Rajif Agung Yunmar
Department of Informatics Engineering, Insititut Teknologi Sumatera, Indonesia.

Published : 1 Documents Claim Missing Document
Claim Missing Document
Check
Articles

Found 1 Documents
Search

How few features are enough? A systematic study of feature reduction in system call N-Grams for android malware detection Rajif Agung Yunmar; Andika Setiawan
Journal of Soft Computing Exploration Vol. 7 No. 2 (2026): June 2026
Publisher : SHM Publisher

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.52465/joscex.v7i2.120

Abstract

System call N-gram representations have been widely utilized in Android malware detection due to their ability to capture behavioral execution patterns. However, previous studies have not systematically examined how aggressive feature reduction affects different N-gram orders, particularly in extremely low-dimensional feature spaces. This study evaluates the impact of feature reduction on system call N-gram representations ranging from 1-gram to 4-gram using Chi-Square feature selection across subsets varying from Top-3 to Top-100 features. Malware classification was performed using the XGBoost algorithm with leakage-free stratified 10-fold cross-validation. Experimental results show that the 2-gram representation achieved the highest accuracy of 96.98% under full-feature conditions. Surprisingly, under aggressive feature reduction, the 1-gram representation consistently outperformed higher-order N-grams across all reduced feature subsets, indicating greater robustness in low-dimensional feature spaces. Statistical significance analysis using paired t-test and Wilcoxon signed-rank test further confirmed significant performance differences between 1-gram and higher-order N-gram representations. Although higher-order N-grams provide richer contextual and more discriminative behavioral representations, their information becomes increasingly fragmented in sparse feature spaces, reducing effectiveness under extreme dimensionality reduction. Furthermore, aggressive feature selection substantially improved computational efficiency, reducing the execution time of the 4-gram representation from 3000.78 seconds to 8.28 seconds under the Top-100 scenario. Overall, the findings reveal a trade-off between contextual richness, feature sparsity, detection performance, and computational efficiency in system call N-gram-based Android malware detection.