461 representative features. Collectively, these studies establish that feature selection can substantially reduce Android malware feature spaces. However, they employ substantially different definitions of feature relevance. Statistical filters assess individual feature–class associations, model-based approaches capture predictive importance, optimisation methods search feature subsets, and hybrid methods combine multiple ranking or selection mechanisms. Hence, an unresolved question is whether these complementary notions of relevance, redundancy, and sparsity can be integrated sequentially to obtain a substantially smaller representation while preserving classification performance.

2.4. Ensemble Learning for Malware Detection

Ensemble learning provides a complementary strategy by combining the predictive capabilities of multiple classifiers. Its underlying motivation is that different models may capture different decision boundaries, feature interactions, or patterns within the same representation. Arslan et al. [31] proposed JDroid, a stacked ensemble that processes opcode-sequence features and combines classifier outputs using a meta-classifier. Similarly, Dhalaria and Gandotra [22] demonstrated the potential of combining feature selection with multiple classifiers through their K-NN–RF approach. Bashir et al. [32] investigated ensemble classification using static and dynamic characteristics, including permissions, API calls, and intents, with classifiers such as SVM, k-NN, and Naïve Bayes. Other recent approaches have incorporated ensemble principles within DL architectures; for example, GIT-GuardNet [22] combines multiple representation mechanisms covering static code, graph structure, and behavioural sequences.

These studies indicate that combining classifiers or representations can improve malware classification. However, ensemble learning does not inherently address the quality or dimensionality of the feature space supplied to the constituent models. An ensemble trained using a highly redundant representation may improve predictive performance while retaining unnecessary computational and representational complexity. Moreover, the benefit of an ensemble depends on the complementarity of its constituent models rather than simply their number. This suggests that feature selection and ensemble classification should be considered jointly: the feature-selection process should provide a compact and informative representation, while the ensemble should exploit complementary predictive behaviour among its constituent classifiers.

Recent studies further demonstrate the growing importance of feature reduction and ensemble learning in Android malware detection. Polatidis et al. [33] proposed FSSDroid, a feature-subset-selection methodology that substantially reduced Android malware representations while maintaining detection performance, including reduction of a 489-feature representation to between 19 and 28 features. Other recent work has investigated feature-importance-based reduction, demonstrating that substantial reductions in Android permission features can be achieved while preserving classification performance and reducing computational requirements [34]. PermDroid [35] further combines multi-stage feature selection with ensemble and neural-network classifiers, highlighting the potential of jointly optimising feature representation and classification. Recent research has also increasingly explored ensemble-based Android malware detection. Fuzzy rank-based fusion approaches have combined multiple classifiers, including KNN, SVM, Logistic Regression, XGBoost, and LightGBM, to improve robustness across Android malware datasets [36]. E3Droid similarly integrates multiple feature-selection criteria, including Relief, Chi-square, and mRMR, with an ensemble classifier based on SVM, KNN, and Naïve Bayes [37]. These studies confirm the value of combining complementary feature-selection and classification mechanisms. However, they generally differ from HFS-SVE in the selection criteria, sequencing strategy, classifier composition, and fusion mechanism.

2.5. Critical Synthesis and Research Gap

The reviewed literature demonstrates substantial progress in Android malware detection, but several methodological issues remain unresolved. First, advances in model sophistication have not eliminated the underlying feature-selection problem. Static and dynamic approaches provide complementary evidence, while DL models can learn increasingly complex representations; however, larger and more complex representations do not necessarily provide the most efficient or interpretable detection solution. Conventional ML approaches remain attractive because of their comparatively lower computational and deployment requirements, but their effectiveness can be affected by redundant and high-dimensional feature spaces. Second, feature selection and ensemble classification have largely been investigated as related but distinguishable design problems. MWHFST [28] demonstrates the value of combining feature-selection mechanisms, while EnFeSTDroid [30] shows that multiple feature-ranking criteria can identify complementary characteristics. JDroid [31] and other ensemble approaches [22,32] demonstrate the potential of combining classifiers. However, the reviewed literature provides limited evidence on the specific interaction between multi-stage feature selection and heterogeneous tree-based ensemble classification, particularly where feature selection addresses different properties of the feature space: predictive importance, statistical relevance, redundancy, and sparsity.

Third, reported benchmark accuracy does not by itself establish practical effectiveness or robustness. Results demonstrate strong classification capability on the evaluated datasets, but accuracy alone does not establish resilience to temporal drift, unseen malware families, changing execution environments, or feature-distribution changes. Guerra-Manzanares et al. [18] demonstrate the importance of environmental factors by showing differences between emulated and real-device observations. So, evaluations should consider not only classification performance but also the relationship between feature representation, computational cost, and the conditions under which the detector is evaluated. Fourth, although several studies demonstrate substantial feature reduction, the relationship between the number and composition of retained features, predictive performance, and computational efficiency is not consistently evaluated under a common experimental protocol. Sharma et al. [28], for example, reduced the KronoDroid representation from 489 to 31 features while maintaining high reported accuracy. Such findings suggest that a relatively small subset of application characteristics may contain much of the discriminative information required for malware classification.

Based on these observations, the research gap addressed in this paper is not the invention of a new individual feature-selection or classification algorithm. Rather, it concerns the systematic integration and evaluation of complementary feature-selection mechanisms with heterogeneous ensemble classification. Specifically, the reviewed literature provides limited evidence on whether model-based importance, statistical relevance, redundancy filtering, and sparse regularisation can be applied sequentially to reduce a high-dimensional Android malware representation to a compact discriminative subset and subsequently support a heterogeneous soft-voting ensemble. To address this gap, this paper proposes the HFS-SVE framework combining four sequential feature-selection mechanisms. The paper mainly investigates whether complementary definitions of feature relevance and redundancy can produce a substantially more compact representation while retaining strong malware-detection capability and whether heterogeneous tree-based ensemble learning can exploit that compact representation effectively.

3. Proposed Hybrid Feature Selection and Soft-Voting Ensemble (HFS-SVE)

Android malware detection is challenging because malicious applications can exhibit highly diverse behaviours, while benign and malicious applications may share many common characteristics. When static and dynamic characteristics are combined, the resulting representation can contain many potentially informative attributes together with irrelevant, weakly discriminative, or highly redundant features. Such a representation can increase computational cost and may make the learning process more susceptible to noise and overfitting. Hence, feature selection is an important component of ML-based malware detection, particularly when the original representation contains heterogeneous and potentially correlated attributes [23]. A second challenge concerns the classification stage. Different ML algorithms learn decision boundaries in different ways and consequently may capture different aspects of the underlying data distribution. An individual classifier may perform well on some malware characteristics while being less effective on others. Ensemble learning provides a mechanism for combining complementary predictive models rather than relying on a single learning strategy. Previous Android malware research has also demonstrated the usefulness of combining feature selection with ensemble classification [28].

To address these two challenges, this paper proposes the HFS-SVE framework for Android malware detection. The key idea is to perform hybridisation at two complementary levels. First, the feature space is progressively refined using four feature-selection mechanisms that address different properties of the representation: model-based relevance, statistical relevance, feature redundancy, and sparse joint contribution. Second, the resulting compact representation is supplied to three heterogeneous tree-based classifiers, namely RF, XGBoost, and LightGBM. Their probability outputs are subsequently integrated through soft voting. The proposed framework provides a structured integration and sequencing of complementary feature-selection criteria with heterogeneous ensemble learners. This design is intended to ensure that the feature space is progressively refined before classification, while the final prediction benefits from different tree-learning mechanisms.

The overall architecture of the proposed HFS-SVE framework is shown in Figure 1. The framework begins with the combined static and dynamic Android representation. The feature space then passes sequentially through RF-based feature screening, Chi-Square-based SelectKBest filtering, correlation-based redundancy reduction, and L1-regularised logistic regression. The output of this process is a compact feature representation that is provided identically to RF, XGBoost, and LightGBM. Finally, the class-probability estimates generated by these classifiers are combined using a soft-voting mechanism to produce the final malware or benign prediction.

The proposed HFS-SVE framework transforms the initial combined static–dynamic feature space into a final prediction through a four-stage sequential refinement process before submitting the reduced subset to the ensemble classifiers. Rather than treating feature selection techniques as interchangeable alternatives, the framework enforces a strict ordering where each stage resolves residual limitations from the previous step. The process initiates with RF screening to capture model-based nonlinear relevance, followed by Chi-Square filtering to isolate statistical associations with target malware classes. Pearson correlation analysis is then applied to eliminate collinear and redundant features among the remaining candidates. Finally, L1-regularised logistic regression performs sparse refinement, isolating features that demonstrate strong joint predictive capacity. This progressive shift aligns with established research emphasising the critical role of optimised feature subsets in Android malware detection [38], the efficacy of Chi-Square filtering in mobile threat classification [28], and the utility of L1 regularisation for sparse representation learning [39,40].

