Anomaly-Score-Augmented Random Forest for Permission-Based Android Malware Detection: An Empirical Study on 29,999 Apps

Permission-based static analysis is still the workhorse of low-cost Android malware detection. But most published evaluations live on small curated subsets, report a single train-test split, and skip statistical analysis altogether. This study takes a different cut. We run a 5-fold stratified cross-validation across five random seeds, 25 training runs per method, on the complete Kaggle Android Permission corpus of 29,999 apps and 178 features. Six standard classifiers are compared head-to-head. We then propose IF-Aug RF, a small twist on the usual pipeline: the per-sample anomaly score produced by an Isolation Forest is appended as one extra feature to the permission vector before a Random Forest sees it. The proposed model lands at 74.00 % accuracy, macro F1 = 0.7028, and ROC-AUC = 0.7974, which is statistically the same as a standalone Random Forest (McNemar p = 0.94). LightGBM is the single-method champion at ROC-AUC 0.8145. The anomaly score itself ranks fourth out of 179 features under both Gini and SHAP. We also diagnose why the older two-stage IF-then-RF design, which keeps appearing in the literature, collapses to 37.54 % accuracy on this corpus. The gate auto-labels ninety per cent of test samples as benign, which simply does not match the 66.67 % malware base rate of rebalanced public datasets. Code, models, predictions, and figures are released for replication.

@article{R2026,
  title     = {Anomaly-Score-Augmented Random Forest for Permission-Based Android Malware Detection: An Empirical Study on 29,999 Apps},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {17},
  number    = {7},
  year      = {2026},
  publisher = {The Science and Information Organization},
  author    = {Harikrishnan P R and P. Periyasamy},
  doi       = {10.14569/IJACSA.2026.0170753},
  url       = {https://doi.org/10.14569/IJACSA.2026.0170753}
}