# DroidDetectMW: A Hybrid Intelligent Model for Android Malware Detection
## 6 Conclusions and Future Work  
For Android malware detection and classification, this research suggested a hybrid analysis-based process, enhancing both static and dynamic features gleaned from network traffic. The proposed mode can be broken down into three distinct phases. The features are then sent into the selection phase after being extracted. There are two primary stages within the feature selection process: dynamic feature selection and static feature selection. We will work to lower the total amount of static and dynamic features throughout the two phases. Static feature selection employs a variety of filtering methods to zero in on the best static features. Fuzzy and metaheuristic optimization techniques are used in the second stage of the dynamic feature selection process. When the feature selection process is complete, the resulting subset of features is used in the detection stage. Within the scope of the detection process, we introduced a novel detection technique that uses an artificial neural network. The best architecture of ANN may be chosen with the help of a revised version of HHO, which is presented here. The detection method and the feature selection procedure are assessed by comparing the improved ANN to other ML models. Experiments are run utilizing a variety of binary, malware category, and malware family samples to gauge effectiveness. The results validated the proposed model's ad-vantage over competing methods. Overall performance is measured using a variety of assessment criteria.  
There is a significant risk that the use of code obfuscation and encryption will invalidate the results of this experiment. Some dynamic analysis features, such as traffic files, may not be enough to effectively detect malware that is not primarily network-based because they are employed in isolation from other features like memory device and logs information logs. The reliability of the experiment is also significantly affected by this. There is also a lack of transparency in interpreting dynamic analytic techniques. Our future efforts will center on these concerns.  
Conceptualization, F.T.; methodology, O.A.; software, H.A.H.; validation, H.A.H. and F.T.; formal analysis, M.A.-k.; investigation, O.A.; resources, F.T.; data curation, F.T.; writing--original draft preparation, S.A.; writing--review and editing, S.A.; visualization, H.A.H.; supervision, F.T.; project administration, F.T.; funding acquisition, F.T. All authors have read and agreed to the published version of the manuscript.  
UAE University and Zayed University joint research grant.  
Not applicable.  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Related Work** & **Precision** & **Recall** \\ \hline [PERSON] et al. [49] & 80.2\%(RF) & 79.6\%(RF) \\ [PERSON] et al. [21] & 49.9\%(RF) & 48.5\%(RF) \\ [PERSON] et al. [45] & 47.8\%(DT) & 45.9\%(DN) \\ [PERSON] et al. [45] & 49.5\%(KNN) & 48\%(KNN) \\ [PERSON] et al. [49] & 77\%(DT) & 77\%(DT) \\ DroidDetectMW & 87.5\% & 89\% \\ \hline \hline \end{tabular}
\end{table}
Table 17: Malware category classification using dynamic features selection: A comparison of results.  
Data Availability Statement: Canadian Institute for Cybersecurity (CIC) offers a competent real-world dataset named CICAndMal2017.