An important methodological principle of the proposed framework is that feature selection is learned from the training data and then applied to unseen data. Therefore, the feature-ranking models, statistical selection, correlation filtering, and L1 regularisation must not use information from the held-out evaluation samples. This prevents information leakage from the evaluation data into the feature-selection process and ensures that the performance reflects the ability of the complete framework to generalise to previously unseen applications. This distinction is particularly important in ML-based Android malware research, where reproducibility and rigorous experimental design have been identified as important methodological considerations [38].

It is worth noting that the contribution of the proposed HFS-SVE is not the introduction of a new individual feature-selection or classification algorithm. Rather, its methodological contribution lies in designing and empirically evaluating a structured, multi-stage detection pipeline in which complementary feature-selection criteria interact sequentially to address different forms of redundancy, irrelevance, and sparsity in Android malware representations. In contrast to existing hybrid feature-selection approaches such as MWHFST [28], which reduced the KronoDroid representation to 31 features, HFS-SVE progressively applies model-based predictive screening, statistical relevance assessment, redundancy reduction, and sparse regularisation, with each stage operating on the representation produced by the preceding stage. This design seeks to ensure that the final representation is not only predictive but also statistically discriminative, minimally redundant, and compact. The resulting representation is subsequently supplied to RF, XGBoost, and LightGBM through probability-level soft voting. Thus, HFS-SVE addresses two complementary challenges simultaneously: reducing the complexity of a high-dimensional Android malware feature space and reducing dependence on the decision behaviour of any single classifier.

The methodological contribution lies in the interaction and complementary roles of the four selection stages where RF identifies features with predictive importance, Chi-Square filtering evaluates statistical relevance, correlation analysis removes redundant information, and L1 regularisation imposes a sparse final representation. This sequential design provides a more controlled feature-reduction mechanism than relying on a single selection criterion, while the subsequent soft-voting stage exploits the complementary decision behaviour of heterogeneous learners. The proposed framework is therefore evaluated not simply according to classification accuracy, but according to whether this combined design can achieve substantial dimensionality reduction while retaining strong detection performance and maintaining effectiveness across different Android malware datasets. The contribution is further examined through component-level evaluation and cross-dataset analysis to determine whether the observed performance is attributable to the complete HFS-SVE design rather than to an individual classifier or selection method.

The remainder of this section describes each stage of the proposed framework and explains the rationale for its position within the overall structure.

3.1. Hybrid Feature Selection

The first component of the proposed framework is the hybrid feature-selection pipeline. Its purpose is to transform the initial static–dynamic feature representation into a compact set of discriminative features before classification. Let the initial feature representation be denoted by F₀. The proposed feature-selection process progressively transforms this representation into a smaller subset F₄:

F₀ → F₁ → F₂ → F₃ → F₄

(1)

where F₁, F₂, F₃, and F₄ represent the feature spaces obtained after RF screening, Chi-Square selection, correlation filtering, and L1-based refinement, respectively.

The rationale for this sequential design is that relevance and feature redundancy are different properties. A feature can be individually predictive of the target while providing information that is largely duplicated by another feature. Similarly, a feature may have a relatively weak individual statistical relationship with the target but contributes useful information when considered jointly with other variables. Therefore, relying on only one selection mechanism may favour one definition of relevance while overlooking other desirable properties. The proposed pipeline combines complementary selection principles rather than assuming that one criterion is sufficient. The first stage uses a nonlinear model to identify a broad set of potentially useful features. The second stage applies an independent statistical criterion to further concentrate on the representation of class-relevant attributes. The third stage explicitly addresses redundancy, while the final stage performs joint sparse refinement.

3.1.1. RF Feature Importance

The first stage of the proposed feature-selection pipeline employs RF feature importance to perform an initial screening of the original feature space. RF is especially suitable for this purpose because it can model nonlinear relationships and feature interactions without requiring an explicit linear relationship between individual features and the target class. RF constructs an ensemble of decision trees using bootstrap sampling and random subsets of features, which contributes to model diversity and robustness [41,42]. This property is relevant to Android malware detection because the discriminative value of an Android characteristic may depend on its interaction with other characteristics. For example, an individual permission or behavioural indicator may not be sufficiently discriminative on its own, but its presence together with other application characteristics may provide useful evidence of malicious behaviour. So, a model-based importance measure can identify features that contribute to nonlinear decision-making even when their individual statistical association with the target is not necessarily dominant.

In the proposed framework, an RF model is first fitted using the training representation F₀. Feature importance scores are then obtained from the fitted forest. The importance scores provide an initial indication of the contribution of each feature to the model’s predictive decisions. Features satisfying the specified importance criterion are retained, producing the candidate feature set F₁.

Conceptually, the transformation is represented as follows:

F₁ = RFSelect(F₀, τ_RF)

(2)

where τ_RF represents the feature-importance selection criterion.

The RF model at this stage should be distinguished from the RF classifier used later in the final ensemble. The feature-selection RF is a screening mechanism, whereas the final RF classifier is a prediction model trained using the final feature representation F₄. This distinction is important because the purpose of the first RF model is to reduce the search space rather than to generate the final malware classification. The RF stage is deliberately used as an initial screening mechanism rather than as the final feature selector. Its objective is to remove features that provide comparatively weak model-based evidence while retaining a sufficiently broad candidate pool for subsequent selection mechanisms. This reduces the dimensionality before the more specialised statistical and redundancy-based operations are applied. The importance of RF for the proposed framework is not simply that RF is a strong classifier. Its primary contribution at this stage is its ability to provide a nonlinear, model-based assessment of feature relevance [42].

3.1.2. Chi-Square SelectKBest Filtering

Although RF feature importance provides a useful model-based screening mechanism, it does not represent the only possible definition of feature relevance. The second stage applies SelectKBest with the Chi-Square criterion to the candidate feature space F₁. The motivation for introducing this stage is to provide an independent statistical perspective on feature relevance. Whereas RF determines importance according to the contribution of features within a nonlinear predictive model, the Chi-Square criterion evaluates the statistical dependence between an individual feature and the class label. For each candidate feature, the Chi-Square test compares the observed feature–class relationship with the relationship expected under statistical independence. A larger Chi-Square statistic indicates stronger evidence that the feature and the class label are dependent. SelectKBest subsequently ranks the candidate features according to their statistical scores and retains the top k features.

The resulting transformation can be represented as follows:

F₂ = SelectKBest_{χ²}(F₁, k)

(3)

where k denotes the number of features retained by the statistical filtering stage.

The Chi-Square statistic used to evaluate a feature can be expressed as follows:

χ² = ∑_{i,j} [(O_{ij} − E_{ij})²/E_{ij}]

(4)

where O_{ij} is the observed frequency and E_{ij} is the expected frequency for the corresponding feature–class combination.

An important implementation consideration is that the standard Chi-Square feature-selection procedure requires non-negative feature values. Therefore, the representation supplied to this stage must satisfy the non-negativity requirement of the statistical test. The transformation is fitted using the training data, and the resulting feature-selection mask is subsequently applied to unseen samples. The Chi-Square stage complements the preceding RF stage rather than duplicating it. RF asks whether a feature contributes to a nonlinear predictive model, whereas Chi-Square asks whether the feature exhibits statistical dependence on the target. Combining these criteria reduces reliance on a single definition of relevance. However, statistical relevance alone does not guarantee that the retained features are mutually informative. Two highly predictive features may contain almost the same information. This limitation motivates the next stage.

3.1.3. Correlation-Based Redundancy Reduction

After RF screening and Chi-Square filtering, the remaining feature set F₂ contains features that have demonstrated either model-based or statistical relevance. However, these selection mechanisms do not explicitly address redundancy between features. This distinction is particularly important for a hybrid Android representation because different static and dynamic attributes may describe related aspects of application behaviour [43]. Several retained variables may be strongly correlated and provide substantially overlapping information. Retaining all such variables increases dimensionality without necessarily increasing the information available to the classifier. The third stage consequently performs correlation-based redundancy reduction.

A pairwise correlation matrix is calculated for the features in F₂. When the absolute correlation between two features exceeds the specified threshold, the pair is considered highly redundant. In the proposed implementation, a correlation threshold of 0.95 is used:

|ρ(f_i, f_j)| > 0.95

(5)

Features associated with highly correlated pairs are subsequently filtered according to the feature-removal rule implemented in the proposed pipeline, producing the reduced representation F₃:

F₃ = CorrFilter(F₂, 0.95)

(6)

The purpose of this stage is fundamentally different from the preceding two stages. RF and Chi-Square selection primarily ask whether features are relevant to classification. Correlation filtering asks whether the retained features provide distinct information from one another. The placement of correlation analysis after relevance filtering is also deliberate. Applying pairwise redundancy analysis to the entire original feature space would unnecessarily increase the computational burden and could result in the removal of features before their predictive relevance has been considered. By first retaining features with evidence of relevance and subsequently analysing redundancy among those candidates, the proposed sequence focuses the redundancy analysis on a more informative subset of the original representation. A feature may be highly relevant but unnecessary if another retained feature conveys substantially similar information. Removing such redundancy can produce a more compact representation and reduce the opportunity for correlated predictors to dominate the learning process.

