A comparative analysis of deep learning techniques for android spyware classification

The General Data Protection Regulation (GDPR) emphasizes safeguarding personal data globally, underscoring the need to protect sensitive information from cyber threats like spyware. Spyware covertly infiltrates devices, collecting personal details, private activities, and financial data. With smartphones as primary devices for daily activities, this research focuses on Android spyware classification to address these growing risks. This study compares spyware classification techniques using the MalNet dataset, evaluating deep learning, transfer learning, and hybrid approaches. The models CNN, CNN-BiLSTM, and ResNet152 were tested with a balanced dataset and 10-fold cross validation. ResNet152 outperformed other models with an accuracy of 0.8541, precision of 0.8940, recall of 0.8035, and an F1-score of 0.8464. By contrast, CNN achieved an accuracy of 0.5 with zero precision, recall, and F1-score while CNN-BiLSTM recorded an accuracy of 0.5, precision of 0.5, recall of 1, and an F1-score of 0.6670. These findings demonstrate ResNet152 has superior consistency and reliability to identify spyware effectively, making it a robust model for malware classification. While CNN offers simplicity and efficiency but struggles with complex patterns. CNN-BiLSTM’s high recall underscores its potential for real-world applications where minimizing missed detections of spyware is critical. This research provides a strong foundation for advancing Android spyware detection and highlights promising directions for enhancing malware classification with deep learning.