# GA-StackingMD: Android Malware Detection Method Based on Genetic Algorithm Optimized Stacking
###### Abstract  
With the rapid development of network and mobile communication, intelligent terminals such as smartphones and tablet computers have changed people's daily life and work. However, malware such as viruses, Trojans, and extortion applications have introduced threats to personal privacy and social security. Malware of the Android operating systems has a great variety and updates rapidly. Android malware detection is faced with the problems of high feature dimension and unsatisfied detection accuracy of single classification algorithms. In this work, an Android malware detection framework GA-StackingMD is presented, which employs Stacking to compose five different base classifiers, and Genetic Algorithm is applied to optimize the hyperparameters of the framework. Experiments show that Stacking could effectively improve malware detection accuracy compared with single classifiers. The presented GA-StackingMD achieves 98.43% and 98.66% accuracies on CIC-AndMal2017 and CICMalDroid2020 data sets, which shows the effectiveness and feasibility of the proposed method.  
Android malware detection; integrated machine learning; stacking; genetic algorithm +
Footnote †: journal: Medical Informatics  
0000-0001-999-2270-3899-2270]Xie 0000-0001-9994-2270][PERSON]  
0000-0001-999-2270-3899-2270-3  
model to achieve the purpose of malware detection, which is to have a good and stable detection performance for different forms of software [5; 6], so that the stability, robustness, and effectiveness of the classification model have attracted the attention of researchers. The existing malware detection methods usually extract the data set features and train the learning models, then classify the malicious samples from normal ones. The detection accuracy of a single feature or single detection algorithm is not satisfied in practice, while the combinations of multi-dimensional features or various classifiers are faced with high computational consumption.  
Considering the above problems, we try to propose solutions. The contributions of this paper are as follows.  
1. An Android malware detection framework based on Stacking is proposed. The framework mainly includes three parts: data set construction, feature dimension reduction, and optimization method GA-StackingMD. By Stacking technology, five base classifiers are integrated to combine their advantages in order to improve malware detection performance;
2. A two-step feature dimension reduction method is realized. The extracted multiple-category features have high dimensions, which may lead to redundancy, excessive computational consumption, and even over-fitting. The proposed method uses Info-Gain for first feature detection and then applies Chi-square Test to reduce redundancy; finally, the key features subset with better distinguishing ability is constructed;
3. A Stacking hyperparameters' optimization method, GA-Stacking MD, is presented to improve the classifiers' combination performance. Experiments show it achieves better accuracy than the original combination of base classifiers. The proposed method is not only applicable to the optimization of stacking hyperparameters but also can be extended to apply to different integrated classifiers' optimization, so as to play a role in different base classifier algorithm environments.