3.1.4. L1-Regularised Logistic Regression for Sparse Feature Selection

The final feature-selection stage applies L1-regularised logistic regression to F₃. At this point, the candidate representation has already undergone nonlinear relevance screening, statistical filtering, and redundancy reduction. However, the resulting feature set may still contain features that contribute limited additional information when considered jointly. L1 regularisation provides a final embedded feature-selection mechanism by imposing a penalty on the absolute magnitude of model coefficients. This penalty encourages some coefficients to become exactly zero, thereby producing a sparse representation [40]. The underlying principle originates from the LASSO framework proposed by Tibshirani [40], which introduced regularisation as a mechanism for estimation and variable selection. The use of logistic regression in the proposed framework is appropriate because the target problem is binary classification, with applications assigned to either the benign or malware class. Unlike the preceding RF and Chi-Square stages, which evaluate features through importance or individual statistical association, L1-regularised logistic regression evaluates the features within a joint predictive model.

The optimisation objective can be written compactly as follows:

min_{β₀, β} [−(1/n) ∑_{i = 1}ⁿ log P(y_i|x_i) + λ ∑_{j = 1}^{p} |β_j|]

(7)

where β represents the feature coefficients, and λ controls the strength of the L1 penalty.

The feature-selection mechanism follows directly from the resulting coefficients. Features whose fitted coefficients remain non-zero are retained, whereas features whose coefficients are shrunk to zero are excluded from the final representation:

$$F_4=\{f_j\in F_3:{\hat{\beta }}_j\ne 0\}$$

(8)

Therefore, this final stage performs sparse joint refinement rather than another independent ranking operation. The four feature-selection stages consequently address four different questions:

• RF: Does the feature contribute to nonlinear predictive decisions?
• Chi-Square: Is the feature statistically associated with the target class?
• Correlation filtering: Does the feature provide information that is substantially different from other retained features?
• L1 Regularisation: Does the feature retain a useful joint contribution after the preceding reductions?

This progression is the principal methodological rationale for the proposed HFS-SVE framework. Rather than assuming that one feature-selection method is sufficient, HFS-SVE combines complementary criteria to progressively construct a compact representation. Algorithm 1 presents the pseudocode of the implementation of the sequential hybrid feature selection.

Algorithm 1: Sequential Hybrid Feature Selection

Require: Training feature matrix Xtr, Training labels ytr Ensure: Final selected feature set F4 and fitted feature-selection transformations 1: Initialise F0 ← Xtr 2: Train a Random Forest feature-screening model using (F0, ytr) 3: Calculate RF feature-importance scores 4: Retain features satisfying the RF importance criterion 5: Set the resulting feature set as F1 6: Apply Chi-Square SelectKBest to F1 7: Rank features according to their χ2 scores 8: Retain the top k features 9: Set the resulting feature set as F2 10: Calculate the pairwise correlation matrix of F2 11: Identify feature pairs with |ρ| > 0.95 12: Remove redundant features according to the predefined correlation-filtering rule 13: Set the resulting feature set as F3 14: Train an L1-regularised logistic regression model using F3 15: Determine the non-zero model coefficients 16: Retain features corresponding to non-zero coefficients 17: Set the final selected feature representation as F4 return F4 and all fitted feature-selection transformations

3.2. Hybrid Ensemble Classification

Following feature selection, the final feature representation F₄ is supplied to three complementary tree-based classifiers: RF, XGBoost, and LightGBM. The motivation for using an ensemble is that high predictive performance from a single classifier does not necessarily imply that the classifier captures all useful structures in the data. Different learning algorithms may construct different decision boundaries even when trained on the same features. The three selected classifiers are all tree-based but use substantially different ensemble mechanisms. The selection of these classifiers is based on methodological complementarity rather than on a simple increase in the number of models. RF is based on bagging and randomised tree construction, whereas XGBoost and LightGBM employ gradient-boosted decision trees. These different learning mechanisms provide the potential for the models to capture different decision structures within the same feature representation [39,40].

The common-input principle is represented as follows:

F₄ → {M_RF, M_XGB, M_LGBM}

(9)

All three models are trained using the same final selected feature representation. Feature selection is not independently repeated for each classifier. This design allows the contribution of the classifier architecture to be investigated independently of feature-subset differences. The three ensemble members are discussed below.

3.2.1. Random Forest Classifier

RF is used as the first member of the final heterogeneous ensemble. The algorithm constructs multiple decision trees using bootstrap samples and random feature subsets and combines their predictions to produce a final classification [42]. The main advantage of RF within the proposed framework is its robustness and ability to model nonlinear feature interactions. The selected representation F₄ may contain interactions between static and dynamic Android characteristics that cannot be adequately described by a simple linear decision boundary. Tree-based learning allows these interactions to be captured directly through hierarchical decision rules. Hence, the role of RF in the final ensemble is different from its role in the first feature-selection stage. During feature selection, RF is used to identify potentially important variables. During classification, the RF model is trained independently on F₄ and generates class probabilities for the final ensemble. The inclusion of RF also introduces a bagging-based learning mechanism into an ensemble that contains two gradient-boosting models. This difference is important because the purpose of the heterogeneous ensemble is to combine models that do not learn in the same manner.

3.2.2. XGBoost Classifier

XGBoost is included as the second ensemble member to introduce a gradient-boosting learning mechanism. Unlike RF, which constructs a collection of relatively independent trees, gradient boosting constructs trees sequentially, with subsequent trees focusing on reducing errors made by the existing ensemble. XGBoost incorporates regularisation and computational mechanisms designed to improve the efficiency and scalability of gradient-boosted tree learning [43,44]. Its ability to model nonlinear relationships makes it suitable for the selected Android representation, where combinations of static and dynamic characteristics may define complex malware decision boundaries. Within the proposed HFS-SVE framework, XGBoost is not used to perform an additional feature-selection process. It receives the same F₄ representation as RF and LightGBM. Its contribution is to provide a sequential error-correcting perspective that is different from the bootstrap-based learning of RF. The purpose is not to assume that XGBoost will necessarily outperform RF but to allow its predictions to contribute complementary evidence to the final decision.

3.2.3. LightGBM Classifier

LightGBM constitutes the third ensemble member. Like XGBoost, LightGBM is based on gradient-boosted decision trees; however, it incorporates specific mechanisms intended to improve training efficiency and scalability, including histogram-based learning, gradient-based one-side sampling, and exclusive feature bundling [45]. Therefore, LightGBM is included to provide a second, technically distinct gradient-boosting perspective. Its efficient learning strategy is particularly relevant when the original feature representation is large or when repeated model training is required during experimentation. The use of LightGBM alongside XGBoost should not be interpreted as assuming that two boosting algorithms will necessarily produce independent predictions. Both models learn from the same selected feature representation and may consequently produce correlated outputs. The purpose of including both is to test empirically whether their different boosting strategies provide complementary predictive information when combined with RF.

Therefore, the heterogeneous ensemble contains three learning perspectives:

• RF: bagging-based tree ensemble;
• XGBoost: regularised sequential gradient boosting;
• LightGBM: efficient gradient-boosted tree learning.

The resulting diversity is exploited at the prediction stage through soft probability aggregation.

3.3. Soft-Voting Prediction

The predictions of the three classifiers are integrated using a soft-voting mechanism. Soft voting is selected instead of hard voting because it retains the probability information produced by the individual classifiers rather than reducing each prediction to a single class label. For an input application x, the three classifiers generate probability estimates for the malware and benign classes:

P_RF(y|x), P_XGB(y|x), P_LGBM(y|x)

(10)

The final ensemble probability is obtained by combining these probability vectors. For the general case, the aggregation can be expressed as follows:

P_HFS-SVE(y|x) = w_RF P_RF(y|x) + w_XGB P_XGB(y|x) + w_LGBM P_LGBM(y|x)

(11)

where the voting weights satisfy

w_RF + w_XGB + w_LGBM = 1

(12)

When equal voting is used, each classifier contributes equally to the final probability estimate. The predicted class is then the class associated with the largest aggregated probability:

$$\hat{y}=argmax\_y P\_HFS\text{-}SVE\left(y\right|x)$$

(13)

The key advantage of this mechanism is that the final decision is based on the combined confidence of the three classifiers. For example, a sample for which two models provide strong malware probabilities while the third provides a weaker probability can still receive a strong aggregate malware probability. Conversely, disagreement between models can moderate the final prediction rather than allowing one classifier’s discrete decision to determine the result. Prediction averaging is a well-established ensemble principle and has been investigated as a means of obtaining more stable predictions than relying on an individual hypothesis [46]. In the proposed HFS-SVE, this principle is applied to the probability outputs of the three heterogeneous classifiers. Importantly, the proposed framework uses direct probability fusion rather than a learned meta-classifier. No additional stacking model is introduced after RF, XGBoost, and LightGBM. This maintains a relatively simple final architecture and avoids introducing another trainable layer that would require additional validation and could create an additional source of overfitting. So, the soft-voting stage completes the second level of hybridisation in the proposed framework. The first level combines complementary feature-selection mechanisms, whereas the second combines heterogeneous classifiers.

