Open Access

ARTICLE

Lightweight and Robust Android Ransomware Detection Using Behavioral Analysis and Feature Reduction

Muhammad Sibtain¹, Mehdi Hussain^1,*, Qaiser Riaz¹, Sana Qadir¹, Naveed Riaz¹, Ki-Hyun Jung^2,*

1 School of Electrical Engineering and Computer Science (SEECS), National University of Sciences and Technology (NUST), Islamabad, 44000, Pakistan
2 Department of Software Convergence, Gyeongkuk National University (Andong National University), Gyeongbuk, 36729, Republic of Korea

* Corresponding Authors: Mehdi Hussain. Email: ; Ki-Hyun Jung. Email:

Computers, Materials & Continua 2025, 84(3), 5177-5199. https://doi.org/10.32604/cmc.2025.066198

Received 01 April 2025; Accepted 16 June 2025; Issue published 30 July 2025

Abstract

Ransomware is malware that encrypts data without permission, demanding payment for access. Detecting ransomware on Android platforms is challenging due to evolving malicious techniques and diverse application behaviors. Traditional methods, such as static and dynamic analysis, suffer from polymorphism, code obfuscation, and high resource demands. This paper introduces a multi-stage approach to enhance behavioral analysis for Android ransomware detection, focusing on a reduced set of distinguishing features. The approach includes ransomware app collection, behavioral profile generation, dataset creation, feature identification, reduction, and classification. Experiments were conducted on ∼3300 Android-based ransomware samples, despite the challenges posed by their evolving nature and complexity. The feature reduction strategy successfully reduced features by 80%, with only a marginal loss of detection accuracy (0.59%). Different machine learning algorithms are employed for classification and achieve 96.71% detection accuracy. Additionally, 10-fold cross-validation demonstrated robustness, yielding an AUC-ROC of 99.3%. Importantly, latency and memory evaluations revealed that models using the reduced feature set achieved up to a 99% reduction in inference time and significant memory savings across classifiers. The proposed approach outperforms existing techniques by achieving high detection accuracy with a minimal feature set, also suitable for deployment in resource-constrained environments. Future work may extend datasets and include iOS-based ransomware applications.

---

Keywords

---