Hybrid Intelligent Detection Approach for Android Malware Using Gradient-Boosting Tree Ensembles and Correlation–Differential Evolution Feature Selection

Abstract

The rapid rise in Android applications has fueled a significant surge in the creation and distribution of malicious apps by cybercriminals. Numerous tools and applications are utilized to detect Android malware apps. However, they cannot effectively detect the latest or zero-day Android malware apps because these tools rely on conventional signature-based approaches. Therefore, more advanced intelligent techniques are investigated to overcome the inherent limitations of the traditional signature-based detection techniques. Nevertheless, the use of intelligent machine learning techniques with a large number of features is resource-intensive and time-consuming in resource-constrained mobile environments. This paper proposes a novel hybrid intelligent approach for Android malware detection that integrates a two-stage Correlation–Differential Evolution-based feature selection (Corr-DE) with gradient-boosting tree ensembles, including LightGBM and XGBoost. In the first stage, a correlation-based filter is employed to reduce feature redundancy by selecting the top 30% of most relevant static and dynamic features. In the second stage, Differential Evolution is utilized to identify an optimal subset of discriminative features, thereby enhancing detection performance. Accordingly, LightGBM and XGBoost are trained effectively using the optimal features and then employed to maximize the detection performance of Android malware apps. The experimental results demonstrate that both LightGBM and XGBoost with Corr-DE feature selection achieved high levels of Android malware detection, with overall accuracy of 95.78% and 95.51%, respectively, while the LightGBM and XGBoost with Corr-DE contributed to reducing the feature space substantially by 83% (reducing the feature space from 420 to 72 features).

1. Introduction

The explosive growth in Android applications has unfortunately coincided with a significant rise in Android malware applications that are orchestrated by cybercriminals and malicious developers. According to a Kaspersky report [1], mobile devices were targeted in 2024 by an average of 2.8 million monthly incidents involving potentially unwanted software, adware, and malware, resulting in a cumulative total of 33.3 million attacks discovered by Kaspersky’s security solutions over the year 2024. In September 2025, Kaspersky reported that attacks on Android smartphone users in the first half of 2025 rose by 29% relative to the first half of 2024 and by 48% relative to the second half of 2024 [2].

Since Android app developers frequently have no restrictions, they can create malware apps and then distribute them in third-party Android markets. Furthermore, certain Android malware applications may not be reliably identified even in the trusted markets like the official Google Play Store, particularly when newly created malware applications are first released on the Google Android Market [3,4].

Traditionally, numerous commercial malware detection tools have relied on signature-based techniques, which identify threats using predefined patterns or signatures of Android malware apps. While these tools are effective against known Android malware apps, these approaches struggle to detect new or evolving threats, particularly zero-day Android malware apps. In response, numerous machine learning algorithms have been explored for detecting new malware on Android devices [5].

Various machine learning algorithms have been successfully trained using some features of known Android malware apps and then used effectively for identifying new and recent Android malware apps. However, since most of the current works [6,7,8] emphasize static features analysis of Android malware apps, they have difficulty identifying malware that uses obfuscation techniques or demonstrates harmful actions only while running [5]. Furthermore, the utilization of machine learning techniques with an extensive number of features is resource-intensive, so it is inappropriate and time-consuming in resource-constrained mobile environments [5,6,7,8,9].

Based on feature analysis, the existing approaches in Android malware detection are categorized into three main categories: static, dynamic, and hybrid. Static analysis techniques examine Android applications without executing the code by reverse-engineering their code to extract features such as API calls, permissions, and opcodes. Although these methods are efficient, they are limited in their ability to detect advanced evasion techniques such as code obfuscation, dynamic code loading, and the use of packers [5]. In contrast, dynamic analysis methods evaluate applications by executing them in controlled runtime environments in order to enable the extraction of behavioral features such as network traffic patterns, system events and actions, API call sequences, and intent invocations observed during execution. The dynamic features are obtained through sandbox-based dynamic analysis using tools such as DynaLog [10], which automate the execution of applications in an instrumented environment while monitoring their interactions with the operating system. The dynamic approaches are more effective in handling sophisticated evasion techniques, including code obfuscation, compression, and dynamic code loading. However, dynamic analysis has several limitations, such as high computational cost, time-consuming execution, and limited code coverage, as only executed paths are observed. Additionally, advanced malware may evade detection by recognizing sandbox environments and modifying its behavior. To overcome these challenges, this study adopts a hybrid analysis approach that combines static and dynamic features. This integration leverages the efficiency and broad coverage of static analysis with the behavioral insights of dynamic analysis to produce more effective and robust malware detection

Android applications have a wide range of different static and dynamic features, and some features are more useful and important features since they have considerable effects on detecting Android malware from benign apps. In the literature, many researchers [11,12,13] have widely employed filter feature selection methods in Android malware detection, such as the Information Gain Ratio, Chi-Square, Information Gain, and Fisher Score. Filter methods are fast and scalable for high-dimensional Android datasets, but they evaluate each feature independently of any classifier. Thus, machine learning models based on features selected by filter methods usually do not produce accurate malware detection.

To yield better detection accuracy, metaheuristic optimization algorithms have been employed as a wrapper approach based on a specific classifier to choose the best feature set that can contribute to recognizing Android malware applications. In recent years, an optimal feature set of Android applications has been selected using several metaheuristic optimization algorithms as a wrapper feature selection approach, such as genetic algorithm (GA) [9,14,15,16], Genetic Algorithm and Simulated Annealing (GASA) [17], Particle Swarm Optimization (PSO) [18,19,20], Artificial Jellyfish Search (JS) [21], Bald Eagle Search (BES) and Sailfish Optimization (SFO) [22], Cuckoo Search Optimization (CSO), Ant Lion Optimization (ALO), and Firefly Optimization (FO) [23]. Machine learning models based on features selected by wrapper-based metaheuristic algorithms achieved more accurate malware detection. However, the employment of wrapper-based metaheuristic algorithms with a substantial number of features can be time-consuming and resource-intensive. Furthermore, most of the current works emphasize static feature analysis of Android malware apps. Therefore, they have difficulty identifying malware that uses obfuscation techniques or demonstrates harmful actions only while running.

In this paper, I suggest a hybrid, efficient, and scalable Android malware detection approach using gradient-boosting tree ensembles with features selected based on a two-stage hybrid Correlation–Differential Evolution feature selection (Corr-DE). The proposed two-stage hybrid feature selection approach aimed at identifying the most effective dynamic and static features to enhance the performance of Android malware detection. Initially, all dynamic and static features of Android apps are ranked by the correlation filter method. To reduce the amount of static and dynamic characteristics, I eliminate the irrelevant and redundant features, while only the top-ranked static and dynamic features of Android apps are selected to contribute to distinguishing malware from benign apps. In the second stage, Differential Evolution (DE) is used to exclusively choose the most powerful features to further increase malware detection. DE is utilized in this paper since DE is often more efficient and robust than other competitive optimization algorithms. Eventually, the optimal static and dynamic features chosen by the proposed hybrid two-stage feature selection are utilized to effectively train XGBoost and LightGBM to maximize the detection performance of Android malware apps.

The novelty of this work lies in the hybrid two-stage integration of correlation-based filtering with DE for feature selection. Unlike existing metaheuristic-based feature selection approaches that directly operate in high-dimensional feature spaces, the proposed Corr-DE approach first reduces redundancy using a correlation filter, thereby significantly decreasing the search space for the optimization stage. This approach not only improves computational efficiency but also enhances the quality of the selected features by enabling DE to focus on more informative subsets. As a result, the proposed approach effectively addresses the high computational overhead commonly associated with metaheuristic feature selection methods. The proposed approach further leverages a hybrid representation of static and dynamic features to capture both structural and behavioral characteristics of applications in order to become more effective and robust against advanced evasion techniques. The selected features are then evaluated using state-of-the-art classifiers, namely LightGBM and XGBoost, demonstrating improved and balanced detection performance with a significantly reduced number of features. The key contributions presented in my paper are summarized as follows:

• Developing a novel hybrid intelligent approach for detecting malware on Android devices using Corr-DE feature selection and XGBoost and LightGBM. To the best of my knowledge, this paper is among the few works that combine a two-stage Corr-DE feature selection strategy with both XGBoost and LightGBM for Android malware detection.
• Enhancing malware detection results of machine learning using a two-stage hybrid Corr-DE feature selection approach suggested to recognize the key static and dynamic characteristics of Android apps.
• Based on the best static and dynamic features identified by the proposed Corr-DE feature selection, I develop efficient and scalable Android malware detection models based on XGBoost and LightGBM, which are two powerful gradient-boosting tree ensembles.
• The proposed hybrid intelligent approach achieved both high accuracy and substantial dimensionality reduction in Android malware detection. LightGBM with Corr-DE feature selection achieved 95.78% accuracy, and XGBoost with Corr-DE feature selection achieved 95.51%, while both LightGBM and XGBoost with Corr-DE feature selection reduced the feature space by 83% (reducing the feature space from 420 to 72 features).
• The proposed hybrid intelligent approach reduced the computational overhead in metaheuristic feature selection methods. The key limitation of metaheuristic feature selection methods is their high computational cost when applied to large feature sets. The proposed pre-filtering stage significantly reduces the dimensionality of the search space, thereby lowering computational complexity and improving convergence speed. This makes the approach more scalable for real-world Android malware datasets.

The next sections of this paper are organized as follows. Section 2 reviews related works of the metaheuristic optimization algorithms used for Android malware detection. Section 3 presents the methodology of the proposed hybrid Android malware detection approach based on gradient-boosting tree ensembles and Corr-DE feature selection. Section 4 and Section 5 report and discuss the experimental results of the proposed approach. Section 6 summarizes the paper and discusses future directions.