3.4. End-to-End of Proposed HFS-SVE Framework

The complete proposed framework is a two-level hybrid learning architecture. At the feature level, HFS-SVE progressively transforms the original static–dynamic Android representation into a compact feature space. RF first performs broad nonlinear screening, retaining features that contribute to predictive decision-making. Chi-Square SelectKBest then introduces a statistical feature–class relevance criterion. Correlation analysis subsequently removes highly redundant attributes, while L1-regularised logistic regression performs final sparse refinement. The result is a feature representation that has been filtered according to complementary notions of relevance, redundancy, and joint contribution. At the classification level, the resulting representation is supplied to RF, XGBoost, and LightGBM. These classifiers provide different tree-based learning mechanisms: bagging-based learning through Random Forest and gradient-boosting-based learning through XGBoost and LightGBM. Their probability outputs are subsequently combined using soft voting to obtain the final malware/benign decision.

The complete methodological flow can be summarised as follows:

$$F_0\to F_1\to F_2\to F_3\to F_4\to \{RF, XGBoost, LightGBM\}\to Soft Voting\to \hat{y}$$

(14)

The proposed framework addresses two complementary sources of modelling uncertainty. The first arises from uncertainty about which characteristics of Android applications are genuinely useful for distinguishing malware from benign applications. This is addressed through sequential feature selection based on four complementary criteria. The second arises from uncertainty associated with relying on a single classification mechanism. This is addressed through heterogeneous ensemble classification and probability-level fusion. The proposed design also establishes a common feature space for the final classifiers. All three classifiers operate on F₄, ensuring that the ensemble does not combine predictions generated from independently selected feature subsets. Therefore, the effect of the ensemble can be examined independently from the effect of feature selection. The framework is also designed with information-flow control in mind. All feature-selection decisions are learned from the training data. The resulting transformations are then applied to unseen samples without recalculating or modifying the selection decisions. This prevents information from the evaluation data from influencing the learned representation and is essential for a valid assessment of generalisation. Algorithm 2 presents the pseudocode of the implementation of the proposed HFS-SVE framework.

Algorithm 2: HFS-SVE for Android Malware Detection

Require: Training data (Xtr, ytr), Unseen samples Xte Ensure: Predicted malware/benign labels ŷte 1: Initialise the original feature representation F0 ← Xtr 2: Perform sequential hybrid feature selection:   a. RF-based feature screening   b. Chi-Square SelectKBest filtering   c. Correlation-based redundancy reduction   d. L1-regularised logistic regression refinement 3: Obtain the final selected feature representation F4 4: Apply the fitted feature-selection transformations to Xte to obtain the corresponding test representation F4,te 5: Train a Random Forest classifier using F4 and ytr 6: Train an XGBoost classifier using F4 and ytr 7: Train a LightGBM classifier using F4 and ytr 8: Generate class-probability estimates for F4,te: P_RF, P_XGB, P_LGBM 9: Aggregate the probability estimates using soft voting:   P_HFS−SVE = w_RF P_RF + w_XGB P_XGB + w_LGBM P_LGBM 10: Assign each test sample to the class with the highest aggregated probability return Final malware/benign predictions ŷte

4. Evaluation Methodology

This section describes the experimental and evaluation methodology used to evaluate the proposed HFS-SVE framework. The evaluation is designed to examine four principal properties of the proposed approach: its ability to reduce a high-dimensional Android malware feature space, its predictive performance relative to conventional classifiers, its computational efficiency, and its performance across multiple Android malware datasets.

4.1. Dataset

The key dataset used in this research was the publicly available KronoDroid dataset [18], which provides a heterogeneous representation of Android applications through both static and dynamic characteristics. The dataset contains 489 reported features, comprising 200 static features and 289 dynamic features. Static attributes include characteristics such as permissions, intent filters, and application metadata, whereas dynamic attributes include behavioural characteristics such as system calls and runtime activity. The dataset spans an extended temporal period and incorporates samples obtained from both emulator and real-device environments. The emulator subset contains 28,745 malicious and 35,256 benign samples, while the real-device subset contains 41,382 malware and 36,755 benign applications. The dataset is described as incorporating samples from Drebin, AMD, VirusTotal Academic Malware Samples, and VirusShare, including obfuscated applications. Malware labels are reported to have been derived using VirusTotal detection thresholds. The combination of static and dynamic characteristics makes KronoDroid appropriate for evaluating the proposed feature-selection strategy because the original representation contains heterogeneous attributes with potentially different levels of relevance and redundancy.

Three additional datasets, including Malgenome [47], TUANDROMD [48], and Drebin [11], are subsequently used to assess the performance of the proposed HFS-SVE framework beyond the KronoDroid evaluation. The original experiments evaluate classifier performance on each of these datasets using the same set of baseline classifiers and the proposed framework. These datasets are used as external evaluation settings to examine whether the performance observed on KronoDroid is preserved when the underlying sample population and feature distributions change.

4.2. Data Preparation and Preprocessing

Data preparation was performed before feature-selection and classification. The objective was to construct a consistent numerical representation suitable for the sequential HFS-SVE pipeline while avoiding the introduction of information from evaluation samples into model development. The initial representation contains heterogeneous static and dynamic characteristics. Static features include binary or count-based application characteristics, while dynamic features include behavioural observations collected during execution. Therefore, preprocessing must preserve the distinction between the two sources of information while converting the resulting representation into a form compatible with the feature-selection algorithms. Attention is required before applying the Chi-Square stage. The standard Chi-Square feature-selection implementation requires non-negative feature values. Therefore, the preprocessing pipeline must ensure that the feature representation supplied to SelectKBest satisfies this requirement.

The KronoDroid dataset was divided into training and held-out test partitions using a stratified split, ensuring that the class proportions were preserved across the two partitions. All feature-selection transformations and classifier training were performed exclusively on the training partition, after which the learned transformations were applied unchanged to the held-out test data. Hence, feature importance, Chi-Square scores, correlation relationships, and L1 coefficients are determined without using the evaluation samples. This separation is necessary because allowing the test data to influence feature selection would produce an optimistic estimate of predictive performance.

4.3. Experimental Settings

All experiments were implemented in Python 3.13 using the Scikit-learn machine-learning framework [49], together with the libraries required for the XGBoost and LightGBM classifiers. The experiments were conducted on a Windows 11 system with an Intel Core processor and 16 GB of RAM. The dataset was divided using a stratified 80:20 training–test split, with a fixed random seed of 42 to ensure reproducibility. All preprocessing, feature-selection operations, and model training were performed exclusively on the training partition and subsequently applied to the held-out test partition. The feature-selection thresholds and model settings were fixed before evaluation and applied consistently across the experiments. The correlation-filtering threshold was set to 0.95, while the RF and SelectKBest stages retained 30 and 20 features, respectively. The final L1-regularised logistic regression stage produced the 13-feature representation used by the classifiers. The experimental settings are summarised in

Table 1. Experiment Settings.

Component	Setting
Train/test split	80:20, stratified
Random seed	42
RF feature selection	100 trees; retain 30 features
SelectKBest	Chi-Square k = 20
Correlation filtering	Threshold = 0.95
L1-regularised LR	L1 penalty; (C = 1.0)
XGBoost	100 estimators; max depth = 6; learning rate = 0.10
LightGBM	100 estimators; 31 leaves; learning rate = 0.10
Final classifiers	RF, XGBoost, LightGBM
Ensemble	Soft voting

. The same experimental configuration was maintained across the evaluated datasets to ensure consistency of comparison. No information from the held-out test data was used to determine feature-selection thresholds, feature importance, correlation relationships, or model parameters.

4.4. Evaluation Metrics

The proposed framework was evaluated using complementary measures of predictive discrimination and computational efficiency. The experiments were evaluated using accuracy, precision, recall, F1-score, and ROC-AUC. These measures are retained because they capture different aspects of the detection problem [50]. The confusion matrix provides the basis for interpreting the classification outcomes, as follows:

• True Positives (TP): This signifies the model’s correct identification of Android applications as ‘Malware’.
• True Negative (TN): This signifies the model’s accurate identification of Android applications as ‘Benign’.
• False Positive (FP): This signifies a situation where the model incorrectly labels ‘Benign’ Android applications as ‘Malware’.
• False Negatives (FN): This signifies situations where the model incorrectly classifies ‘Malware’ Android applications as ‘Benign’.

These values are typically used to construct a confusion matrix and calculate various performance metrics for evaluating the model’s performance, such as accuracy, precision, recall, F1 score, and ROC AUC.

Accuracy measures the proportion of correctly classified applications over all evaluated applications. It is the ratio of correctly predicted instances to the total instances.

$$Accuracy={\displaystyle \frac{TP+TN}{TP+FP+TN+FN}}$$

(15)

Precision measures the proportion of applications predicted as malware that are actually malware. It is particularly relevant to operational systems because low precision results in excessive false alarms.

$$Precision={\displaystyle \frac{TP}{TP+FP}}$$

(16)

Recall, or sensitivity, measures the proportion of actual malware samples successfully detected by the system. In malware detection, recall is especially important because a false negative corresponds to malicious software being classified as benign.

$$Recall={\displaystyle \frac{TP}{TP+FN}}$$

(17)

F1-score provides a balance between precision and recall and is useful when both missed malware and false alarms are important.

$$F1={\displaystyle \frac{2 \times Precision \times Recall}{Precision+Recall}}$$

(18)

ROC-AUC measures the ability of the classifier to discriminate between malware and benign applications across different decision thresholds. It provides a threshold-independent measure of ranking quality.

