Open Access

ARTICLE

Enhancing Android Malware Detection with XGBoost and Convolutional Neural Networks

Atif Raza Zaidi¹, Tahir Abbas^1,*, Ali Daud^2,*, Omar Alghushairy³, Hussain Dawood⁴, Nadeem Sarwar⁵

1 Department of Computer Science, TIMES Institute, Multan, 60000, Pakistan
2 Faculty of Resilience, Rabdan Academy, Abu Dhabi, 114646, United Arab Emirates
3 Department of Information Systems and Technology, College of Computer Science and Engineering, University of Jeddah, Jeddah, 23218, Saudi Arabia
4 School of Computing, Skyline University College, University City Sharjah, Sharjah, 1797, United Arab Emirates
5 Department of Computer Science, Bahria University, Lahore Campus, Lahore, 54600, Pakistan

* Corresponding Authors: Tahir Abbas. Email: ; Ali Daud. Email:

Computers, Materials & Continua 2025, 84(2), 3281-3304. https://doi.org/10.32604/cmc.2025.063646

Received 20 January 2025; Accepted 16 April 2025; Issue published 03 July 2025

Abstract

Safeguarding against malware requires precise machine-learning algorithms to classify harmful apps. The Drebin dataset of 15,036 samples and 215 features yielded significant and reliable results for two hybrid models, CNN + XGBoost and KNN + XGBoost. To address the class imbalance issue, SMOTE (Synthetic Minority Over-sampling Technique) was used to preprocess the dataset, creating synthetic samples of the minority class (malware) to balance the training set. XGBoost was then used to choose the most essential features for separating malware from benign programs. The models were trained and tested using 6-fold cross-validation, measuring accuracy, precision, recall, F1 score, and ROC AUC. The results are highly dependable, showing that CNN + XGBoost consistently outperforms KNN + XGBoost with an average accuracy of 98.76% compared to 97.89%. The CNN-based malware classification model, with its higher precision, recall, and F1 scores, is a secure choice. CNN + XGBoost, with its fewer all-fold misclassifications in confusion matrices, further solidifies this security. The calibration curve research, confirming the accuracy and cybersecurity applicability of the models’ probability projections, adds to the sense of reliability. This study unequivocally demonstrates that CNN + XGBoost is a reliable and effective malware detection system, underlining the importance of feature selection and hybrid models.

---

Keywords

---