2. Related Work

Metaheuristic feature selection methods used in Android malware detection can be categorized into evolutionary-based feature selection, swarm intelligence-based feature selection, and hybrid metaheuristic-based feature selection. Evolutionary-based algorithms, such as Differential Evolution (DE) and genetic algorithms (GAs), emphasize global exploration through mutation, crossover, and recombination strategies to search for optimal feature subsets. In contrast, swarm intelligence-based methods, including Particle Swarm Optimization (PSO), Grey Wolf Optimizer (GWO), and Artificial Jellyfish Search (JS), rely on collective behavioral mechanisms and social interactions to balance exploration and exploitation during the optimization process. More recently, hybrid optimization approaches have emerged to overcome the limitations of individual metaheuristic algorithms by integrating complementary search strategies.

• Evolutionary-Based Feature Selection

Lee et al. [9] used a genetic algorithm (GA) to find the optimum API calls and permissions features in the detection of Android malware. Unlike other works, they used GA as a filter feature selection method that is based on the correlation among features as well as the correlation between features and class labels. Then, some common machine learning techniques were trained based on the optimal features selected by GA to identify malware on Android devices. They proved that machine learning after applying GA-based feature selection achieved better results compared to their performance using information gain. However, they demonstrated that the detection accuracy produced by machine learning models after considering GA as feature selection was reduced by less than 3% compared to their performance with all features.

Firdaus et al. [16] suggested using GA as a wrapper feature selection method to identify the best static attributes for Android malware detection. Then, NB, MLP, J48, FT, and RF were employed to evaluate the features selected by GA. Since this work employed only static feature analysis, this approach may fail to identify malware apps that employ obfuscation methods or show harmful actions only during execution time. Furthermore, in this work, GA employed for feature selection may be resource-intensive when applied to a high number of features.

GA as a wrapper feature selection method was also proposed by Fatima et al. [15] to select the optimal static features of permissions and App components. To evaluate their proposed method, the features selected by GA were utilized by SVM and ANN to assess Android malware detection. Although the GA-based feature selection proposed by Fatima et al. [15] reduced the static features used in the training of the SVM and ANN classifiers, the classification accuracy was not improved and still maintained at the same level as the performance with all features. Furthermore, GA-based feature selection can be computationally intensive, especially when dealing with large feature sets.

In a similar way, the authors of [14] investigated the application of feature selection based on GA for detecting Android malware. They [14] improved the detection results of Android malware by selecting the most pertinent permissions characteristics using wrapper-based GA. This approach demonstrated promising results in Android malware detection. However, since this approach utilized only static feature analysis, it could be vulnerable to evasion methods such as code obfuscation or dynamic code loading used by advanced malware applications.

An enhanced version of the genetic algorithm called the self-variant genetic algorithm (SV-GA) was introduced by Wang et al. [8] to select the best permission characteristics in Android malware detection. In SV-GA [8], the genetic parameters were dynamically adapted during the selection process to produce better performance. Then, Random Forest was trained based on the best permission attributes chosen by SV-GA to detect the Android malware applications. The self-variant adaptation in SV-GA [8] may further increase the complexity of GA when dealing with large feature sets. Thus, SV-GA [8] is not suitable for real implementation in the resource-constrained mobile environment. In addition, it may fail to identify malware that uses obfuscation techniques since only the static analysis of permissions was utilized in the SV-GA.

• Swarm Intelligence-Based Feature Selection

Mohamad Arif et al. [18] suggested use of PSO, evolutionary computation, and information gain to obtain the most significant static permission characteristics. Then, KNN, MLP, Adaboost, RF, and J48 were trained based on the optimal static permission features to identify malware on Android devices. Similarly to other works that focused only on static analysis, this approach might not be able to identify malware apps that use obfuscation techniques or only behave maliciously during runtime.

In the work suggested by Emad T. Elkabbash et al. [21], Artificial Jellyfish Search (JS) was used as a wrapper technique to select the static and dynamic attributes extracted from Android applications. Furthermore, the classification performance was enhanced by a random vector functional link (RVFL) network with optimizing hyperparameters using Artificial Jellyfish Search. Although this method reached a remarkable accuracy of 98.41%, incorporating the JS optimizer as a wrapper feature selection technique with the RVFL network might result in extra computational overhead, which could be taken into account in the resource-constrained mobile environment.

Hossain et al. [20] introduced an approach for detecting Android ransomware that employed PSO to identify the most significant traffic features. Then, DT and RF were trained using the selected traffic features to enhance the detection accuracy of ransomware. Although this proposed approach contributed effectively to reducing the features, it produced a low ransomware detection accuracy of 81.58%.

Naick et al. [22] introduced a wrapper-based feature selection method aimed at enhancing malware detection using Bald Eagle Search (BES) and Sailfish Optimization (SFO) to identify the most useful API call characteristics. Several machine learning classifiers, including KNN, SVM, RF, DT, and LR, were used to assess the chosen features. Utilizing BES and SFO as wrapper-based feature selection techniques may incur supplementary computational overhead. This is potentially affecting the efficiency of the malware detection process, particularly on resource-limited devices. Furthermore, depending exclusively on static analysis of API calls may fail to identify malware apps that utilize obfuscation or demonstrate malicious behavior solely during runtime.

Santosh Jhansi et al. [23] employed three swarm optimization algorithms to identify the most useful API call features relevant to malware detection: Cuckoo Search Optimization (CSO), Ant Lion Optimization (ALO), and Firefly Optimization (FO). A hybrid Artificial Neuronal Classifier (ANC) was then trained using the optimal selected API call features for enhancing the detection accuracy of Android malware. In the resource-constrained mobile environment, the additional computational overhead that may arise from using swarm optimization methods as a wrapper feature selection approach with the hybrid ANC could be considered.

Albakri et al. [6] introduced a hybrid Android malware detection called RHSODL-AMD that integrated the Rock Hyrax Swarm Optimization (RHSO) used to recognize the most useful characteristics with Attention Recurrent Autoencoder (ARAE) optimized with the Adamax optimizer. RHSODL-AMD [6] attained an impressive accuracy rate between 96.2% and 98.57% in identifying Android malware. However, combining RHSO with deep learning may lead to considerable computational burdens. This intricacy could restrict the scalability of models and their use in real-time or in a resource-limited mobile environment. Furthermore, since RHSODL-AMD [6] employed only static analysis of API calls and permissions, it may be less successful against malware that uses complex obfuscation techniques or that only exhibits harmful behavior during runtime.

Recently, Banik and Singh [24] have suggested a BERT–PSO approach that integrated a transformer-based BERT architecture with PSO for feature selection using static permissions and API-call features. The BERT–PSO approach achieved accuracy between 96.27% and 97.87%, while reducing the feature space by approximately 50.26%. BERT–PSO highlighted the effectiveness of combining transformer-based architectures with metaheuristic optimization methods to improve Android malware detection performance and reduce feature redundancy. However, transformer-based models generally require higher computational resources and memory consumption compared with lightweight ensemble-learning approaches, which may affect deployment efficiency in resource-constrained environments.

• Hybrid Metaheuristic-Based Feature Selection

Bhattacharya et al. [19] introduced a hybrid approach called PSORS-FS that combined rough set and improved PSO to identify the best permission attributes to enhance the detection of Android malware. Accordingly, the optimal permission features were evaluated with popular machine learning techniques utilized to identify malware on Android devices. However, PSORS-FS can be affected by obfuscation strategies since it considers only static permission characteristics and ignores other dynamic characteristics. Furthermore, the computational cost of PSORS-FS can be high when handling large datasets with numerous permissions.

Akbar Meimandi et al. [17] suggested a wrapper feature selection approach called GASA that incorporates both GA and simulated annealing for selecting the optimal permission features in Android malware detection. Subsequently, SVM, DT, and KNN were used to evaluate features selected by the hybrid GASA. The GASA-SVM accomplished the highest accuracy among other methods. However, the hybridization of GA and simulated annealing (SA) for selecting features may require a lot of computational resources when applied to many features. Moreover, like the works that focused on static analysis, this approach might have difficulty in identifying malware applications that use obfuscation methods.

Hamoud et al. [25] suggested an intelligent Android malware detection approach in autonomous vehicles using PSO and adaptive GA (AGA). In [25], the best static and dynamic features were selected by PSO to give better Android malware detection results in the autonomous driving environments. Furthermore, XGBoost and random forest with optimizing their hyperparameters using AGA were employed to achieve a high level of accuracy and precision in malware detection within autonomous driving environments. Although this approach improved detection accuracy, the combination of PSO with AGA may result in a considerable computational burden. This might affect the viability of the model for use in real-time environments like autonomous vehicles with constrained processing capabilities.

Tarwireyi et al. [7] suggested applying several wrapper-based metaheuristic optimization algorithms to optimize the sonified features (static audio-based features). Then, LightGBM model was trained based on the selected features to enhance detection accuracy. This method introduced a novel approach to Android malware detection by combining sonification techniques with a metaheuristic optimization algorithm. However, significant processing complexity may be introduced by the conversion of Android application data into audio signals and the subsequent analysis of these using metaheuristic methods. This could make it more difficult to implement, particularly on devices with limited resources.

It can be noticed that a majority of the current studies utilized metaheuristic optimization algorithms as a wrapper feature selection approach to choose the optimal static features for identifying Android malware applications. Given that many of the current methods emphasize static analysis, they may struggle to detect malware that employs obfuscation methods or exhibits malicious behavior solely during execution. Furthermore, recent studies in adversarial machine learning have demonstrated that malware detection models are vulnerable to evasion attacks through the manipulation of static features [26,27]. Moreover, the utilization of wrapper-based metaheuristic algorithms with an extensive number of features may be resource-intensive, so it is inappropriate and time-consuming in resource-constrained mobile environments.