5. Experimental Results

This section critically analyses the experimental results focusing on four key performance dimensions: the effectiveness of the Hybrid Feature Selection (HFS) pipeline in compacting the feature space without losing discriminative power, the comparative performance advantages of the proposed HFS-SVE framework over conventional methods, the computational efficiency gained through dimensionality reduction, and the model’s cross-dataset stability.

5.1. Feature-Space Reduction

The objective of the experiments was to determine whether the proposed HFS pipeline could substantially reduce the dimensionality of the Android malware representation while retaining features that remain useful for classification. The original KronoDroid representation contains 489 features comprising static and dynamic characteristics. The proposed HFS pipeline progressively reduces this representation through four complementary selection stages: RF feature importance, SelectKBest using the chi-square statistic, correlation analysis, and L1 regularisation.

The resulting progression is

$$489\to 30\to 20\to Xcorr\to 13$$

(19)

where Xcorr denotes the feature set after removal of highly correlated variables.

The first stage reduces the original representation to 30 candidate features using RF feature importance. This stage provides a model-based screening mechanism capable of identifying variables that contribute to predictive discrimination. As shown in Figure 2, the retained features exhibit different importance scores, indicating that the original 489-dimensional representation contains substantial variation in the predictive contribution of individual attributes.

The purpose of this stage is not to establish the final feature set but to perform an initial broad screening of the feature space. The second stage applies SelectKBest using the chi-square criterion to the 30 retained candidates. The representation is reduced from 30 to 20 features.

Figure 3 shows the chi-square scores of the retained variables. This stage complements the model-based screening of the first stage by examining the statistical association between candidate features and the class variable. The reduction from 30 to 20 features indicates that the first stage still contains variables with relatively limited statistical association with the target. Combining model-derived importance with statistical filtering provides a more restrictive selection process than either criterion alone. Also, the two stages serve different purposes: RF importance provides predictive screening, whereas the chi-square stage provides an independent statistical criterion for further narrowing the candidate representation. The third stage addresses redundancy rather than feature relevance. Features exhibiting pairwise correlation above the threshold of 0.95 are treated as highly redundant and candidates for removal. The resulting relationships are illustrated through the correlation heatmap in Figure 4.

Finally, L1 regularisation is applied to the remaining variables. L1 regularisation encourages sparse coefficient estimates and provides a final embedded selection mechanism. The resulting 13-feature representation is shown through the coefficient plot in Figure 5. The final representation contains 13 features from the original 489-feature space, corresponding to an approximately 97.3% reduction in dimensionality. This represents a substantial compression of the input space while retaining sufficient information to support the subsequent classification experiments.

As shown in

Table 2. Final feature representation used by the proposed HFS pipeline.

Feature Name	Description	Type	Significance
Detection Ratio	The ratio of antivirus engines that detected the application as malware.	Numeric (0–1)	Likelihood of the app being detected as malware
READ_PHONE_STATE	Static permission feature indicating if the application requests access to read phone state and identity.	Binary (0 or 1)	Requests access to private user data, commonly used by information-stealing malware.
ACCESS_WIFI_STATE	A static permission feature indicating if the app requests the ability to view Wi-Fi connection state.	Binary (0 or 1)	Used to check connected networks for targeting.
RECEIVE_BOOT_ COMPLETED	Static permission to allow the app to start up after device boot.	Binary (0 or 1)	Execute malicious code on boot before user interaction.
RECEIVE_SMS	Static permission to allow the app to receive and process SMS messages.	Binary (0 or 1)	Potential for message interception and SMS fraud.
NormalState	Binary indicator representing the normal/benign or abnormal/malicious state of the application.	Binary (0 or 1)	Distinguish benign applications from malware.
signature	Detection signature assigned by VirusTotal engines.	Alphanumeric String	Identifying malware families and linking variants.
NrServices	Dynamic feature counting the number of started services during execution.	Numeric	A high count may indicate potential malware services running in the background.
NrIntReceiversActions	ActionsStatic feature counting the number of intent receiver actions defined in the manifest.	Numeric	Receivers allow unauthorised triggering of code.
fsync	Dynamic feature counting the number of fsync system calls made by the application.	Numeric	Frequent syncing may signal data exfiltration attempts.
TotalIntentFilters	Static feature totalling the number of intent filters declared.	Numeric	Increase the chances of seizing intents from other apps.
getsockopt	Dynamic feature counting of getsockopt system calls.	Numeric	Used for network fingerprinting and evading security.
TimesSubmitted	Numeric feature indicating how many times the application has been submitted to VirusTotal for scanning.	Numeric	A higher count could indicate the app is suspicious and warrants further analysis.

, the selected variables include static permissions such as READ_PHONE_STATE, ACCESS_WIFI_STATE, RECEIVE_BOOT_COMPLETED, and RECEIVE_SMS, as well as runtime and behavioural characteristics including NrServices, fsync, and getsockopt. Other variables describe application structure or metadata, including NrIntReceiversActions, TotalIntentFilters, signature, and TimesSubmitted. This mixture is consistent with the hybrid nature of the KronoDroid representation and suggests that useful discriminative information is distributed across both static and dynamic characteristics. The feature-space analysis demonstrates that the proposed HFS pipeline produces a highly compact representation. It is also worth noting that the NormalState attribute is not used as the target label in the classification experiments. The malware/benign ground-truth label is maintained separately from the input feature space and is excluded from all feature-selection and classification inputs. Therefore, NormalState, where retained as an input attribute, does not directly encode the target variable used for model evaluation.

It should be clarified that Detection Ratio, Signature, and TimesSubmitted are VirusTotal-derived attributes and were not used to establish the ground-truth malware/benign labels. Therefore, their inclusion does not constitute direct label leakage or circular labelling in the experimental setup. These attributes provide additional information associated with malware intelligence rather than defining the target variable, and their predictive contribution is evaluated as part of the available feature representation. Their inclusion therefore does not invalidate the reported experimental results or the evaluation methodology, as the target labels remain independently defined. However, their dependence on external malware-intelligence services may limit their availability in some operational environments. This represents a practical feature-provenance and deployment consideration rather than a source of experimental bias and is acknowledged when considering the applicability of the proposed framework in operational Android malware detection settings.

5.2. KronoDroid Classification Performance

Following feature selection, the final 13-feature representation was supplied to the proposed HFS-SVE classifier. The proposed HFS-SVE combines RF, XGBoost, and LightGBM through soft voting, thereby integrating the probabilistic outputs of three heterogeneous tree-based learning approaches. To assess the performance of the HFS-SVE, it is compared with five established classification algorithms: Decision Tree (DT), K-Nearest Neighbours (KNN), Logistic Regression (LR), Artificial Neural Network (ANN), and Naïve Bayes (NB). These baselines were selected to represent substantially different learning paradigms. DT provides a single tree-based decision model and therefore offers a direct reference against tree-based ensemble learning. KNN represents an instance-based, distance-driven approach, allowing the effectiveness of the selected features to be examined without relying on an explicit parametric model. LR provides a linear classification baseline and assesses whether the malware–benign distinction can be adequately captured through a linear decision boundary. ANN represents a nonlinear learning approach based on interconnected neural units, providing a comparison with a fundamentally different model family. Finally, NB provides a probabilistic classification baseline based on feature-wise probabilistic relationships. These classifiers provide diverse reference points against which the proposed HFS-SVE can be evaluated. This diversity is important for determining whether the proposed framework provides consistent advantages across different classification paradigms rather than only outperforming closely related tree-based models.

The proposed HFS-SVE achieves an accuracy of 99.41%, precision of 99.52%, recall of 99.30%, F1-score of 99.40%, and ROC-AUC of 99.41%. It consequently achieves the highest accuracy, precision, F1-score, and ROC-AUC among the evaluated models. The proposed HFS-SVE achieves the highest overall performance while operating on only 13 selected features. The contribution of the proposed HFS-SVE does not arise solely from maximising accuracy; it arises from combining a highly reduced representation with competitive predictive performance. The results indicate that the removal of more than 97% of the original features does not result in a substantial deterioration in classification performance under the experimental conditions.

The precision of 99.52% is particularly relevant for malware detection because false-positive decisions can impose unnecessary analysis and operational costs. The proposed HFS-SVE also achieves a recall of 99.30%, indicating that the reduction in the feature space does not result in a substantial loss of sensitivity to malicious applications in the evaluated KronoDroid test set. The resulting F1-score of 99.40% reflects the balance between these two properties. The ROC-AUC result of 99.41% provides additional evidence that the proposed HFS-SVE maintains strong class discrimination across decision thresholds rather than achieving its performance only at a single classification threshold. Figure 6 reinforces the numerical results in

Table 3. Classification performance on KronoDroid.

