Generalizing Feature Selection in Android Malware Detection: The SigAPI AutoCraft Approach - Rocha, Vanderson; Tschiedel, Laura; Kreutz, Diego; Bragança, Hendrio; Assolin, Joner; Mansilha, Rodrigo Brandão; Quincozes, Silvio E.; Nogueira, Angelo Gaspar Diniz (Journal of the Brazilian Computer Society, 2026)
Feature selection methods are widely employed in Android malware detection to improve accuracy and efficiency by identifying the most relevant features. However, their generalizability often remains limited, as approaches like SigAPI are typically developed and evaluated on a small number of datasets, reducing their effectiveness across diverse scenarios. The practical use of SigAPI is further hindered by the need to predefine a minimum number of features, the instability of its evaluation metrics, and its inability to adapt efficiently to the heterogeneity commonly present in Android datasets. To address these limitations, we developed SigAPI AutoCraft, an enhanced and fully automated version of the original method. SigAPI AutoCraft achieves consistent and robust performance across ten Android malware datasets, substantially improving generalization. The results demonstrate a 5–15% increase in Matthews Correlation Coefficient (MCC) and up to a 7.6-fold improvement in feature reduction, underscoring its effectiveness and adaptability to complex and heterogeneous data environments.