3. Proposed Methodology

This section explains the methodology of the proposed intelligent hybrid Android malware detection approach using gradient-boosting tree ensembles and Corr-DE feature selection. As illustrated in Figure 1, the proposed approach involves two essential phases: the training phase and the detection phase.

In the training phase, many static and dynamic features of Android applications are extracted and then prepared in numerical form to be suitable for training machine learning. The hybrid two-stage Corre-DE feature selection approach is used to rank and then select an optimal subset of Android app features. After feature selection, LightGBM and XGBoost models are trained effectively using the best features chosen by the two-stage Corre-DE feature selection approach.

In the detection phase, new Android apps are classified using the trained LightGBM and XGBoost based on the optimal features to evaluate the detection performance of Android malware apps. The LightGBM and XGBoost classifiers are evaluated based on the significant features of the testing dataset that were identified by the hybrid Corr-DE during the training phase. Then, the same feature extraction and encoding methods employed in the training phase are employed to transform all Android apps of the testing dataset. Next, they are transmitted to the LightGBM and XGBoost models that have been trained to generate classification decisions for each Android application.

3.1. Training Phase

3.1.1. Dataset Acquisition

In this paper, a DL-Droid dataset [12] is used to assess the proposed approach, which includes 31,124 Android applications. The DL-Droid dataset [12] was acquired by Intel Security (McAfee Labs). It consists of 19,618 legitimate applications and 11,506 malware applications. This dataset is chosen in this paper since it has many Android applications with various static and dynamic features. In addition, this dataset reflects a variety of Android malware families encountered in real-world environments such as paid apps, powerful utility apps, banking apps, media player apps, and popular game apps [12].

Table 1. Characteristics of the Android malware dataset used to assess the approach.

Characteristic	Description
No. of Android apps	31,124
No. of malware apps	11,506
No. of benign apps	19,618
No. of features	420
No. of permission features	300
No. of action/event features	23
No. of API calls and intents features	97

shows the main characteristics of the dataset used to evaluate the proposed approach.

3.1.2. Feature Extraction

In this step, 420 dynamic and static characteristics are retrieved from Android applications to aid in the efficient identification of Android malware. An automated platform is needed to run Android apps and extract their features. In the DL-Droid dataset [12], DynaLog [10] was applied as a dynamic analysis framework to extract the features. DynaLog is developed to accept and run a large number of Android apps automatically, launch them in sequence using either an emulator (an Android Virtual Device “AVD”) or a real phone, and log and extract several dynamic features (i.e., API calls, action/events) [12]. Particularly, 120 features (97 API calls and intents features, and 23 action/event features) were dynamically extracted after installing and then running Android applications on several phones or an emulator using DynaLog. In addition, DynaLog was extended to enable extracting Android permissions features statically prior to each dynamic run [12]. In particular, 300 permission features that control access to various system resources and device hardware were extracted from the examined Android apps to contribute toward detecting Android malware applications.

While static features are effective in capturing the structural characteristics of applications, they are often insufficient in the presence of code obfuscation, packing, or dynamic code loading. In contrast, dynamic features capture runtime behavior, including API call sequences, system events, and intent invocations observed during execution, which are less affected by such evasion techniques. In this work, both static and dynamic features are employed to address the limitations of the existing malware detection approaches based on only static features. Then, the proposed Corr-DE approach further enhances this capability by selecting the most informative features from both static and dynamic features. By eliminating redundant features and selecting discriminative features, the proposed Corr-DE ensures that behaviorally relevant dynamic features are preserved in the final subset. This enables the detection model to better identify malware that exhibits malicious behavior only at runtime, thereby improving robustness against obfuscated and zero-day threats.

3.1.3. Dataset Preparation

To properly build and train the hybrid proposed model, the dynamic and static characteristics of Android apps are transformed into numerical form in this step. Each training pattern of the dataset represents an Android app with numerous attributes, representing the extracted features of that Android app. The extracted features are then encoded with binary values, either 0 or 1 based on the absence or presence of the features in the Android apps. In addition, the last feature in the training pattern represents the class of the Android app, which is encoded with either 1 for a malware app or 0 for a benign app.

3.1.4. Hybrid Two-Stage Corr-DE Feature Selection

As mentioned earlier, the Android app dataset used in this paper includes 420 static and dynamic features such as permissions, API calls and intents, and action/event features. So, feature selection is a critical preprocessing step to remove redundant features or the features that are weakly related to the label of the Android app, either malware or a benign app. In this step, a two-stage hybrid Corr-DE feature selection approach is suggested to recognize the key static and dynamic features of Android apps in order to enhance the malware detection accuracy of machine learning. Initially, all dynamic and static features of Android apps are ranked by the correlation filter method. To reduce the amount of static and dynamic characteristics, I eliminate the irrelevant and redundant features, while only the top-ranked static and dynamic features of Android apps are selected to contribute to distinguishing malware from benign apps. In the second stage, Differential Evolution (DE) is used to choose exclusively the most powerful features to further increase malware detection. The rationale behind integrating the correlation filter method and DE in the feature selection step is explained as follows. Although the Pearson correlation is simple and computationally efficient, it does not automatically optimize for classifier performance and has a limited capacity to capture non-linear feature interactions. On the other hand, applying DE alone to high-dimensional feature space is computationally costly. In order to overcome these drawbacks, the proposed Corr-DE approach first uses the Pearson correlation to eliminate obviously redundant features. This reduces the search space to a manageable size before enabling DE to optimize the remaining candidate feature in a more effective manner.

• Correlation-Based Feature Reduction

The correlation filter method is a correlation-based filter feature selection technique that evaluates the usefulness of features by considering both their relevance to the target class and their redundancy with other features. In this paper, a Pearson correlation-based feature selection is employed as a filter method to reduce feature dimensionality and improve classification efficiency due to its simplicity, scalability, and interpretability in cybersecurity applications [28,29], which are particularly more feasible when handling resource-constrained mobile environments. Furthermore, since the features of Android applications are binary, the Pearson correlation provides an effective statistical measure for identifying features strongly associated with malicious or benign behavior.

Given a feature $x$ and the class label $y$, the Pearson correlation coefficient $r$ is computed as:

$$r={\displaystyle \frac{{\displaystyle {\sum }_{i=1}^n}(x_i-\stackrel{‐}{x}\left)\right(y_i-\stackrel{‐}{y})}{\sqrt{{\displaystyle {\sum }_{i=1}^n}(x_i-\stackrel{‐}{x}{)}^2{\displaystyle {\sum }_{i=1}^n}(y_i-\stackrel{‐}{y}{)}^2}}}$$

(1)

where $\stackrel{‐}{x}$ and $\stackrel{‐}{y}$ denote the mean values of the feature and the class label, respectively. The coefficient $r\in \left[-\mathrm{1,1}\right]$ quantifies the strength and direction of the linear association such that $r$ close to ±1 indicates a strong linear relationship, while $r$ close to 0 indicates weak or no linear correlation.

In this study, the Pearson correlation coefficients are computed between each extracted Android app feature and the target label (benign or malware). Features with higher absolute correlation values are considered more discriminative and retained for the subsequent stage. The top 30% of the best-ranked features are selected based on classification accuracy, while weakly correlated features are removed to ensure a balance between dimensionality reduction and information preservation.

• Differential Evolution-Based Feature Selection

At the previous stage, the Pearson correlation is used to rank and then reduce the dimensionality of Android app features. However, machine learning algorithms may not perform well by considering only the Android app features reduced by the Pearson correlation. This is due to the Pearson correlation used as a filter method to evaluate Android app features independently of a machine learning algorithm. Furthermore, the Pearson correlation assesses the features by recognizing the correlation between each individual feature of Android app and the class label, either benign or malware. Thus, Differential Evolution (DE) [30] is employed as a wrapper-based optimization technique for selecting an optimal subset of Android app features. I suggest a DE optimization algorithm in the second stage to evaluate feature subsets rather than individual features in isolation. This is important in Android malware detection since suspicious behavior often emerges from feature interactions (e.g., permission becoming more indicative when combined with certain API calls or intents). By searching globally across subsets, DE can identify compact combinations of Android features that can improve detection performance while reducing redundancy and computational cost.

DE [30] is one of the evolutionary algorithms developed for resolving global optimization problems over continuous spaces. Similarly to the genetic algorithm (GA), DE draws inspiration from the chromosomes that are evolving biologically in the natural world. DE offers several advantages [30,31,32,33] such as simplicity, robustness, and strong performance on complex and non-linear optimization problems. In addition, DE exhibits strong performance in convergence with only minimal parameter tuning. DE also maintains population diversity, which helps to avoid local optima and to support effective global search. As a result, it has been successfully applied in various fields and real applications [33,34,35,36]. These characteristics make DE particularly suitable for high-dimensional feature selection tasks, where the search space grows exponentially and contains numerous redundant and noisy features. In the context of Android adware detection, DE provides an effective balance between exploration and exploitation enabling the identification of informative feature subsets while reducing the likelihood of convergence to local optima. Furthermore, DE requires relatively low parameter tuning compared with many population-based optimizers making it computationally efficient for iterative optimization processes. To the best of my knowledge, the application of DE-based feature optimization in Android adware detection remains relatively underexplored in the existing literature.

Both GA and DE are popular evolutionary algorithms that can be used effectively in feature selection to recognize the most optimal attributes in order to enhance the classification performance in many applications. Like GA, DE works by generating an initial population of candidate solutions (called individuals) and then gradually improving them through three key processes: mutation, crossover, and selection. However, DE often outperforms standard GA because of faster convergence and fewer parameters since DE implements the mutation, crossover, and selection operations in different methods. Those differences can affect performance, speed, and robustness depending on the problem. The procedure of using DE in the feature selection process can be illustrated in Figure 2.