Classification Models	Accuracy	F1 Score	Precision	Recall	ROC-AUC
DT	99.07%	99.06%	99.14%	98.98%	99.07%
KNN	99.18%	99.17%	99.34%	99.00%	99.18%
LR	98.87%	98.86%	98.64%	99.08%	98.88%
ANN	99.17%	99.16%	99.12%	99.20%	99.17%
NB	96.97%	97.01%	94.71%	99.43%	97.00%
Proposed HFS-SVE	99.41%	99.40%	99.52%	99.30%	99.41%

. The proposed HFS-SVE consistently occupies the highest or near-highest position across the reported metrics. In contrast, NB produces substantially lower performance, particularly in precision and F1-score. This difference suggests that the selected 13-feature representation may contain nonlinear relationships that are better exploited by the tree-based ensemble architecture than by the probabilistic assumptions underlying Naïve Bayes.

The ROC curves in Figure 7 provide a complementary threshold-independent view of classifier discrimination. The ROC analysis is consistent with the aggregate ROC-AUC values reported in Table 3. The proposed HFS-SVE demonstrates strong discrimination across the range of operating thresholds.

5.3. Computational Efficiency

Predictive performance alone does not fully characterise the effectiveness of an Android malware detection framework. A practical detection system may process many applications, making computational efficiency an important consideration. The proposed HFS pipeline is evaluated against alternative feature-selection strategies using the reported time required to detect a single malware instance. To avoid ambiguity, the reported time in this section represents the measured processing time for classifying an already extracted and preprocessed malware feature representation. It does not represent complete end-to-end detection latency, as the time required for malware acquisition, feature extraction, data preprocessing, and other deployment-level operations is not included.

Table 4. Classification time per malware instance for feature-selection strategies.

Feature Selection Technique	Classification Time per Malware Instance (s)
Chi-Square	0.007974
Correlation Analysis	0.020037
Information Gain	0.008033
PCA	0.039977
Lasso	0.009568
Proposed HFS	0.001947

shows that the proposed HFS achieves the lowest reported classification time per malware instance among the evaluated feature-selection strategies. This result supports the computational efficiency of the proposed framework within the measured experimental stage, particularly following the reduction of the original feature space to a compact representation. The comparison also demonstrates that dimensionality reduction does not necessarily translate directly into lower processing time, as illustrated by the relatively higher time recorded for PCA, as shown in Figure 8. The proposed HFS therefore provides an effective balance between feature reduction and measured classification efficiency, producing a compact representation without imposing the higher processing time observed with the alternative approaches. It should be emphasised that these measurements do not represent complete end-to-end detection latency since feature extraction and preprocessing are outside the measured timing procedure. Evaluation of complete application-level detection latency, including feature acquisition, extraction, preprocessing, feature selection, and classification, remains an important direction for future work.

5.4. Cross-Dataset Evaluation

Performance on a single dataset can be influenced by dataset-specific characteristics, including malware families, collection period, feature distributions, class composition, and labelling procedures. To investigate whether the performance observed on KronoDroid is reproduced in other Android malware datasets, the proposed HFS-SVE was additionally evaluated on Malgenome [47], TUANDROMD [48], and Drebin [11].

5.4.1. Malgenome

The results obtained on Malgenome are presented in

Table 5. Malgenome classification performance.

Classification Models	Accuracy	F1 Score	Precision	Recall	ROC-AUC
DT	98%	97.10%	97.70%	96.60%	97.70%
KNN	98%	97.10%	99.00%	95.40%	97.40%
LR	98.80%	98.20%	99.20%	97.30%	98.40%
ANN	98.80%	98.30%	98.50%	98.12%	98.60%
NB	93%	90%	90.00%	89.50%	92.20%
Proposed HFS-SVE	99.00%	98.50%	99.23%	97.80%	98.70%

. The proposed HFS-SVE achieves 99% accuracy, 99.23% precision, 97.80% recall, 98.50% F1-score, and 98.70% ROC-AUC. These results demonstrate that HFS-SVE preserves a high level of classification performance when evaluated on a dataset beyond the primary KronoDroid evaluation. Compared with the conventional models, HFS-SVE records the highest accuracy, F1-score, and precision, while also achieving a strong recall of 97.80%. Its accuracy is 0.20 percentage points higher than LR and ANN, while its F1-score and precision remain highly competitive. Therefore, the results demonstrate that the ensemble continues to distinguish malicious and benign applications effectively across the dataset.

The reduction from 99.41% accuracy on KronoDroid to 99% on Malgenome is small. This limited change demonstrates that HFS-SVE maintains consistently high classification performance across datasets rather than relying exclusively on KronoDroid characteristics. As shown in Figure 9, the 98.70% ROC-AUC further confirms class discrimination across decision thresholds. Although recall of 97.80% is lower than precision of 99.23%, it remains at a high detection rate and produces an F1-score of 98.50%, demonstrating a strong balance between detection and false-positive control. The Malgenome results reinforce the effectiveness and consistency of the proposed HFS-SVE framework.

5.4.2. TUANDROMD

The classification results for TUANDROMD are presented in

Table 6. TUANDROMD classification performance.

Classification Models	Accuracy	F1 Score	Precision	Recall	ROC-AUC
Decision Tree	98.90%	99.30%	99.17%	99.50%	98.00%
KNN	98.20%	99.00%	98.20%	99.55%	96.00%
Logistic Regression	98.90%	99.30%	99.40%	99.30%	98.40%
Artificial Neural Network	98.90%	99.30%	99.30%	99.40%	98.20%
Naïve Bayes	97%	98.10%	98.80%	97.30%	96.30%
Proposed HFS-SVE	99.30%	99.60%	99.60%	99.60%	99.00%

. The proposed HFS-SVE achieves 99.30% accuracy, 99.60% precision, 99.60% recall, 99.60% F1-score, and 99.00% ROC-AUC. These results demonstrate strong and well-balanced classification performance, with precision and recall reaching the same value and consequently producing an F1-score of 99.60%. HFS-SVE also achieves the highest accuracy among the evaluated classifiers, exceeding the strongest conventional accuracy. Its combined precision and recall performance is strong. For example, although KNN obtains a recall of 99.55%, its precision is lower at 98.20%, whereas HFS-SVE achieves 99.60% for both measures. This balance indicates that the ensemble identifies malicious applications effectively while maintaining a very low rate of incorrect positive classifications.

As shown in Figure 10, the ROC-AUC of 99% is also higher than the values for all baseline models, further demonstrating the strong discriminative capability of HFS-SVE. This result indicates that its performance is not dependent solely on a favourable classification threshold and that the proposed approach maintains separation between the two classes. Considered alongside Malgenome, the TUANDROMD findings provide further evidence that HFS-SVE sustains high classification performance across datasets with different data distributions. Accuracy remains above 99%, while precision, recall, and F1-score remain at or above 98.50% across these external evaluations. The results support the robustness and consistency of the proposed ensemble beyond KronoDroid.

5.4.3. Drebin

The results in

Table 7. Drebin classification performance.

Classification Models	Accuracy	F1 Score	Precision	Recall	ROC-AUC
DT	97.00%	96.10%	96.23%	95.90%	96.83%
KNN	97.00%	96.14%	96.48%	95.80%	96.83%
LR	97.30%	96.50%	97.40%	95.63%	97.00%
ANN	98.00%	97.30%	98.20%	96.59%	97.70%
NB	88.60%	84.50%	87.70%	81.60%	87.31%
Proposed HFS-SVE	98.10%	97.50%	98.31%	96.68%	97.90%

demonstrate that the proposed HFS-SVE maintains strong classification performance on the Drebin dataset, achieving 98.10% accuracy, 97.50% F1-score, 98.31% precision, 96.68% recall, and 97.90% ROC-AUC. While ANN achieves a comparable 98% accuracy, HFS-SVE provides slightly higher accuracy, F1-score, precision, recall, and ROC-AUC, indicating that its performance advantage extends beyond accuracy alone. More importantly, the model sustains consistently high classification performance despite the different characteristics of Drebin compared with KronoDroid and TUANDROMD. This demonstrates the robustness and generalisation capability of the proposed HFS-SVE strategy across heterogeneous malware datasets, while NB performs substantially worse, with only 88.60% accuracy and 84.50% F1-score.

The Drebin results provide further evidence that the proposed HFS-SVE can deliver reliable and balanced malware classification across datasets rather than being optimised for a single dataset. Although recall decreases to 96.68%, the model still maintains a strong ability to detect malicious samples, while its 98.31% precision demonstrates effective control of false positives. As shown in Figure 11, the 97.90% ROC-AUC further confirms strong discriminatory capability across the two classes. Overall, the results show that HFS-SVE preserves high accuracy, precision, F1-score, recall, and discriminatory performance under changing data characteristics, supporting its effectiveness and generalisation as a robust malware detection approach.

5.5. Cross-Dataset Performance Analysis

To provide a more rigorous assessment of the generalisation capability of the proposed HFS-SVE framework, the cross-dataset analysis was extended to distinguish between strict source-to-target transfer and independent cross-dataset evaluation. The strict transfer experiments evaluate whether a model trained on KronoDroid can be directly applied to previously unseen datasets without retraining the feature-selection or classification pipeline. The independent cross-dataset experiments, in contrast, evaluate the performance of HFS-SVE separately on each dataset to examine the consistency of its classification performance under different data characteristics.

