Title: Artificial Neural Network-Based Android Malware Detection Using Application Permission Features
Authors: Taha Al-Jaro, Muhammad Isleem, Samy S. Abu-Naser
Volume: 10
Issue: 7
Pages: 28-40
Publication Date: 2026/07/28
Abstract:
Android malware continues to challenge mobile security because malicious applications can imitate legitimate software while requesting combinations of permissions that enable surveillance, unauthorized messaging, data access, persistence, or installation of additional packages. This study develops and evaluates a feed-forward artificial neural network for binary Android malware detection using application permission features from the NATICUSdroid dataset. The source file contains 29,332 observations, 86 binary permission variables, and a binary outcome in which 0 denotes benign software and 1 denotes malware. A detailed data audit identified extensive repetition and a smaller number of contradictory labels for identical permission profiles. To reduce information leakage and remove impossible input-output conflicts, identical profiles were consolidated by majority label, tied profiles were removed, and the remaining data were balanced by reproducible undersampling. The final JustNN-compatible dataset contains 5,116 unique permission profiles, equally divided between benign and malicious classes. A stratified 70/30 split produced 3,581 training cases and 1,535 validation cases. The evaluated multilayer perceptron used 86 input neurons, one hidden layer of 16 sigmoid neurons, and one sigmoid output neuron. On the held-out validation set, the network achieved 93.81% accuracy, 93.98% precision, 93.61% malware recall, a 93.79% F1-score, 94.01% specificity, and an ROC-AUC of 0.985. The findings indicate that permission profiles contain strong predictive information and can support lightweight malware screening. Nevertheless, permission-based models should be considered screening mechanisms rather than complete security solutions because permissions do not directly describe runtime behavior, adversaries may manipulate manifest declarations, and performance can decline under temporal or cross-dataset distribution shifts.