Scientific Reports Article in Press

Structured Data Preprocessing

The IMDP-HDL methodology begins with Z-score standardization. This crucial preprocessing step ensures that all features are consistently scaled, centering them around a mean of zero with unit variance. This improves the stability and performance of the deep learning model, especially for algorithms sensitive to feature scales.

Intelligent Feature Selection

The approach utilizes the SHO (Heuristic Search Optimization) technique for effective feature selection. This step is vital for mitigating dimensionality, reducing computational complexity, and preserving the most crucial data features. By streamlining the dataset, it enhances model training speed and accuracy.

Hybrid Deep Learning Model: CBiLSTM-SA

The core of IMDP-HDL is a hybrid model integrating a Convolutional Neural Network (CNN), a Bi-directional Long Short-Term Memory (BiLSTM) network, and a Self-Attention (SA) mechanism. The CNN extracts spatial features, BiLSTM captures sequential patterns in both forward and backward directions for comprehensive context, and the SA mechanism focuses on the most relevant aspects of the input, improving interpretability and accuracy. This combination enables the model to identify complex, intrinsic patterns in malware data.

Superior Detection Accuracy

Extensive experimentation on the Android malware dataset demonstrated that the IMDP-HDL model achieved a remarkable average accuracy of 99.22%. This performance significantly surpasses that of existing techniques, showcasing the model's robust classification capabilities.

Enhanced Performance Metrics

Beyond accuracy, IMDP-HDL consistently delivered high values across other critical performance metrics: precision of 99.20%, recall of 99.13%, and an F1-score of 99.16%. This indicates a balanced and reliable detection system, minimizing both false positives and false negatives across different epochs.

Exceptional Computational Efficiency

The IMDP-HDL model exhibited superior computational efficiency, with a processing time of just 4.81 seconds. This makes it highly suitable for real-time deployment in resource-constrained environments, outperforming all other compared methodologies.

Generalization and Robustness

The model's consistent performance across various datasets, including the AMD and Android_Permission datasets, highlights its strong generalization capability and robustness against diverse malware variants and feature distributions.

Strengthening Enterprise Cybersecurity

The IMDP-HDL framework offers a significant advancement for enterprise cybersecurity, providing a highly accurate and efficient solution for detecting sophisticated Android malware. Its ability to adapt to new threats and operate efficiently makes it invaluable for protecting critical assets and sensitive data.

Scalable and Real-time Deployment

With its low computational complexity and high accuracy, IMDP-HDL is well-suited for scalable deployment in real-world cybersecurity environments, including mobile and IoT edge devices where resources are often restricted. This enables proactive defense against rapidly evolving cyber-attacks.

Addressing Future Cybersecurity Challenges

The research emphasizes the potential for further development, including expanding dataset diversity to capture the full range of malware variants, integrating adaptive learning mechanisms to counter polymorphic and zero-day attacks, and optimizing for even more resource-limited devices. Future work will also explore explainable AI techniques to enhance transparency and trustworthiness of detection decisions.