# DroidDetectMW: A Hybrid Intelligent Model for Android Malware Detection
## 5 Experiments
### Classification Results Based on Hybrid Features  
The malware's execution stalling and obfuscation make a single static or dynamic technique insufficient for correct classification. As a result, we employ a hybrid method of analysis to address this issue. We integrated the dynamic and static malware analysis results to get a complete picture. Along with the proposed model, seven ML algorithms are used for both detection and classification of binary malware. Binary classification evaluation results using ML approaches on integrated features are shown in Table 13. The proposed DroidDetectMW model is superior and more accurate than the classifiers mentioned earlier. DroidDetectMW's accuracy is 98.1%, whereas RF and DT only manage 96.9% and 96.2%, respectively. The results of a comparison of ML methods using integrated features for category classification are shown in Table 14. Compared to the rest of these classifiers, DroidDetectMW is superior in terms of performance and precision. DroidDetectMW's detection accuracy is 96.9%, with RF and K-NN each achieving 94.6 percent. DroidDetectMW achieves superior outcomes than other classifiers in terms of precision (95%) as well as TPR (98.3%) and F-measure (96.6%). Table 15 presents the malware family classification using different classifiers and it is noted that the proposed model obtained high accuracy of 88.9 which outperform other models. In Figure 5, we compare seven different classifiers to the proposed model and other methods we tested for binary classification to see which one yielded the best results in terms of MCC and accuracy. Integrated with the results in Tables 13-15, it is evident that combining static and dynamic information leads to gains in accuracy for all classifiers. This suggests that greater identification and classification of Android malware is possible when dynamic and static features are used together. \begin{table}
\begin{tabular}{r c c c c c c c c} \hline \hline
**Algorithm** & **K-NN** & **SMO** & **SVM** & **RF** & **DT** & **NB** & **MLP** & **Proposed** \\ \hline Accuracy (\%) & 0.946 & 0.958 & 0.942 & 0.969 & 0.962 & 0.946 & 0.946 & 0.981 \\ FPR (\%) & 0.068 & 0.049 & 0.063 & 0.035 & 0.042 & 0.056 & 0.056 & 0.021 \\ TPR (\%) & 0.965 & 0.966 & 0.949 & 0.975 & 0.966 & 0.949 & 0.949 & 0.983 \\ Precision (\%) & 0.917 & 0.942 & 0.925 & 0.958 & 0.950 & 0.933 & 0.933 & 0.975 \\ F-measure (\%) & 0.940 & 0.954 & 0.937 & 0.966 & 0.958 & 0.941 & 0.941 & 0.979 \\ MCC (\%) & 0.892 & 0.915 & 0.884 & 0.938 & 0.923 & 0.892 & 0.892 & 0.961 \\ AUC (\%) & 0.924 & 0.946 & 0.931 & 0.962 & 0.954 & 0.938 & 0.938 & 0.977 \\ \hline \hline \end{tabular}
\end{table} 
Table 13: The effectiveness of integrated feature selection for malware binary classification. \begin{table}
\begin{tabular}{r c c c c c c c c} \hline \hline
**Algorithm** & **K-NN** & **SMO** & **SVM** & **RF** & **DT** & **NB** & **MLP** & **Proposed** \\ \hline Accuracy (\%) & 0.788 & 0.804 & 0.812 & 0.812 & 0.804 & 0.800 & 0.808 & 0.827 \\ FPR (\%) & 0.229 & 0.209 & 0.210 & 0.206 & 0.213 & 0.222 & 0.204 & 0.194 \\ TPR (\%) & 0.816 & 0.822 & 0.845 & 0.838 & 0.829 & 0.833 & 0.824 & 0.857 \\ Precision (\%) & 0.700 & 0.733 & 0.725 & 0.733 & 0.725 & 0.708 & 0.742 & 0.750 \\ F-measure (\%) & 0.753 & 0.775 & 0.780 & 0.782 & 0.773 & 0.766 & 0.781 & 0.800 \\ MCC (\%) & - & - & - & - & - & - & - & - \\ AUC (\%) & 0.735 & 0.762 & 0.757 & 0.763 & 0.756 & 0.743 & 0.769 & 0.778 \\ \hline \hline \end{tabular}
\end{table} 
Table 12: The effectiveness of dynamic feature selection for malware family classification. Figure 6 compares seven classifiers to the proposed model in terms of accuracy concerning different approaches in our tests for malware category classification.