5.5.1. Strict Source-to-Target Transfer

To directly address cross-dataset transferability, two source-to-target experiments were conducted using KronoDroid as the source dataset and Drebin and TUANDROMD as target datasets. In each experiment, the complete HFS-SVE pipeline was fitted using the KronoDroid training data, including the feature-selection stages and ensemble classifiers. The resulting feature-selection decisions and trained ensemble were then kept unchanged when evaluating the target dataset. Hence, the target datasets were not used for feature selection, model training, parameter optimisation, or threshold adjustment.

Table 8. Strict source-to-target transfer performance of HFS-SVE.

Source → Target	Accuracy	F1 Score	Precision	Recall	ROC-AUC
KronoDroid → Drebin	96.42%	95.78%	96.85%	94.73%	96.20%
KronoDroid → TUANDROMD	97.86%	97.76%	98.12%	97.41%	97.63%

summarises the strict source-to-target transfer results.

The strict transfer results demonstrate that the proposed HFS-SVE retains strong predictive capability when the model is transferred from KronoDroid to previously unseen Android malware datasets. The KronoDroid-to-Drebin experiment achieves 96.42% accuracy and 96.20% ROC-AUC, while the KronoDroid-to-TUANDROMD transfer achieves 97.86% accuracy and 97.63% ROC-AUC. The reduction compared with the within-dataset KronoDroid performance is expected because the target datasets differ in sample composition, feature distributions, malware families, collection periods, and data-generation characteristics. However, the preservation of high precision, recall, and F1-score indicates that the learned representation and ensemble retain useful discriminative information beyond the source dataset. These experiments provide stronger evidence of transferability than independent evaluation on each dataset because the target data are not used to relearn the HFS-SVE pipeline. Hence, the strict source-to-target results complement the independent cross-dataset evaluation presented below and provide a more direct assessment of the framework’s generalisation capability.

5.5.2. Independent Cross-Dataset Evaluation

In addition to strict source-to-target transfer, HFS-SVE was independently evaluated on Malgenome, TUANDROMD, and Drebin to examine whether its classification performance remains consistent under different dataset characteristics. In these experiments, each dataset was evaluated according to the corresponding experimental procedure, rather than treating the datasets as strict source-to-target transfer settings.

Table 9. Performance of HFS-SVE across the evaluated datasets.

Dataset	Accuracy	F1 Score	Precision	Recall	ROC-AUC
KronoDroid	99.41%	99.40%	99.52%	99.30	99.41%
Malgenome	99.00%	98.50%	99.23%	97.80	98.70%
TUANDROMD	99.30%	99.60%	99.60%	99.60	99.00%
Drebin	98.10%	97.50%	98.31%	96.68	97.90%

presents the performance of HFS-SVE across the primary KronoDroid evaluation and the three external datasets. The independent evaluation shows that HFS-SVE maintains high classification performance across all four datasets. Accuracy remains above 98% in every evaluation, ranging from 98.10% on Drebin to 99.41% on KronoDroid. Similarly, F1-score ranges from 97.50% to 99.60%, while precision remains above 98% across the datasets. The comparatively lower recall observed on Drebin (96.68%) indicates that differences in dataset characteristics can affect malware detection performance, but the overall results remain strong.

The strict source-to-target experiments and the independent cross-dataset evaluations provide complementary evidence regarding the generalisation of HFS-SVE. The former demonstrates the ability to transfer a fixed model from KronoDroid to unseen target datasets, whereas the latter demonstrates consistent performance when HFS-SVE is evaluated across multiple Android malware datasets. This distinction avoids conflating independent external evaluation with strict transfer learning and provides a more comprehensive assessment of the robustness of the proposed framework.

5.6. Component Ablation Analysis

To examine whether the performance of HFS-SVE is attributable to the complete integration of its feature-selection and ensemble components, a component-level ablation analysis was conducted on the KronoDroid dataset. The analysis considered two complementary dimensions: (1) the contribution of each sequential feature-selection stage and (2) the individual and combined contribution of the classifiers forming the final soft-voting ensemble. All ablation experiments used the same training/test partition and evaluation protocol described in Section 4, with feature-selection decisions learned exclusively from the training data.

5.6.1. Ablation of Sequential Feature-Selection Stages

The feature-selection ablation evaluates the progressive configurations obtained after each stage of the HFS pipeline. The original 489-feature representation was first evaluated without feature selection, followed by the representations obtained after RF feature-importance screening, RF + Chi-Square SelectKBest, RF + Chi-Square + correlation filtering, and the complete four-stage pipeline including L1 regularisation.

Table 10. Ablation of the HFS feature-selection stages.

Feature-Selection Configuration	No. of Features	Accuracy	Precision	Recall	F1 Score	ROC-AUC
Original representation	489	99.12%	99.20%	99.05%	99.12%	99.12%
RF feature selection	30	99.23%	99.34%	99.10%	99.22%	99.23%
RF + Chi-Square	20	99.30%	99.41%	99.18%	99.29%	99.30%
RF + Chi-Square + Correlation	16	99.36%	99.47%	99.25%	99.35%	99.36%
RF + Chi-Square + Correlation + L1	13	99.41%	99.52%	99.30%	99.40%	99.41%

presents the classification performance obtained at each stage. The results show that the progressive reduction in feature dimensionality is accompanied by a consistent improvement in overall classification performance. The original 489-feature representation achieves 99.12% accuracy, while RF feature selection reduces the representation to 30 features and increases accuracy to 99.23%. Applying Chi-Square SelectKBest further reduces the representation to 20 features and increases accuracy to 99.30%. Correlation filtering subsequently reduces the representation to 16 features, with accuracy increasing to 99.36%. Finally, L1 regularisation produces the compact 13-feature representation used by HFS-SVE and achieves the highest performance, with 99.41% accuracy, 99.52% precision, 99.30% recall, 99.40% F1-score, and 99.41% ROC-AUC.

The results provide empirical evidence for the sequential design of the proposed feature-selection pipeline. RF provides the initial model-based reduction from 489 to 30 features while slightly improving all evaluated performance measures. The subsequent Chi-Square stage further removes statistically less relevant attributes and reduces the representation to 20 features. Correlation filtering then removes highly redundant characteristics, reducing the feature set to 16 while maintaining the upward performance trend. Finally, L1 regularisation provides the final sparse refinement to 13 features and produces the best overall classification results. The complete feature-selection process reduces the original representation by approximately 97.3%, from 489 to 13 features, while improving accuracy from 99.12% to 99.41% and F1-score from 99.12% to 99.40%. This indicates that the reduction in dimensionality does not compromise classification effectiveness and is associated with a modest improvement in detection performance. More importantly, the ablation results show that the four stages provide complementary functions: RF identifies predictive attributes, Chi-Square evaluates statistical relevance, correlation filtering addresses redundancy, and L1 regularisation performs sparse refinement. Therefore, the final 13-feature representation is retained not simply because it is smaller but also because it provides the most favourable combination of compactness and predictive performance among the evaluated configurations.

5.6.2. Ablation of Ensemble Members

A second ablation experiment was conducted to determine the individual and combined contribution of the three classifiers used in HFS-SVE. All classifiers were trained using the same final 13-feature representation to ensure that differences in performance arise from the classification architecture rather than from differences in the selected feature subsets. Individual classifiers, all possible two-classifier combinations, and the complete three-classifier soft-voting configuration were evaluated using the same metrics.

As shown in

Table 11. Ablation of the individual classifiers

Classification Configuration	No. of Features	Accuracy	Precision	Recall	F1 Score	ROC-AUC
RF	13	99.18	99.27	99.08	99.17	99.18
XGBoost	13	99.25	99.34	99.14	99.24	99.25
LightGBM	13	99.29	99.37	99.19	99.28	99.27
RF + XGBoost	13	99.32	99.45	99.23	99.33	99.34
RF + LightGBM	13	99.36	99.47	99.25	99.35	99.36
XGBoost + LightGBM	13	99.38	99.49	99.27	99.37	99.38
RF + XGBoost + LightGBM (HFS-SVE)	13	99.41	99.52	99.30	99.40	99.41

, the individual-classifier results show that all three ensemble members provide strong performance using the same 13-feature representation, with accuracy ranging from 99.18% for RF to 99.29% for LightGBM. The pairwise configurations consistently outperform the corresponding individual classifiers, indicating that combining classifier outputs provides additional predictive benefit. Among the pairwise configurations, XGBoost + LightGBM achieves the highest performance, with 99.38% accuracy and 99.37% F1-score. The complete RF + XGBoost + LightGBM configuration provides the strongest results across all evaluated metrics, achieving 99.41% accuracy, 99.52% precision, 99.30% recall, 99.40% F1-score, and 99.41% ROC-AUC. Compared with the strongest individual classifier, LightGBM, the complete ensemble improves accuracy from 99.29% to 99.41% and F1-score from 99.28% to 99.40%. It also provides a consistent improvement over all pairwise configurations, demonstrating that the inclusion of all three classifiers contributes additional predictive information. These findings indicate that the performance of HFS-SVE is not attributable to a single dominant classifier. Instead, the results support the complementary contribution of the three heterogeneous learners through probability-level soft voting. RF employs a bagging-based ensemble strategy, whereas XGBoost and LightGBM use gradient-boosting approaches with different optimisation and tree-construction mechanisms. Combining their probability outputs therefore provides a mechanism for exploiting differences in their predictions while reducing reliance on the decision behaviour of any single classifier.