The DE used to select the optimal features is explained in the following steps:

(1) Population Initialization: DE starts by initializing a population of random candidate solutions (individuals) that represent the possible feature subsets. Each individual is a vector of real values in the range [0, 1]. These real values can be interpreted as probabilities of selecting features.

(2) Fitness Evaluations: To find the best individual (optimal feature subset) in the population, DE uses the fitness function to evaluate the individuals in the population. Because feature selection requires binary decisions, the probabilities are mapped to binary representation by applying thresholding (e.g., ≥0.5), where 1 means the feature is selected while 0 means the feature is excluded. Accordingly, the fitness of that individual is calculated by training LightGBM or XGBoost classifier based on the selected features of the corresponding individual and then computing the misclassification rate. During the generations, DE minimizes the fitness function in order to determine the most effective feature subset for achieving the most accurate detection results.

(3) Mutation: The mutation operation in DE is applied to each individual vector ${\mathrm{X}}_{\mathrm{i}}=\left({\mathrm{x}}_{\mathrm{i}1},{\mathrm{x}}_{\mathrm{i}2},{\mathrm{x}}_{\mathrm{i}3},\dots ,{\mathrm{x}}_{\mathrm{i}\mathrm{D}}\right)$ to yield a mutant individual ${\mathrm{V}}_{\mathrm{i}}=\left({\mathrm{v}}_{\mathrm{i}1},{\mathrm{v}}_{\mathrm{i}2},{\mathrm{v}}_{\mathrm{i}3},\dots ,{\mathrm{v}}_{\mathrm{i}\mathrm{D}}\right)$ where the Android feature space has D features. For each target individual ${\mathrm{X}}_{\mathrm{i}}$, three individuals ${\mathrm{X}}_{{\mathrm{r}}_1}$, ${\mathrm{X}}_{{\mathrm{r}}_2}$, ${\mathrm{X}}_{{\mathrm{r}}_3}$ are randomly selected from the population where $\mathrm{r}1\ne \mathrm{r}2\ne \mathrm{r}3\ne \mathrm{i}$. Then, DE can produce the mutant individual ${\mathrm{V}}_i$ using Equation (2).

$${\mathrm{V}}_{\mathrm{i}}={\mathrm{X}}_{{\mathrm{r}}_1}+\mathrm{F}\left({\mathrm{X}}_{{\mathrm{r}}_3}-{\mathrm{X}}_{{\mathrm{r}}_2}\right)$$

(2)

where F ∈ [0, 2] represents the mutation factor.

(4) Crossover: The crossover operation in DE is utilized to combine both the target individual ${\mathrm{X}}_{\mathrm{i}}$ and its mutant individual ${\mathrm{V}}_{\mathrm{i}}$ into a trial individual ${\mathrm{U}}_{\mathrm{i}}=\left\{{\mathrm{u}}_{\mathrm{i}1},{\mathrm{u}}_{\mathrm{i}2},{\mathrm{u}}_{\mathrm{i}3},\dots ,{\mathrm{u}}_{\mathrm{i}\mathrm{D}}\right\}$. The DE uses Equation (3) to generate the trial individual.

$${\mathrm{u}}_{\mathrm{i}\mathrm{d}}=\left\{\begin{array}{l}{\mathrm{v}}_{\mathrm{i}\mathrm{d}},\hspace{1em}\mathrm{if} \delta \le \mathrm{CR} \mathrm{or} \mathrm{d}={\mathrm{d}}_{\mathrm{r}\mathrm{a}\mathrm{n}\mathrm{d}}\\ {\mathrm{x}}_{\mathrm{i}\mathrm{d}},\hspace{1em}\mathrm{otherwise}\end{array}\right.$$

(3)

where CR ∈ [0, 1] denotes crossover rate, δ is a random number ∈ (0, 1), and ${\mathrm{d}}_{\mathrm{r}\mathrm{a}\mathrm{n}\mathrm{d}}$ represents index ∈ [1, D] that is arbitrarily chosen.

(5) Selection: In the selection operation, DE computes the fitness values of the trial individual ${\mathrm{U}}_{\mathrm{i}}$ and the target individual ${\mathrm{X}}_{\mathrm{i}}$. Then, the fitness of the trial individual ${\mathrm{U}}_{\mathrm{i}}$ is evaluated and compared with the target individual ${\mathrm{X}}_{\mathrm{i}}$. The trial individual ${\mathrm{U}}_{\mathrm{i}}$ replaces the target individual ${\mathrm{X}}_{\mathrm{i}}$ in the next generation if it yields a better fitness value.

This iterative procedure is repeated until a stopping criterion is satisfied (e.g., maximum generations or no improvement). Accordingly, DE extracts the optimized feature subset that yields the best performance for Android malware detection.

3.1.5. Training Gradient-Boosting Tree Ensembles

In the training step, the training data with only the best features (chosen by the proposed two-stage correlation-DE feature selection) is utilized to train two gradient-boosting tree ensembles: Light Gradient Boosting Machine (LightGBM) and eXtreme Gradient Boosting (XGBoost). LightGBM and XGBoost have become two of the most popular algorithms in machine learning due to their exceptional performance on structured and tabular data. In this paper, LightGBM and XGBoost are trained and utilized to detect Android malware apps, since they outperformed other classifiers for malware detection [7,37] and intrusion detection [38,39]. The selection of XGBoost and LightGBM is motivated by their strong performance on high-dimensional data, inherent ability to model non-linear relationships and built-in importance mechanisms, which align well with the objectives of the proposed Corr-DE feature selection strategy. Additionally, their complementary tree growth strategies (level-wise vs. leaf-wise) allow for a more robust evaluation of the proposed design across different boosting paradigms, while their regularization capabilities help mitigate overfitting.

The LightGBM is an advanced gradient-boosted decision tree framework developed by Microsoft in 2017 [40] that can learn an additive ensemble of trees by adding trees sequentially where each new tree corrects the errors of the previous one. LightGBM is selected for Android malware detection because it can produce outstanding accuracy on the high-dimensional and sparse feature representations typical of Android apps (e.g., permission, API calls and intent features) while remaining computationally efficient for large-scale app datasets. Unlike traditional level-wise algorithms, LightGBM utilizes a leaf-wise growth strategy to expand the leaf that yields the largest loss reduction in order to improve the classification accuracy. Furthermore, LightGBM can accelerate training on high-dimensional data by using histogram-based split finding, which discretizes continuous features into bins to reduce both computation and memory usage. To further improve the efficiency of learning, two techniques are employed by LightGBM: Exclusive Feature Bundling (EFB) and Gradient-based One-Side Sampling (GOSS). LightGBM utilizes GOSS to focus on training instances with larger gradients, while EFB is used in LightGBM to bundle mutually exclusive sparse features, which are particularly relevant for sparse binary representations common in Android analysis.

XGBoost is another optimized implementation of gradient-boosted decision trees that was introduced by Chen and Guestrin in 2016 [41]. Like LightGBM, in order to create an accurate classifier, XGBoost sequentially combines a large number of tiny decision trees, each of which fixes the errors of its predecessors. However, they differ fundamentally in their tree-building strategies and optimization focuses. XGBoost grows trees depth-wise (sometimes described as level-wise), which expands all nodes at the same depth before moving to the next level. This can provide better control over tree complexity, but can be slower for large datasets. The popularity of XGBoost stems from several practical advantages. XGBoost achieves exceptional predictive performance through sophisticated regularization mechanisms such as L1 and L2 penalties that help prevent the model from overfitting to training data. Furthermore, XGBoost is remarkably efficient computationally by leveraging parallel processing and intelligent memory management to train models faster than traditional implementations. In addition, XGBoost can handle missing values automatically without requiring data imputation.

3.2. Detection Phase

In the training phase, the LightGBM and XGBoost models are trained effectively using the best features chosen by the proposed two-stage hybrid Corr-DE. In the detection phase, the testing dataset, including new Android apps not used during training, is utilized to evaluate the LightGBM and XGBoost classifiers. Initially, only the significant features of the testing dataset that were identified by the hybrid Corr-DE during the training phase are used to assess the LightGBM and XGBoost classifiers. Then, all Android apps in the testing dataset are transformed using the same feature extraction and encoding used in the training phase. Subsequently, they are passed to the trained LightGBM and XGBoost models to output a malware probability for each Android app. Then, a decision threshold (commonly 0.5) is applied to convert probabilities into class labels, either 1 for a malware app or 0 for a benign app. Accordingly, classification accuracy values of the LightGBM and XGBoost classifiers are computed on the testing dataset to assess the proposed hybrid Android malware detection approach based on LightGBM classifier and Correlation-DE feature selection. To ensure reliable performance assessment, the proposed approach is evaluated using 5-fold cross-validation. Stratified 5-fold cross-validation was adopted in this paper to ensure that the class distribution is preserved across all folds, which is particularly important in malware detection. This approach also ensures that every sample contributes to both training and evaluation in order to maximize the use of available data while producing reliable generalization estimates. In addition to the classification accuracy, performance of the proposed approach is quantified using other common classification metrics derived from the confusion matrix, which counts four distinct outcomes: true positive (TP) (malware correctly detected), false positive (FP) (benign wrongly flagged as malware), true negative (TN) (benign correctly recognized) and false negative (FN) (malware misclassified as benign). I can describe the metrics used to evaluate the proposed approach as follows:

• Accuracy: It calculates the ratio of correctly classified Android apps (both malware and benign apps) to total Android apps.

$$Accuracy={\displaystyle \frac{TP+TN}{TP+FP+FN+TN}}$$

(4)

• Recall: It is also called the True Positive Rate (TPR) or Sensitivity, which measures the proportion of actual malware that the proposed model successfully caught.

$$Recall={\displaystyle \frac{TP}{TP+FN}}$$

(5)

