## 3 Materials and Methods
### Dynamic Model Proposed for Android Malware Detection
#### 3.2.2 Feature Selection  
In studies using ML-based classifiers, feature selection is a vital process step that should be employed, as it can reduce the classifier training time and improve the classification performance by removing the irrelevant features. Feature selection is widely used in  
Figure 1: The schematic structure of the dynamic model proposed for Android malware detection.  
permission-based android malware detection studies [35; 36; 37; 38; 39]. Although the applications' permission requests are effective in malware classification, not every permission request may affect the classification. For this reason, the feature selection process is generally applied in the studies. When the studies are examined, the most widely used method for the selection of permission-based features in android malware detection is the information gain one [18; 36; 37; 38]. In [18; 36; 37; 38], the information gain method was used, and the classification accuracy was greatly increased. information gain and Fisher score methods are filter-based methods which give us the effect value of the attributes in the classification. Filter-based methods collect the intrinsic properties of the measured features through univariate statistics. These methods are faster and less computationally costly than wrapper (Forward Feature Selection, Exhaustive Feature Selection and Recursive Feature Elimination, etc.) and embedded (LASSO Regularization (L1) and Random Forest Importance, etc.) methods are. In a comparison study conducted to obtain the information gain and Fisher score, it was seen that more successful results were obtained with the Fisher score method [40]. However, existing studies have used the information gain method, and their accuracy values are lower. Therefore, in this study, the Fisher score method is implemented in the feature selection process of the proposed model. This method uses a feature selection strategy that calculates the gain score so that the distance between the data points within the same class is as small as possible and the distance between the data points within different classes is as great as possible [41]. The feature set was then selected in accordance with this calculation. The Fisher score of a feature for the given classes a and b can be obtained using Equation (1).  
\[FS=\frac{\sum_{a=1}^{b}na(\mu_{i,a}-\mu_{i})^{2}}{\sum_{a=1}^{b}na\sigma_{i,a} ^{2}} \tag{1}\]  
In this equation, \(na\) represents the number of instances in the dataset, \(\mu_{i}\) corresponds to the mean score of the features, \(\mu_{i,a}\) stands for the mean score of the features in class a and \(\sigma_{i,a}\) corresponds to the variance score of the features in class a. In the experimental studies, Fisher scores of other features were obtained according to the actual class label \"CLASS\". The experiments were performed for 1000, 750, 500, 250, 100, 50 and 25 features with the ensemble learning-based BDT classifier, and since 50 features gave the highest accuracy value, the number of features that had to be selected by the Fisher score method was determined as being 50. Therefore, at the end of the feature selection process, the 2000 \(\times\) 1134-dimensional dataset obtained from the database is reduced to a 2000 \(\times\) 50-dimensional dataset.