This study delves into advanced feature selection methodologies for enhancing Android malware classification. GHR-Optimizer is introduced as an innovative feature selection approach combining Grey Wolf Optimization, Hill Climbing, and Random Forest Classifier method. The approach selects features from a hybrid dataset and is evaluated across machine learning, deep learning, and ensemble frameworks. A detailed comparative analysis is conducted, contrasting GHR-Optimizer with static and dynamic feature sets as well as traditional filter and wrapper-based methods. The implementation of the GHR method demonstrated superior performance, particularly when evaluated with diverse datasets such as KronoDroid, which achieved exceptional accuracy and balance in classification metrics. When integrated with the Random Forest classifier, the GHR-Optimizer achieves an accuracy of 98.40%. These findings underscore GHR-Optimizer’s superior performance in boosting classification accuracy and robustness, highlighting its pivotal role in advancing feature selection strategies within the domain.

Abstract The recent increase in Android's popularity has resulted in a swamp of attacks faced by the platform. Several researchers have come out with various static malware detection tools using opcodes as features since opcodes provide the details of intrinsic patterns of application raw data. This article presents a new malware detection approach CogramDroid based on opcode ngrams. The approach classifies the applications based on the relative frequency patterns of the opcode ngrams using the concept of word cooccurrence of natural language processing. The objective of the article is to develop a malware detection approach with high accuracy and time efficiency. The article also presents an analysis of the number of opcodes required for effective malware detection. In this study, an accuracy rate of 96.22% and an F1‐score of 96.69% is achieved using seven core opcodes and three grams.