• True Negative Rate (TNR): It is also called Specificity, which is used to measure how well the proposed model correctly identifies Android benign apps.

$$TNR={\displaystyle \frac{TN}{TN+FP}}$$

(6)

• Precision: It measures the proportion of Android apps flagged as malware that are actually malicious.

$$Precision={\displaystyle \frac{TP}{TP+FP}}$$

(7)

• F1-score: This measure is used to evaluate the balance between precision and recall by computing the harmonic mean of precision and recall.

$$F1-score={\displaystyle \frac{2\ast recall\times precision}{recall+precision}}$$

(8)

• ROC Curve and AUC: Receiver Operating Characteristic (ROC) is a graphical curve, which visualizes classifier performance by displaying the true positive rate versus the false positive rate at different decision thresholds. The Area Under the ROC Curve (AUC) summarizes this curve into a single threshold-independent measure as shown in Equation (9), such that a larger value is better performance.

$$AUC={\displaystyle \frac{1}{2}}\left({\displaystyle \frac{TP}{TP+FN}}+{\displaystyle \frac{TN}{TN+FP}}\right)$$

(9)

4. Experimental Results

4.1. Experimental Environment and Settings

In this study, all experiments were implemented using Windows 10 operating system, Hewlett-Packard (HP) Laptop, 11th Gen Intel(R) Core (TM) i7-1165G7 Processor, and 16 GB of RAM. To assess the proposed approach, various experiments were conducted in Python 3.9.13 using the Anaconda environment and Jupyter Notebook 6.4.12. Several Python libraries were employed to support the implementation such as Scikit-learn for preprocessing and model evaluation, NumPy for numerical operations, Pandas for data handling and manipulation, and Matplotlib 3.5.2 for visualization.

In the first stage of the proposed two-stage Corr-DE feature-selection, the Pearson correlation filter was applied in Python by computing the correlation between each attribute and the label. Subsequently, the features were ranked according to the absolute correlation values, and then only the top 30% most correlated features were retained. The threshold for retaining the top 30% of features was determined empirically through preliminary experiments by evaluating multiple retention ratios ranging from 10% to 50%. The selection process was based on classification accuracy. It was observed that lower retention ratios resulted in the removal of important discriminative features, leading to reduced accuracy, whereas higher retention ratios retained redundant features and increased computational overhead without noticeable performance improvement. Therefore, the 30% threshold was adopted in this study, since it provided an effective trade-off between dimensionality reduction and classification accuracy.

In the second stage of the proposed two-stage Corr-DE feature-selection, DE as a wrapper-based feature selection method was implemented in Python to recognize the most informative subset of features. The final features subset selected based on the proposed Corr-DE was subsequently used to train and evaluate both XGBoost and LightGBM for Android malware detection.

LightGBM and XGBoost were implemented in Python by importing LGBMClassifier and XGBClassifier from the lightgbm and xgboost packages, respectively. To systematically determine the optimal hyperparameter configurations, multiple preliminary experiments and iterative empirical tuning procedures were conducted for DE, LightGBM and XGBoost. Different combinations of key hyperparameters were evaluated including the population size, mutation constant, and the crossover rate for DE, as well as the learning rate, the number of estimators, maximum tree depth, and regularization parameters for LightGBM and XGBoost. The final hyperparameter settings were selected based on achieving the highest classification accuracy while maintaining stable and computationally efficient performance during five-fold cross-validation. Hyperparameter tuning was performed by a trial-and-error basis through iterative experimental evaluation rather than exhaustive grid search due to the high computational complexity associated with exhaustive parameter exploration for repeated feature optimization and ensemble classifier training.

Table 2. The best parameter values of DE, LightGBM, and XGBoost utilized in the proposed hybrid approach.

Model	Parameter Settings
DE	Crossover rate = 0.9, Mutation constant = 0.5, Population size = 70, No. of generations = 20
LightGBM	Number of boosted trees (n_estimators) = 600, Learning rate (learning_rate) = 0.2, Number of leaves (num_leaves) = 31, Maximum tree depth (max_depth) = −1 (no limit), Minimum child samples (min_child_samples) = 20, Fraction of training instances used for each tree (subsample) = 1.0, Fraction of features used for each tree (colsample_bytree) = 1.0, L1 regularization (reg_alpha) = 0, L2 regularization (reg_lambda) = 0
XGBoost	Number of boosted trees (n_estimators) = 600, Learning rate (learning_rate or eta) = 0.2, Maximum tree depth (max_depth) =6, Minimum child weight (min_child_weight) = 1, Fraction of training instances sampled per tree (subsample) = 1.0, Fraction of features sampled per tree (colsample_bytree) = 1.0, L1 regularization (reg_alpha (alpha)) = 0, L2 regularization (reg_lambda (lambda)) = 1, Minimum loss reduction required for a split (gamma) = 0

summarizes the final hyperparameter settings utilized for DE, LightGBM, and XGBoost in the proposed hybrid intelligent Android malware detection approach. To further improve reproducibility, the other unspecified hyperparameters retained their default parameter values. In addition, a fixed random seed (random_state = 1) was used during classifier training to ensure consistent and reproducible experimental results across repeated runs.

4.2. Performance of Proposed Hybrid Gradient-Boosting Tree Ensembles Based on Corr-DE Feature Selection Approach

This section presents the results of performance measures achieved by the proposed method. As can be seen in

Table 3. Performance of the proposed intelligent hybrid LightGBM and XGBoost with Corr-DE feature selection.

	LightGBM with Features Selected by Corr-DE	XGBoost with Features Selected by Corr-DE
Accuracy (%)	95.78	95.51
Recall (%)	92.14	91.34
TNR (%)	97.91	97.96
Precision (%)	96.27	96.32
F1-score (%)	94.16	93.77
AUC (%)	95.03	94.65
Features Used	72	72

, the proposed LightGBM and XGBoost models with only 72 features selected by Corr-DE demonstrate a high level of detection performance with overall accuracy of 95.78% and 95.51%, respectively.

From the confusion matrix shown in Figure 3, it can be observed that both LightGBM and XGBoost models with 72 features selected by the Corr-DE method have strong discrimination capability for both malware and benign classes. For the positive (malware) class, the proposed LightGBM and XGBoost models with 72 features selected by the Corr-DE method achieved 10,602 and 10,510 correct malware detections out of 11,506 malware apps to produce a superior recall or True Positive Rate of 92.14% and 91.34%, respectively. That means the proposed LightGBM and XGBoost models correctly detected 92.14% and 91.34% of the malware apps, respectively. This is particularly important because misclassifying positive cases (malware apps) can often be costly in real applications. For the negative (benign) class, the proposed LightGBM and XGBoost models with only 72 features selected by the Corr-DE method accomplished an outstanding True Negative Rate (TNR) of 97.91% and 97.96%, respectively, since the proposed LightGBM and XGBoost models correctly identified 19,208 and 19,217 benign apps of 19,618 benign apps, respectively. That indicates that both LightGBM and XGBoost models with only 72 features selected by the Corr-DE method correctly identified almost all benign apps and rarely raised false alarms.

In terms of precision, the proposed LightGBM and XGBoost models with only 72 features selected by the Corr-DE method achieved a high precision of 96.27% and 96.32%. This indicates that the majority of Android apps classified by the proposed method as malware apps are truly malware apps. Furthermore, the proposed LightGBM and XGBoost models with only 72 features selected by the Corr-DE method performed well in terms of F1-score (94.16%, 93.77%, respectively). This confirms a robust balance between recall and precision and suggests that the proposed models can manage the trade-off between false positives and false negatives effectively.

In terms of ROC, Figure 4 shows the ROC curve that illustrates an important visualization of the discriminatory ability of the model across different classification thresholds. As can be observed from Figure 4, the ROC curve rises sharply toward the upper-left corner for both the proposed LightGBM and XGBoost models with only 72 features selected by Corr-DE. That means that the proposed LightGBM and XGBoost models achieved a high True Positive Rate while maintaining a low False Positive Rate over a wide range of thresholds. This shape indicates that the proposed LightGBM and XGBoost models with only 72 features selected by Corr-DE were able to distinguish effectively between the positive and negative classes, which are particularly malware and benign classes in this paper, respectively. In terms of AUC, the proposed model achieved excellent overall discriminatory performance. The high AUC value (0.95) demonstrates that the proposed LightGBM and XGBoost models with only 72 features selected by Corr-DE correctly ranked positive instances above negative ones in most cases and maintained high True Positive Rate even at low False Positive Rates.

To further validate the robustness of the performance comparison, the Wilcoxon Signed-Rank test was employed to assess the statistical significance between LightGBM and XGBoost using only the 72 features selected by the Corr-DE method across 50 paired observations obtained from repeated five-fold cross-validation. This non-parametric test is particularly suitable in this context as it does not assume normality and accounts for the paired nature of the samples. The results show that LightGBM achieved a higher mean accuracy (95.76% ± 0.25%) with a 95% confidence interval of [95.69%, 95.83%] compared to XGBoost (95.39% ± 0.24%) and a 95% confidence interval of [95.33%, 95.46%]. The Wilcoxon test yielded a statistic of 3.0 with an extremely small p-value (p < 0.001). This indicates a statistically significant difference between the two models at the 0.05 significance level. This outcome demonstrates that the observed improvement of LightGBM over XGBoost is consistent across multiple folds and repetitions rather than being caused by random variation in the data splits. Furthermore, the consistency of the results is reflected in the low standard deviation values for both models, which suggests stable performance across repeated evaluations.

4.3. Performance Comparison of XGBoost with LightGBM Before and After Applying Proposed Corr-DE Feature Selection

The results reported in

Table 4. Performance comparison of XGBoost with LightGBM before and after applying the proposed Corr-DE feature selection.

