<![CDATA[System call N-gram representations have been widely utilized in Android malware detection due to their ability to capture behavioral execution patterns. However, previous studies have not systematically examined how aggressive feature reduction affects different N-gram orders, particularly in extremely low-dimensional feature spaces. This study evaluates the impact of feature reduction on system call N-gram representations ranging from 1-gram to 4-gram using Chi-Square feature selection across subsets varying from Top-3 to Top-100 features. Malware classification was performed using the XGBoost algorithm with leakage-free stratified 10-fold cross-validation. Experimental results show that the 2-gram representation achieved the highest accuracy of 96.98% under full-feature conditions. Surprisingly, under aggressive feature reduction, the 1-gram representation consistently outperformed higher-order N-grams across all reduced feature subsets, indicating greater robustness in low-dimensional feature spaces. Statistical significance analysis using paired t-test and Wilcoxon signed-rank test further confirmed significant performance differences between 1-gram and higher-order N-gram representations. Although higher-order N-grams provide richer contextual and more discriminative behavioral representations, their information becomes increasingly fragmented in sparse feature spaces, reducing effectiveness under extreme dimensionality reduction. Furthermore, aggressive feature selection substantially improved computational efficiency, reducing the execution time of the 4-gram representation from 3000.78 seconds to 8.28 seconds under the Top-100 scenario. Overall, the findings reveal a trade-off between contextual richness, feature sparsity, detection performance, and computational efficiency in system call N-gram-based Android malware detection.]]>
Copyrights © 2026
