Comparative Analysis of Machine Learning Algorithms for Malware Detection in Android Ecosystems

Abstract

Android malware is a growing cybersecurity concern as malicious applications exploit vulnerabilities in the Android operating system to steal sensitive data, disrupt device functionality, or gain unauthorised control. The rising sophistication of these threats makes conventional signature-based detection techniques insufficient, highlighting the need for advanced learning-based solutions that adapt to evolving attack patterns. This study proposes a comparative evaluation of Machine Learning (ML) as well as Deep Learning (DL) models for Android malware detection using the RT-IoT2022 dataset, which contains diverse benign and malicious network traffic. Five models were implemented: Random Forest (RF), Support Vector Machine (SVM), Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), and a hybrid CNN-LSTM. Experimental analysis showed that while RF and SVM achieved strong baseline results and CNN effectively extracted spatial features, LSTM alone struggled to classify balanced classes. The proposed hybrid CNN–LSTM achieved the best results with 99.30% accuracy and 99.76% F1-score. These findings validate the superiority of hybrid architectures and provide a pathway for lightweight, real-time, and adversarial-resistant malware detection systems for Android and Internet of Things (IoT) environments.