		Accuracy (%)	Recall (%)	TNR (%)	Precision (%)	F1-Score (%)	AUC (%)	Features Used
All features	LightGBM	93.30	88.01	96.41	93.49	90.67	92.22	420
	XGBoost	94.11	88.94	97.15	94.82	91.78	93.04	420
Features selected by Corr	LightGBM	93.85	88.88	96.76	94.15	91.44	92.82	126
	XGBoost	94.28	89.34	97.18	94.89	92.03	93.26	126
Features selected by DE	LightGBM	94.68	90.18	97.30	95.15	92.60	93.74	241
	XGBoost	94.53	89.48	97.50	95.45	92.36	93.49	221
Features selected by Corr-DE	LightGBM	95.78	92.14	97.91	96.27	94.16	95.03	72
	XGBoost	95.51	91.34	97.96	96.32	93.77	94.65	72

reveal the comparative performance of the baseline LightGBM and XGBoost for Android malware detection and their performance after applying feature selection strategies. When examining the baseline models using all 420 features, both LightGBM and XGBoost demonstrate good performance, but XGBoost shows a slight edge across most metrics. This is due to the regularization and split-finding strategies of XGBoost. When the top 30% of the best-ranked features are selected by using the correlation filter method, the feature space is reduced from 420 to 126 features while performance is maintained or slightly improved for both LightGBM and XGBoost models. This indicates that a substantial portion of the original features are likely redundant features or weakly related to the class of the Android app, either a benign or malware app. Hence, removing these redundant features can reduce noise without sacrificing detection accuracy.

The results in Table 4 demonstrated that the DE-based feature selection approach also improved the classification performance of LightGBM and XGBoost compared to their performance using all features. LightGBM with DE-based feature selection approach achieved an accuracy of 94.68% using 241 features, while XGBoost achieved 94.53% accuracy using 221 features. In addition, both LightGBM and XGBoost classifiers with DE-based feature selection achieved higher recall, precision and F1-score values compared with the LightGBM and XGBoost models with all features. These findings demonstrate the capability of DE in searching for informative feature subsets that enhance classifier performance. However, the DE approach still retained a relatively large number of features compared with the proposed hybrid Corr-DE feature selection approach.

The most noticeable improvements were achieved by both LightGBM and XGBoost after applying the proposed hybrid Corr-DE feature selection, which delivered the best overall detection results using only 72 features (83% reduction from the original features). As can be observed from Table 4, both LightGBM and XGBoost models showed substantial performance gains with this optimized subset of 72 features. Compared with the performance accomplished with all features, LightGBM records gains of 2.48% in accuracy, 4.13% in recall, 2.78% in precision, 3.49% in F1-score and 2.81% in AUC. Similarly, XGBoost records gains of 1.4% in accuracy, 2.4% in recall, 1.5% in precision, 1.99% in F1-score, and 1.61% in AUC. Figure 5 shows ROC curves of LightGBM and XGBoost for Android malware detection before and after applying feature selection strategies. Significantly, these improvements were achieved while maintaining consistently high specificity (TNR ≥ 97.15%). This indicates that the increase in recall is not obtained at the expense of substantially higher false positive rates.

To further validate the reliability and stability of the observed performance improvements, an additional statistical significance analysis was conducted using 10 independent repetitions of five-fold cross-validation, resulting in 50 paired performance observations for both LightGBM and XGBoost before and after applying the proposed Corr-DE. The Wilcoxon signed-rank test was then applied to compare the LightGBM and XGBoost after applying the proposed Corr-DE against LightGBM and XGBoost with all features before applying the proposed Corr-DE. The LightGBM after applying the proposed Corr-DE feature selection approach achieved a mean accuracy of 95.76% ($\pm 0.25\%$) with a narrow 95% confidence interval of [95.69%, 95.83%], compared with a mean accuracy of 93.32% ($\pm 0.28\%$) and a 95% confidence interval of [93.25%, 93.40%] obtained using LightGBM with all features. Similarly, the XGBoost classifier after applying the proposed Corr-DE feature selection approach achieved a mean accuracy of 95.39% ($\pm 0.24\%$) with a 95% confidence interval of [95.33%, 95.46%] outperforming the baseline XGBoost model using all features, which achieved a mean accuracy of 94.04% ($\pm 0.24\%$) with a confidence interval of [93.98%, 94.11%]. The Wilcoxon signed-rank test produced highly significant p-values for both LightGBM and XGBoost ($p=1.78\times {10}^{-15}$), which are substantially lower than the significance level of 0.05, confirming that the observed improvements are highly statistically significant rather than resulting from random variation. Furthermore, the calculated effect sizes for both classifiers ($r=0.8703$) indicate a large practical effect, highlighting the substantial contribution of the proposed Corr-DE optimization approach to model performance, robustness, and generalization stability across both ensemble classifiers.

4.4. Impact of Proposed Corr-DE Feature Selection on Performance of Common Machine Learning

In this section, I discuss the impact of the proposed Corr-DE feature selection on popular machine learning classifiers used for Android malware detection.

As can be seen in

Table 5. Impact of the proposed Corr-DE feature selection on the performance of the common machine learning.

		Accuracy (%)	Recall (%)	TNR (%)	Precision (%)	F1-Score (%)	AUC (%)	Features Used
SVM	All features	79.43	48.81	97.39	91.63	63.69	93.2	420
	Correlation	78.6	47.24	97	90.22	62.01	92.3	126
	Corr-DE	94.4	88.97	97.58	95.57	92.15	93.27	70
NB	All features	50.75	98.52	22.73	42.79	59.66	25.5	420
	Correlation	81.44	62.47	92.56	83.12	71.33	89.5	126
	Corr-DE	85.24	75.98	90.68	82.7	79.2	83.33	65
DT	All features	85.9	74.73	92.44	85.29	79.66	85.2	420
	Correlation	88.09	77.18	94.49	89.15	82.73	87.9	126
	Corr-DE	94.21	90.23	96.54	93.87	92.02	93.39	70
RF	All features	83.87	58.77	98.6	96.09	72.93	94.5	420
	Correlation	88.33	72.35	97.7	94.86	82.09	95	126
	Corr-DE	94.42	90.30	96.83	94.35	92.28	93.56	67
kNN	All features	92.84	93.92	92.21	87.61	90.66	96.7	420
	Correlation	89.91	94.37	87.3	81.33	87.37	94.5	126
	Corr-DE	94.33	90.14	96.79	94.27	92.16	93.47	70
CNN	All features	94.06	89.02	97.01	94.58	91.72	93.015	420
	Correlation	93.17	87.88	96.27	93.25	90.49	92.08	126
	Corr-DE	94.72	89.84	97.58	95.61	92.63	93.71	68
LightGBM	All features	93.30	88.01	96.41	93.49	90.67	92.22	420
	Correlation	93.85	88.88	96.76	94.15	91.44	92.82	126
	Corr-DE	95.78	92.14	97.91	96.27	94.16	95.03	72
XGBoost	All features	94.11	88.94	97.15	94.82	91.78	93.04	420
	Correlation	94.28	89.34	97.18	94.89	92.03	93.26	126
	Corr-DE	95.51	91.34	97.96	96.32	93.77	94.65	72

, most of the common machine learning classifiers used with all 420 features did not produce good detection results since they were trained with many redundant and irrelevant features. After using the correlation filter method, although detection results of machine learning classifiers were enhanced, the improvement results were limited since the correlation filter only contributed to eliminating some redundant and irrelevant features. The results provided in Table 5 reveal that the proposed Corr-DE feature selection approach not only reduces the dimensionality of the feature space substantially, but it also contributes to outstandingly enhancing the malware detection performance of the common machine learning models.

The results in Table 5 demonstrate that the best detection results remain with gradient-boosted trees. Both LightGBM and XGBoost show incremental gains after applying the correlation filter method and achieve their best performance under the proposed Corr-DE feature selection. Based on only 72 features selected by Corr-DE, LightGBM achieves an accuracy of 95.78%, a recall of 92.14%, a precision of 96.27%, an F1-score of 94.16%, and an AUC of 95.03%. This represents a clear improvement over LightGBM with both all features (accuracy of 93.30%) and correlation method (accuracy of 93.85%) variants. Similarly, using only 72 features XGBoost with Corr-DE yields an accuracy of 95.51%, an F1-score of 93.77%, and an AUC of 94.65%. These findings confirm that Corr-DE is especially compatible with boosting algorithms because it filters out redundant and irrelevant features while retaining features that carry complementary information. This allows both LightGBM and XGBoost models to learn from clearer patterns in the data and limits the influence of high dimension.

For SVM, the clearest improvements appear in models that struggle with many features. In SVM with only 70 features selected by Corr-DE, accuracy jumps from 79.43% to 94.40%, and recall rises from 48.81% to 88.97%. In addition, the precision achieved by SVM with Corr-DE also increases from 91.63% to 95.57% while TNR stays very high (97.58%). For NB, the results in Table 5 illustrate that NB with all features shows extremely unstable performance (very high recall of 98.52% but very low TNR of 22.73%). After applying Corr-DE, NB becomes more balanced. This indicates that removing irrelevant and noisy features reduces feature redundancy and noise that may otherwise bias the NB classifier toward incorrect predictions.

