Master’s Thesis at the College of Information Technology Explores Malware Detection in Android Systems

Duhaa Fadill Abbas
The Software Department at the College of Information Technology – University of Babylon witnessed the defense of a distinguished master’s thesis entitled:
“Android Malware Detection Based on Static and Dynamic Feature Selection Using Machine Learning Techniques”
by the student Abdullah Alawi Mohammed Hilal, under the supervision of Asst. Prof. Dr. Ahmed Habib Saeed. The thesis defense took place at 9:00 a.m. on Sunday, July 20, 2025, in the college s main conference hall.

The thesis addresses the growing threat of Android malware as a result of the rapid evolution of Android devices, which has rendered the detection of malicious software a critical research domain. Traditional detection methods often rely on a large number of features, which increases computational complexity and demands extensive manual effort for data labeling. This research aims to overcome these challenges by proposing an effective framework for Android malware detection that integrates feature reduction techniques, unsupervised learning methods, and classification models to enhance performance and reduce human intervention.

The study pursues three primary objectives. First, it employs dimensionality reduction and feature selection techniques—such as Mutual Information and Principal Component Analysis (PCA)—to minimize the number of features while preserving classification accuracy. Second, it evaluates the performance of various machine learning and deep learning algorithms, including Random Forest and Multilayer Perceptron (MLP), in classifying Android malware using both static and dynamic features from the CCCS-CIC-AndMal-2020 dataset. Third, to address the challenge of manual data labeling, the research applies the enhanced K-Means++ clustering algorithm to the Drebin dataset to effectively segregate malware samples without relying on manually labeled data.

The results reveal that the MLP model achieves a high detection accuracy of up to 99% following the application of feature reduction techniques, significantly lowering computational costs. Moreover, clustering evaluations show that organizing the Drebin dataset into two clusters yields the most optimal separation between samples, reinforcing the efficacy of the proposed unsupervised learning approach.

Overall, the findings demonstrate that the proposed system offers a robust, efficient, and scalable solution for Android malware detection, making it a practical candidate for real-world deployment.