## Article
This occurs when an application carrying malicious code that may have been downloaded via email or a web page is utilized without the knowledge of the user as the device is injected with malicious software as part of a hacking attack [2,3]. A variety of interfaces are used to connect linked or self-driving autos to external or public networks [7]. Connectivity Control Units (CCUs) or Telematics Control Units (TCUs) are devices that have an external communication and modem that allow them to receive GPS signals and connect to wireless networks. Numerous apps for in-vehicle infotainment systems are made possible by embedded operating systems, such as Android OS or QNX OS. During the development of wireless or wired networks, and if security is not taken into account, it is possible to take over the OS environment by using embedded malware or malicious instructions to perform evil jobs [7]. In general, the malware detection phase has mainly been divided into two phases in previous studies: the first one has been the analysis phase and the second one has been the detection phase. In the analysis phase, to extract the features of the malware, several methods are available such as static analysis (SA), dynamic analysis (DA), memory analysis (MA), and hybrid analysis (HA) [8]. Static analysis includes testing and analyzing specific malware without running it directly. Whereas dynamic malware analysis is carried out systematically and in a controlled environment to analyze the functioning of the malware. Hybrid analysis uses both dynamic and static analysis. The last method is the memory analysis method, which performs a complete and comprehensive analysis of the malware in the memory. When the malware analysis is completed, the discovery phase is started to detect the malware. Through the use of malware detection stages, it will be possible to prevent the spread of malware and prevent the damage that can occur because of that. Therefore, this paper is based on the static analysis of malware detection in self-driving vehicles [7]. There are many studies which have been performed using static and dynamic analysis for Android malware detection [9; 10; 11; 12]. Static analysis is fast and the application can be avoided without damaging the system. However, the static analysis method is vulnerable to zero-day attacks. It is also vulnerable to runtime vulnerabilities. Dynamic analysis, on the other hand, is powerful in terms of detecting and capturing the real-time behavior of the application. In this study, a dataset containing hybrid analysis was used to take advantage of the detection power of static analysis and dynamic analysis, and the experiments were carried out with hybrid analysis. In the current studies, high accuracies have tried to be obtained by using different analysis types and different classification models have been presented. However, machine learning and deep learning methods presented in previous studies are dependent on hyperparameter selection. In addition, selecting the best features requires expert knowledge. In this study, the best features are selected by using particle swarm optimization on the dataset containing hybrid analysis information. At the same time, automatic adjustment of hyperparameter settings is provided using the adaptive genetic algorithm. The specific and significant contributions of this current study can be summarized as follows:  
* In the study, a dataset with a wide hybrid feature is used for the security of Android systems used in autonomous vehicles. In this way, the malware detection power of static analysis and dynamic analysis is utilized. Particle swarm optimization technique is used in order to discard irrelevant features and use related features. * Adaptive genetic algorithm is used to maximize the performance of machine learning classifiers. * The performance of the proposed AGA-based XGBoost and random forest classifiers is compared with deep neural network and various machine learning classifiers.