Android Malware Detection Using Machine Learning with SMOTE-Tomek Data Balancing

Abstract

Android malware poses an increasing threat to mobile ecosystems due to the rapid growth of malicious applications and the rising complexity of attack strategies. This study addresses the challenge of reliable malware detection under imbalanced data conditions, which remains a critical limitation of many existing detection approaches. The objective of this research is to empirically validate the effectiveness of Random Forest for Android malware detection, while using comparative evaluation as supporting evidence. A machine learning–based detection framework is developed using the preprocessed TUANDROMD dataset, which contains 4,465 applications represented by 241 static and dynamic features. To mitigate class imbalance, SMOTE-Tomek is applied to the training subset, and model performance is evaluated on an unseen test set using accuracy, precision, recall, F1-score, and ROC AUC. The experimental results show that Random Forest achieves consistently strong and balanced performance, particularly in maximizing recall and minimizing false negatives, while outperforming baseline classifiers such as Decision Tree, K-Nearest Neighbors, and Support Vector Machine. Comparison with previously published studies further supports the robustness and reliability of the proposed approach. These findings demonstrate that combining ensemble-based learning with explicit data balancing provides a practical and computationally efficient solution for Android malware detection. The study concludes that Random Forest, when appropriately balanced and evaluated, offers a reliable alternative to more complex deep learning–based models for real-world Android security applications.