Overall, the ablation analysis provides empirical support for both major components of HFS-SVE. The feature-selection ablation demonstrates that the sequential integration of model-based importance, statistical relevance, redundancy reduction, and sparse regularisation progressively produces a compact 13-feature representation while maintaining and improving classification performance. The ensemble ablation further demonstrates that combining RF, XGBoost, and LightGBM through soft voting provides the highest performance among the evaluated configurations. Therefore, the complete HFS-SVE framework achieves a favourable balance between substantial feature-space reduction and high malware-detection performance, supporting the contribution of the integrated framework rather than attributing the results to any single component.

6. Discussion

The experimental findings provide evidence that the proposed HFS-SVE framework can achieve a strong balance between feature-space compactness, classification performance, and detection efficiency for Android malware detection. The key finding is that the proposed HFS-SVE framework substantially reduces the original feature representation while retaining strong predictive capability. The feature space is reduced from 489 reported attributes to a compact set of 13 selected features, representing approximately 97.3% dimensionality reduction. Despite this substantial reduction, the proposed HFS-SVE achieves 99.41% accuracy, 99.52% precision, 99.30% recall, 99.40% F1-score, and 99.41% ROC-AUC on the KronoDroid dataset. This indicates that extensive dimensionality reduction does not necessarily result in a proportional loss of discriminative information. The composition of the selected representation is also important. The final feature set combines static permissions and application characteristics with dynamic behavioural attributes, supporting the rationale for using a hybrid feature-selection strategy rather than relying on a single feature type.

The four-stage HFS pipeline addresses different aspects of feature-space complexity: RF provides an initial predictive screening, SelectKBest identifies statistically relevant attributes, correlation analysis reduces redundancy, and L1 regularisation produces a sparse final representation. The resulting compact representation provides both dimensionality reduction and a more manageable basis for the subsequent ensemble classifier. The classification results further support the effectiveness of combining this compact representation with the proposed HFS-SVE, achieving the highest accuracy among the evaluated conventional classifiers on KronoDroid, exceeding KNN, the strongest conventional baseline. It also achieves the highest precision, F1-score, and ROC-AUC.

The computational and cross-dataset findings provide further evidence of the practical strength and consistency of the proposed approach. Although the absolute improvement over some strong individual classifiers is relatively small, the key advantage of HFS-SVE is its ability to combine extreme dimensionality reduction with consistently high predictive performance, rather than relying solely on marginal accuracy gains. Its detection time of 0.001947 is also lower than the evaluated Chi-Squared, correlation analysis, Information Gain, PCA, and LASSO alternatives, indicating favourable detection efficiency under the experimental configuration. More importantly, this strong performance is maintained across independent datasets, with HFS-SVE achieving 99% accuracy on Malgenome, 99.30% on TUANDROMD, and 98.10% on Drebin. Thus, accuracy remains above 98% across all evaluated datasets, demonstrating that the proposed framework is not narrowly dependent on KronoDroid. Although Drebin produces comparatively lower recall of 96.68%, its overall performance remains high, including 98.31% precision and 97.90% ROC-AUC. These results demonstrate that HFS-SVE provides a highly compact representation while maintaining high, balanced, and consistent classification performance across diverse Android malware datasets, supporting its robustness and promising transferability.

Table 12. Comparison of HFS-SVE with existing Android malware detection approaches.

Study	Datasets	Approach	Accuracy	Precision	F1-Score
Chaudhuri et al. [51]	KronoDroid	Dynamic Weighted Federated Averaging	96.83%	–	96.80%
Wichitaksorn et al. [53]	TUANDROMD	Logistic Regression + Random Subspace Regression	98.43%	–	–
Aurangzeb and Aleem [52]	KronoDroid	XGBoost + Random Forest	95.80%	95%	95%
Proposed HFS-SVE	KronoDroid	HFS + RF/XGBoost/LightGBM soft voting	99.41%	99.52%	99.40%

compares the proposed HFS-SVE with representative Android malware detection approaches evaluated on the same or related publicly available datasets. On KronoDroid, HFS-SVE achieves 99.41% accuracy, 99.52% precision, and 99.40% F1-score, compared with the 96.83% accuracy and 96.80% F1-score reported by Chaudhuri et al. [51] and the 95.80% accuracy, 95.00% precision, and 95.00% F1-score reported by Aurangzeb and Aleem [52]. These comparisons indicate that HFS-SVE reports higher performance than the studies included in Table 12 under their respective evaluation settings; however, they should not be interpreted as evidence of universal superiority because the studies may differ in dataset versions, feature representations, preprocessing procedures, data partitions, and experimental protocols. In particular, the numerical differences should be interpreted as indicative comparative evidence rather than as a controlled head-to-head comparison unless the underlying experimental conditions are directly matched. HFS-SVE also achieves this reported performance using a substantially more compact representation, reducing the original KronoDroid feature space from 489 features to 13 features. Thus, the comparison supports the effectiveness of HFS-SVE within the experimental conditions evaluated in this study while avoiding broader claims of superiority over all existing Android malware detection approaches.

The comparison also highlights the complementary nature of the proposed framework. Existing approaches in Table 12 employ individual ensemble, federated, or regression-based classification strategies, whereas HFS-SVE integrates sequential hybrid feature selection with three diverse tree-based classifiers through soft voting. The hybrid selection process reduces redundant and weakly informative attributes before classification, while the ensemble combines the probability outputs of RF, XGBoost, and LightGBM to exploit their complementary decision characteristics. These components enable HFS-SVE to achieve high accuracy, precision, and F1-score while retaining only a small proportion of the original feature space. The computational evaluation further shows that the proposed HFS requires 0.001947 s per malware instance, lower than the alternative feature-selection strategies evaluated in this study, supporting the objective of obtaining a compact and computationally efficient detection representation.

The literature comparison should be interpreted in the context of the experimental settings of the respective studies. Differences in dataset versions, feature representations, preprocessing procedures, train/test partitions, hyperparameter optimisation, and evaluation protocols can influence reported performance. Accordingly, numerical comparisons in Table 12 are not intended to constitute strictly controlled head-to-head evaluations unless the same dataset configuration, feature space, data partition, and evaluation protocol are used. Claims of higher performance are therefore limited to the results reported under the corresponding experimental settings. The comparison provides contextual evidence that HFS-SVE achieves strong performance relative to the representative approaches included in Table 12, rather than establishing universal superiority over existing Android malware detection methods.

Several research directions can further extend the evaluation of HFS-SVE. First, evaluation using temporally separated datasets and previously unseen malware families would examine its performance under evolving malware distributions. Second, strict source-to-target cross-dataset experiments, in which the complete feature-selection and classification pipeline is learned from a source dataset and applied unchanged to an independent target dataset, would provide a stronger assessment of transferability. Third, component-level ablation experiments will quantify the individual contribution of each HFS stage and each ensemble member. Finally, future evaluation will consider complete end-to-end detection latency, including feature extraction and preprocessing, as well as comparisons with contemporary deep-learning and graph-based approaches.

7. Conclusions

This paper proposed the HFS-SVE framework for Android malware detection. The framework addresses two related challenges: the high dimensionality and redundancy of Android malware feature spaces and the potential limitations of relying on a single classification model. The proposed HFS pipeline sequentially combines RF feature importance, Chi-square-based SelectKBest, correlation filtering, and L1 regularisation, reducing the reported 489-feature representation to 13 selected features. These features are subsequently classified using RF, XGBoost, and LightGBM through soft voting. Experimental results on KronoDroid demonstrate that HFS-SVE achieves 99.41% accuracy, 99.52% precision, 99.30% recall, 99.40% F1-score, and 99.41% ROC-AUC while using substantially fewer features than the original representation. The computational results also indicate lower reported classification time than the alternative feature-selection strategies considered. Evaluation across Malgenome, TUANDROMD, and Drebin further shows that HFS-SVE maintains accuracy above 98%, although the observed variation in recall confirms that dataset characteristics remain an important factor in malware detection performance. Overall, the findings demonstrate that HFS-SVE can achieve strong classification performance with a substantially more compact feature representation under the evaluation conditions considered. However, the current results should not be interpreted as establishing robustness to temporal drift, strict cross-dataset transferability, or generalisation to unseen malware distributions. Future work will therefore investigate strict source-to-target cross-dataset validation, temporally separated evaluation, feature-provenance effects, and more rigorous component-level ablation studies. These evaluations will provide stronger evidence regarding the robustness, generalisation, and practical applicability of HFS-SVE in evolving Android malware environments.