For DT and RF, Corr-DE contributed effectively to producing consistent gains. DT reaches an accuracy of 94.21% with an F1-score of 92.02%, while RF with Corr-DE reaches an accuracy of 94.42% and improves from a low recall (58.77%) to a much stronger detector (recall 90.30% and F1-score 92.28%) while maintaining high TNR. For kNN, kNN using all features performed with higher recall (93.92%) and AUC (96.7%). This indicates strong sensitivity to detecting malicious samples. However, the relatively lower precision (87.61%) and TNR (92.21%) suggest the presence of redundant or noisy features, which may increase false positives. This behavior is expected in high-dimensional spaces since kNN is sensitive to noisy and irrelevant features due to its distance-based nature. After applying Corr-DE, the feature set is reduced from 420 to 70 features, which leads to improved precision (94.27%) and TNR (96.79%), reflecting better discrimination of benign samples. The slight decrease in recall (90.14%) and AUC (93.47%) indicates that some features contributing to detection sensitivity were removed. Overall, this demonstrates a trade-off where Corr-DE reduces noise and redundancy, resulting in a more robust and balanced performance.

For CNN, the results reported in Table 5 demonstrate the effectiveness of the proposed Corr-DE feature selection in improving classification performance while reducing feature dimensionality. Using all 420 features, the CNN model achieved 94.06% accuracy and 91.72% F1-score. After applying only correlation filtering, performance slightly decreased despite reducing the features to 126. In contrast, the proposed Corr-DE approach achieved the best performance with 94.72% accuracy, a 92.63% F1-score and 93.71% AUC using only 68 selected features. These results indicate that the hybrid Corr-DE approach effectively removed redundant features while preserving highly discriminative information for Android malware detection.

4.5. Analysis of Computational Time Complexity

In terms of computational complexity, the proposed two-stage Corr-DE feature-selection strategy can be analyzed as the sum of the Pearson correlation filter stage and the DE wrapper stage. In the first stage, the time complexity of the Pearson correlation is approximately $O\left(ND\right)$ since it computes correlation only between each feature and the target label, where $N$ is the number of samples and $D$ is the total number of original features. This step removes $F$ less relevant features and reduces the feature space to $\left(D−F\right)$. In the second stage, the time complexity of DE used is approximately $O(PG\cdot (D-F)\cdot C_{eval})$ to evaluate candidate subsets over $P$ individuals and $G$ generations in order to select the best features. $C_{eval}$ denotes the cost of training LightGBM or XGBoost model on the reduced feature space. The effect of Pearson filtering appears inside $C_{eval}$ since each candidate subset is evaluated using the reduced feature space $\left(D−F\right)$ rather than the original $D$ features. Thus, $O(ND+PG\cdot (D-F)\cdot C_{eval})$ is the approximated complexity of the proposed two-stage Corr-DE feature-selection. For Corr-DE with XGBoost or LightGBM, this can be expressed approximately as $O(ND+PG\cdot (D-F)\cdot T)$, where $T$ denotes the number of boosting trees. Thus, the overall complexity of the proposed approach can be approximated as $O(ND+PG\cdot (D-F)\cdot T)$.

4.6. Analysis of Inference Efficiency and Resource Consumption

To evaluate inference efficiency and resource consumption, some metrics were analyzed such as average inference latency, total batch prediction time, model size, peak memory usage during inference, and the number of features used. The average inference latency measures the mean time required by the model to generate a prediction for a single input sample. This reflects real-time responsiveness, where lower values indicate faster prediction. The total batch prediction time represents the overall time required to process the entire test dataset to provide an indication of computational efficiency under bulk inference. The model size refers to the storage footprint of the trained model on disk, where smaller sizes are more suitable for resource-constrained environments. The peak memory usage during inference captures the maximum RAM consumption during prediction, which indicates runtime resource requirements. Finally, the number of features used reflects the dimensionality of the input space after feature selection, where reduced feature sets typically contribute to lower computational cost and improved efficiency without compromising predictive performance.

The experimental results reported in

Table 6. Inference efficiency and resource consumption of the proposed approach.

	LightGBM with Features Selected by Corr-DE	XGBoost with Features Selected by Corr-DE
Average Inference Latency (ms/sample)	0.6554	3.0525
Total Batch Prediction Time (s)	0.1085	0.0982
Model Size (MB)	2.0235	1.6866
Peak Memory Usage During Inference (MB)	25.6483	0.4116
Features Used	72	72

indicate that the LightGBM model achieved an average inference latency of 0.6554 ms per sample, while XGBoost required 3.0525 ms per sample. This shows that LightGBM provided faster inference speed compared with XGBoost, so LightGBM is more suitable for latency-sensitive real-time detection scenarios. Nevertheless, LightGBM and XGBoost are suitable for practical cybersecurity applications since both models achieved relatively low inference times. For batch prediction performance, both LightGBM and XGBoost demonstrated efficient processing capability. The total batch prediction time achieved by LightGBM was 0.1085 s, while XGBoost achieved a slightly lower batch prediction time of 0.0982 s. These results indicate that both ensemble models can efficiently process large numbers of samples within a short execution time. The memory footprint analysis further highlights the lightweight nature of the proposed approach. The LightGBM model occupied approximately 2.02 MB of storage space while the XGBoost model required only 1.69 MB. Similarly, the peak memory usage during inference was approximately 25.65 MB for LightGBM and only 0.41 MB for XGBoost. These findings suggest that the XGBoost implementation achieved superior memory efficiency while both models maintained relatively compact storage requirements compared with more computationally intensive approaches. In addition, both LightGBM and XGBoost utilized only 72 selected features after applying the proposed Corr-DE feature selection framework. The substantial reduction from the original high-dimensional feature space contributed directly to lowering computational complexity, reducing memory requirements, and improving inference efficiency without sacrificing classification accuracy. Therefore, the reduced feature dimensionality played an important role in enhancing the practical deployment feasibility of the proposed detection framework.

4.7. Comparison of Proposed Approach Against Existing Metaheuristic Feature Selection Methods

In this section, I compare the results of the proposed XGBoost and LightGBM based on Corr-DE feature selection against some previous works that used metaheuristic optimization algorithms to choose the best feature set in order to enhance Android malware detection.

As shown in

Table 7. Comparison of accuracy and feature reduction in the proposed approach against the existing metaheuristic feature selection methods used in Android malware detection.

Reference	Features	Machine Learning	Feature Selection	Dataset	Accuracy (%)	Features Reduction (%)
Hossain et al. [20]	Traffic features analysis	DT and DF	PSO as wrapper	CICAndMal2017 dataset	81.58	Between 56.01 and 91.95
Wang et al. [8]	Permission-based static features	LR, RF, GNB, KNN	Self-Variant Genetic Algorithm (SV-GA) as wrapper	Android 88 permission-based dataset	94.1	46.8
Fatima et al. [15]	Static features: permissions and App components	SVM and ANN	GA as wrapper	Dataset of around 40,000 APKs	Between 94.1 and 95.0	Between 59.6 and 66.7
Firdaus et al. [16]	Static features: code-based features, Permission features, Directory path features and System command features	NB, functional trees (FT), J48, RF, and MLP	GA as wrapper	Drebin dataset	95.0	94.34
Mohamad Arif et al. [18]	Permissions features	RF, MLP, KNN, J48, and Adaboost	PSO, Information Gain, and evolutionary computation	Androzoo and Drebin datasets	91.59	92.7
Albakri et al. [6]	API calls and permissions	Attention Recurrent Autoencoder (ARAE)	Rock Hyrax Swarm Optimization (RHSO-FS) as wrapper	Andro-AutoPsy dataset	Between 96.2% and 98.57%	Not reported
Banik and Singh [24]	Static permissions and API calls	BERT	PSO	Drebin and AndroZoo	Between 96.27% and 97.87%	50.26%
Proposed XGBoost with Corr-DE	Static and dynamic features: permission, actions/events and API calls and intents features	XGBoost	Corr-DE feature selection	DL-Droid dataset	95.51	83 (reducing the feature space from 420 to 72 features)
Proposed LightGBM with Corr-DE	Static and dynamic features: permission, actions/events and API calls and intents features	LightGBM	Corr-DE feature selection	DL-Droid dataset	95.78	83 (reducing the feature space from 420 to 72 features)

, the proposed XGBoost and LightGBM models with Corr-DE feature selection accomplished highly competitive results relative to the existing Android malware detection approaches based on metaheuristic feature selection.

LightGBM with Corr-DE attained the highest accuracy among most of the compared methods at 95.78% and then followed closely by XGBoost with Corr-DE at 95.51%. Meanwhile, both proposed XGBoost and LightGBM models with Corr-DE retained a substantial feature reduction rate of 83%. As can be seen in Table 6, the detection results of the proposed XGBoost and LightGBM models with Corr-DE feature selection are clearly better than the detection results reported by Hossain et al. [20], Mohamad Arif et al. [18], and Wang et al. [8]. In addition, the detection results of the proposed XGBoost and LightGBM models are also slightly higher than the results of Fatima et al. [16] and Firdaus et al. [16].

Although Albakri et al. [6] reported a higher maximum accuracy of RHSODL-AMD suggested in Android malware detection, utilizing both Rock Hyrax Swarm Optimization (RHSO-FS) as wrapper feature selection and deep learning classifier may be resource-intensive and not suitable for real implementation in the resource-constrained mobile environment. Banik and Singh [24] also demonstrated that BERT–PSO accomplished an accuracy of 96.27–97.87% with feature reduction of about 50.26%. However, transformer-based models usually demand more computing resources and memory than lightweight ensemble learning techniques used in this study.

Several recent studies have also investigated Android malware detection using deep learning approaches without incorporating metaheuristic feature selection techniques. For example, Graph Neural Network was used to evaluate API interactions and function call graphs in the study [42] that achieved malware detection accuracy of around 92.6% in malware detection. Similarly, XAIDroid [43] achieved approximately 97% detection accuracy by integrating Graph Neural Networks and attention mechanisms to produce interpretable and explainable malware analysis. These studies demonstrated the effectiveness of deep learning models in capturing complex malware behaviors. However, such approaches generally involve higher computational complexity, larger memory requirements, and increased training overhead compared to the gradient-boosting tree ensembles models.

