Robust Android malware detection through EfficientNet–BERT fusion and Jaya optimization for behavioral analysis
5 affiliations
- 1Department of Cybersecurity, College of Computer Science and Engineering, University of Jeddah
- 2College of Computing and Information Technology at Khulais, Department of Information Technology, University of Jeddah
- 3Department of Information Technology, Faculty of Computing and Information Technology in Rabigh, King Abdulaziz University
- 4Department of Creative Technologies, Faculty of Computing and AI, Air University Islamabad
- 5School of Computing and Artificial Intelligence, aculty of Engineering and Technology, Sunway University
Abstract
Android malware continues to evolve through obfuscation, permission misuse, and dynamic payload activation, reducing the effectiveness of conventional detection methods. Existing machine learning and deep learning approaches often face challenges related to class imbalance, redundant high-dimensional features, and limited robustness to emerging malware behaviors. To address these limitations, this study proposes ENBT-J, a hybrid ensemble framework for Android malware detection. The proposed pipeline integrates Edited Nearest Neighbors (ENN) for noise filtering and class balancing, Boruta-based feature selection for identifying informative attributes, MobileNetV2 for compact feature embedding, and an EfficientNet–BERT classification module for joint modeling of static and dynamic behavioral characteristics. Jaya-based hyperparameter tuning is further employed to improve training stability. Experimental evaluation on multiple Android malware datasets shows that ENBT-J achieves 98.14% accuracy, 97.70% F1-score, 98.0% PR-AUC, and 96.15% MCC, outperforming several recent baseline methods. These findings suggest that ENBT-J provides a robust and scalable framework for Android malware detection under diverse and noisy data conditions.
Related
- EQDA-Net: an enhanced quantum-inspired dragonfly algorithm integrated with efficientnet for brain tumor detection
- An EfficientNet hybrid deep learning detection framework of network intrusion with an optimized mixture-of-experts architecture
- Hybrid rank fusion of a group-token transformer with gradient boosting improves detection of evasive and novel-family malware
- Light meal consumption among university students in China: A multi-regional cross-sectional study of behavioral patterns, influencing factors, and service optimization strategies under supply-side heterogeneity
- A multi-task learning approach for consumer sentiment classification and emotion detection via behavioral data
BibTeX
@article{alsubaei2026robust,
title = {{Robust Android malware detection through EfficientNet–BERT fusion and Jaya optimization for behavioral analysis}},
author = {Faisal S. Alsubaei and Abdulwahab Ali Almazroi and Walid Said Atwa and Abdulaleem Ali Almazroi and Nasir Ayub and Noor Zaman Jhanjhi},
journal = {Scientific Reports},
year = {2026},
month = jul,
doi = {10.1038/s41598-026-63065-2},
url = {https://doi.org/10.1038/s41598-026-63065-2},
note = {CC BY},
}
RIS
TY - JOUR
TI - Robust Android malware detection through EfficientNet–BERT fusion and Jaya optimization for behavioral analysis
AU - Faisal S. Alsubaei
AU - Abdulwahab Ali Almazroi
AU - Walid Said Atwa
AU - Abdulaleem Ali Almazroi
AU - Nasir Ayub
AU - Noor Zaman Jhanjhi
PY - 2026
DA - 2026/07/01
JO - Scientific Reports
DO - 10.1038/s41598-026-63065-2
UR - https://doi.org/10.1038/s41598-026-63065-2
AB - Android malware continues to evolve through obfuscation, permission misuse, and dynamic payload activation, reducing the effectiveness of conventional detection methods. Existing machine learning and deep learning approaches often face challenges related to class imbalance, redundant high-dimensional features, and limited robustness to emerging malware behaviors. To address these limitations, this study proposes ENBT-J, a hybrid ensemble framework for Android malware detection. The proposed pipeline integrates Edited Nearest Neighbors (ENN) for noise filtering and class balancing, Boruta-based feature selection for identifying informative attributes, MobileNetV2 for compact feature embedding, and an EfficientNet–BERT classification module for joint modeling of static and dynamic behavioral characteristics. Jaya-based hyperparameter tuning is further employed to improve training stability. Experimental evaluation on multiple Android malware datasets shows that ENBT-J achieves 98.14% accuracy, 97.70% F1-score, 98.0% PR-AUC, and 96.15% MCC, outperforming several recent baseline methods. These findings suggest that ENBT-J provides a robust and scalable framework for Android malware detection under diverse and noisy data conditions.
SN - 2045-2322
ER -