# Advanced Financial Fraud Malware Detection Method
## 5 Limitations and Future Directions  
The limitations of the proposed work, along with potential future directions, are as follows:  
* The validity of the study may be influenced by dataset bias, as it relies on data from a single bank. Additionally, challenges related to imbalanced data, potential scalability issues in real-world deployment, and the need for continuous adaptation to evolving malware threats must be considered.
* Since this model is designed for static analysis-based financial fraud malware detection, it has not been evaluated against advanced malware evasion techniques (e.g., code obfuscation, zero-day exploits). This limitation may result in an overestimation of its actual detection effectiveness against APT.
* Future research will focus on enhancing the model's generalizability by incorporating datasets from multiple banks and financial institutions across different countries.
* Since random undersampling may lead to the loss of critical malicious patterns, potentially affecting detection performance, future work will explore hybrid resampling methods, such as SMOTE, cost-sensitive learning, and ensemble-based strategies, to assess their impact on performance and robustness.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Category** & **Proposed Work** & **Existing Work** & **Comparison** \\ \hline \multirow{8}{*}{Datasets} & Real-world dataset from Bank & Most existing works (e.g., \\  & A (South Korea) with & DroidDetector [54]) used & The real-world, large-scale dataset offers better \\  & 183,938,730 benign & smaller, lab-controlled & generalizability compared to \\  & transactions and 11,986 & datasets, often from & smaller, simulated datasets \\  & malware transactions; & third-party app stores or & used in existing work. \\  & highly imbalanced & Google Play & \\ \hline \multirow{8}{*}{D Detection Methodology} & Static analysis (feature & Existing methods like \\  & extraction) for both known & DroidDetector [54] and Zhou & Static analysis in the \\  & and unknown malware. & et al. [59] rely primarily on & proposed work is more \\  & & curation analysis, with high & scalable and \\  & & and unknown malware. & computational overheads (e.g., \\  & & & \\  & & & \\  & & & \\ \hline \multirow{8}{*}{Machine Learning Models} & Tested models: Logistic & Random Forest, \\  & Regression, Random Forest, & commonly used but struggle \\  & LightGBM, XGBoost, CatBoost. & with large, imbalanced \\  & LightGBM showed the & datasets; some use deep & \\  & best performance. & learning, which is & \\  & & computationally expensive & SVM and Random Forest. \\ \hline \multirow{8}{*}{Performance Metrics} & Achieved 99.99\% accuracy, & DroidDetector [54] had 96.76\% & The proposed model shows \\  & 96.86\% precision, 97.04\% & accuracy and 92.85\% F1-score; & \\  & F1-score, AUROC of 0.999559, & other models struggled with & \\  & and AUPRC of 0.987537 & imbalanced datasets & \\ \hline \multirow{8}{*}{Application} & Designed for real-time & Existing models such as & The proposed framework is \\  & deployment in financial & TaintDroid [12] and & more scalable and applicable \\ \cline{1-1}  & institutions; uses a lightweight & & to real-world financial \\ \cline{1-1}  & model (LightGBM) to handle & real-time large-scale & institutions compared to \\ \cline{1-1}  & large-scale data & environments & existing methods. \\ \hline \hline \end{tabular}
\end{table}
Table 18: Comparative analysis with existing work.  
* Explainable AI (XAI) techniques [73] will be considered to improve the interpretability of ML-based malware detection pipelines. Additionally, incremental learning [74], which is effective in detecting emerging malware, will be explored.
* Further research will investigate the application of natural language processing techniques on app names to enhance financial fraud malware detection models.