A hybrid deep-handcrafted feature fusion framework for image based android malware detection

Dynamic loading and code-manipulation techniques that weaken the reliability of traditional static and signature-based detectors. Image-based malware analysis has recently emerged as an effective alternative, as transforming executable bytecode into grayscale images reveals structural, spatial and statistical patterns that remain difficult to conceal. Motivated by this, the present study proposes a hybrid learning framework for Android malware detection using grayscale images generated exclusively from DEX bytecode segments. Multiple deep feature extractors based on Transfer Learning architectures—including DenseNet121, MobileNetV2 and InceptionV3—are employed to obtain high-level semantic representations from DEX images, while handcrafted descriptors such as HOG, SIFT, ORB, LBP and GLCM capture complementary gradient and texture characteristics. The fused feature representations are evaluated using several machine learning classifiers, including Random Forest, Logistic Regression, SVM, KNN and Naïve Bayes. Experimental results demonstrate that the DEX image representation yields highly discriminative patterns, achieving a maximum accuracy of 94.40% with Random Forest and 94.33% with Logistic Regression. These findings confirm the effectiveness of DEX-driven image analysis and hybrid feature fusion as a robust, scalable solution for Android malware detection.