In contrast, the proposed approach utilized XGBoost and LightGBM classifiers that are faster and more computationally efficient than deep learning techniques. Furthermore, two-stage hybrid Corr-DE feature selection approach is suggested in the proposed approach to recognize the key static and dynamic characteristics of Android apps. Thus, the proposed XGBoost and LightGBM models with Corr-DE feature selection remain highly competitive in terms of detection results while also providing a substantial reduction in feature dimensionality. This reflects the ability of Corr-DE to remove redundant features without losing the information needed for accurate classification and detection.

In terms of computational time complexity, the proposed Corr-DE approach reduces the computational burden of metaheuristic feature selection by introducing Pearson correlation pre-filtering stage. Particularly, the conventional metaheuristic optimization algorithms such as genetic algorithms and Particle Swarm Optimization exhibit a dominant complexity of $O(P\cdot G\cdot D\cdot C_{\mathrm{eval}})$, where $D$ is the total number of original features, $P$ is the number of individuals, and $G$ is the number of generations. In contrast, the proposed Corr-DE approach reduces this complexity to $O(ND+P\cdot G\cdot (D-F)\cdot C_{\mathrm{eval}})$, where $N$ is the number of samples and $F$ denotes the number of features eliminated during the correlation filtering stage. For the data used in this paper, since D = 420 features while $(D-F)$ = 72, $(D-F)\ll D$. Hence, the feature optimization in the proposed Corr-DE approach is significantly lower-dimensional space, resulting in improved computational efficiency and faster convergence. The one-time filtering cost $O\left(ND\right)$ is negligible compared to the repeated evaluation cost across generations, which dominates the overall complexity.

5. Discussion

The results provided in Table 5 confirm that the most popular machine learning classifiers that were employed with all 420 static and dynamic features did not yield satisfactory malware detection results since they were trained using a large number of redundant and irrelevant features. When the Pearson correlation filter method was only applied, the feature space was reduced from 420 to 126 features, while the performances of most common machine learning models were slightly improved or maintained, particularly for both XGBoost and LightGBM. This was due to the fact that the features are evaluated in the Pearson correlation filter method by finding only the correlation between each individual attribute and the label, and not considering a specific classifier to choose the best feature set that can contribute effectively to recognizing Android malware applications.

The results presented in the previous sections demonstrate that the suggested intelligent hybrid Corr-DE feature selection contributed to enhancing the detection performance of the most common machine learning employed in the literature to recognize Android malware apps. Particularly, the best detection results were accomplished by gradient-boosted trees after applying the proposed hybrid Corr-DE feature selection. This confirms that the proposed Corr-DE feature selection was especially compatible with gradient-boosted trees in Android malware detection. The results also show that the gradient-boosting classifiers based on the proposed Corr-DE feature selection achieved outstanding detection accuracy while reducing the feature space substantially by 83% in Android malware detection. This was due to the ability of the proposed Corr-DE feature selection to eliminate irrelevant and redundant features without losing the information needed for training XGBoost and LightGBM to produce more accurate classification and detection results.

To control and minimize the risk of overfitting, several safeguards were incorporated into the experiments. The 10 repeated runs of a five-fold cross-validation strategy were employed to ensure that model performance was consistently evaluated on unseen data, thereby improving the reliability of the generalization estimates and reducing the likelihood of performance bias caused by a specific data partition. Moreover, the relatively small standard deviations and narrow confidence intervals obtained across repeated experiments indicate stable and consistent performance of the proposed approach. In addition, the initial application of the Pearson correlation filtering reduced redundant and noisy features, which helped lower model complexity within the high-dimensional feature space. Furthermore, the employed gradient-boosting classifiers, namely LightGBM and XGBoost, include built-in regularization mechanisms that provide additional protection against overfitting.

Compared to some previous works that used static-based metaheuristic feature selection in Android malware detection, the proposed hybrid XGBoost and LightGBM with Corr-DE feature selection produced better detection accuracy than most of the compared previous methods and competitive results to other previous works. This improvement can be attributed not only to the effectiveness of the feature selection strategy but also to the inclusion of dynamic features, which capture runtime behaviors that static analysis alone may miss. The results indicate that the selected feature subset enhances the model’s ability to distinguish between benign and malicious applications, particularly by reducing false positives while maintaining strong detection capability. This suggests that the proposed approach is better equipped to handle obfuscated and runtime-dependent malware, where static features are often insufficient. Overall, the combination of hybrid features and Corr-DE contributes to a more robust and generalizable detection framework compared to the traditional static-based metaheuristic feature selection approaches. Furthermore, unlike previous studies that employed metaheuristic optimization algorithms as wrapper feature selection method with all features, the proposed Corr-DE feature selection is more efficient computationally since the proposed Corr-DE feature selection can reduce the number of features of Android apps by the correlation filter method in the first stage. Accordingly, DE is then used as wrapper feature selection with less features in the second stage to select the most significant features to further increase malware detection. Another reason for the outstanding performance of the proposed approach is the use of both static and dynamic features, which gives the proposed approach a richer view of Android application behavior than approaches based only on permissions, traffic or other limited feature types. Overall, the results presented in the previous sections indicate that Corr-DE combined with powerful boosting models such as XGBoost and LightGBM can provide a strong balance between accuracy and feature reduction.

From a practical perspective, the balanced performance achieved by the proposed approach has direct implications for malware detection accuracy, computational efficiency, and deployment scalability in the real-world Android malware detection systems. Although the proposed Corr-DE feature selection approach is computationally more efficient than many existing wrapper-based metaheuristic feature selection approaches due to the initial correlation-based dimensionality reduction stage, the wrapper optimization process itself remains computationally intensive for direct execution in resource-constrained mobile environments. Therefore, the proposed Corr-DE optimization stage is intended to be performed offline during model training, while the final optimized classifier can be deployed for lightweight inference with reduced feature dimensionality and lower computational overhead. In particular, the Corr-DE feature selection process can be performed offline during the training phase to ensure that no additional computational burden is imposed on resource-constrained mobile devices during deployment. The reduction in feature dimensionality (e.g., from 420 to 72 features) significantly lowers training time and inference complexity to enable faster detection and reduced memory usage. Nevertheless, practical deployment on mobile devices presents challenges such as limited processing power, energy consumption, and storage constraints. To address these issues, the proposed approach can be integrated with lightweight deployment strategies such as model compression, optimized feature extraction or cloud-assisted analysis.

Despite the outstanding detection performance achieved by the proposed approach based on Corr-DE-based feature selection and XGBoost and LightGBM, machine learning-based Android malware detection systems may still be vulnerable to adversarial and evasion attacks. Malicious applications can employ techniques such as code obfuscation, API-call manipulation, behavior masking, permission modification, and adversarial feature perturbation to evade detection models. These attacks may alter malware characteristics while preserving malicious functionality, thereby reducing classifier reliability and generalization capability. Although formal adversarial robustness evaluation was beyond the scope of the current study, the proposed approach partially improves robustness by removing redundant and noisy features through the hybrid Corr-DE optimization process, thereby emphasizing more discriminative and stable feature subsets. In addition, the repeated cross-validation experiments, statistical significance analysis, and consistent performance across multiple classifiers further support the reliability and stability of the proposed approach. Nevertheless, comprehensive adversarial robustness analysis against evolving malware evasion strategies remains an important direction for future research.

6. Conclusions

This paper proposed an innovative and intelligent hybrid Android malware detection approach using Corr-DE-based feature selection and XGBoost and LightGBM to overcome the inherent limitations of the traditional signature-based detection techniques. In the proposed two-stage Corr-DE feature selection, the Pearson correlation filter method was first used to rank and remove less relevant static and dynamic features of Android apps, while DE was then applied to refine the feature subset to produce more accurate detection results. Consequently, the best features are exploited to train XGBoost and LightGBM successfully to produce outstanding malware detection results. The experimental results showed the proposed approach was capable of maintaining high detection performance while substantially reducing feature dimensionality. Specifically, the proposed Corr-DE feature selection contributed to reducing the feature space by 83% while LightGBM with Corr-DE achieved 95.78% accuracy and XGBoost with Corr-DE achieved 95.51% accuracy. In comparison to some previous works, the findings indicated that the proposed hybrid XGBoost and LightGBM with Corr-DE feature selection achieved superior detection accuracy in comparison to the majority of the compared previous methods and competitive detection results to several previous works.

Although the proposed approach accomplished a strong balance between detection accuracy and feature reduction in Android malware detection, there are a few limitations in this study. In the current study, the key parameters of XGBoost and LightGBM were selected on a trial-and-error basis. Advanced optimization-based hyperparameter tuning methods may be explored in order to further improve detection performance. While systematic approaches such as exhaustive grid search or alternative metaheuristic optimization methods could be further explored, these methods may also introduce substantial computational cost and increased optimization time, particularly in high-dimensional feature spaces. Future work may therefore investigate more computationally efficient and systematically evaluated hyperparameter optimization strategies. In addition, although the proposed approach demonstrated outstanding detection performance, the current study did not investigate formal threat modeling or adversarial robustness against evasion attacks. Therefore, comprehensive adversarial robustness analysis against sophisticated evasion attacks remains an important research direction. Future work will investigate adversarial attack resilience, malware obfuscation resistance, and formal threat modeling to further strengthen the cybersecurity perspective and practical robustness of the proposed detection approach. Future work will focus on extending the proposed Corr-DE approach through cross-dataset and temporal generalization evaluation using multiple independent and chronologically ordered Android malware datasets. In addition, the proposed approach should be evaluated on more diverse Android malware datasets with multiclass malware classification. Furthermore, the proposed approach may be enhanced with advanced or multi-objective optimization strategies to further improve the balance between feature reduction and detection performance. In addition, the proposed approach could also be extended to incremental or online learning so that the model can adapt to newly emerging malware variants over time.