 ICACT20260079 Slide.01
[Big Slide]
[YouTube] |
Chrome  Click!! |
 |
Hi everybody, my name is Junior Okangondo Loshima. Today, I will be presenting our research entitled “Deep Learning for Android Forensic Analysis: A Multimodal Hybrid Fusion Framework,” which proposes a real-time, optimized, and explainable multimodal deep learning architecture for detecting malicious activities on Android devices. |
| ICACT20260079 Slide.02
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Android dominates the global smartphone market, making it the main target of mobile cyberattacks. Modern malware has become polymorphic and stealthy, which challenges traditional detection methods. |
| ICACT20260079 Slide.03
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Most existing solutions analyze Android artifacts separately and lack real-time multimodal integration. They are also poorly optimized for mobile deployment and rarely provide judicial-level explainability. |
| ICACT20260079 Slide.04
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Our research investigates how to design a multimodal deep learning architecture that is real-time, optimized for smartphones, and legally explainable. The goal is to correlate static, dynamic, and network forensic evidence efficiently. |
| ICACT20260079 Slide.05
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
We propose a hybrid CNN–LSTM–Autoencoder architecture using early and late fusion. The framework integrates embedded optimization, explainability tools, and real-world Android validation. |
| ICACT20260079 Slide.06
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
CNNs efficiently analyze static APK structures such as permissions and entropy patterns. They provide fast and robust detection of malicious code features. |
| ICACT20260079 Slide.07
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
LSTMs model temporal behaviors in system calls and execution traces. They capture sequential patterns that reveal stealthy malware activities. |
| ICACT20260079 Slide.08
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Autoencoders compress network traffic data and learn normal communication behavior. They help detect latent anomalies in encrypted flows. |
| ICACT20260079 Slide.09
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Existing research on Android malware detection primarily relies on hybrid deep learning approaches that combine multiple models to improve classification performance. Lu et al. proposed the integration of Deep Belief Networks (DBN) with Gated Recurrent Units (GRU) to capture both static and temporal characteristics; however, this approach remains computationally expensive and poorly suited for resource-constrained environments. Zhu et al. combined Convolutional Neural Networks with Long Short-Term Memory networks to model dynamic application behaviors, but their solution suffers from slow inference times. In contrast, Sahu et al. employed a CNN combined with XGBoost, achieving effective static feature classification while exhibiting limited capability in modeling sequential dependencies. To address these limitations, our work introduces a CNN–LSTM–Autoencoder hybrid multimodal fusion architecture specifically optimized for Android environments, achieving a better balance between detection accuracy, computational efficiency, and deployability. |
| ICACT20260079 Slide.10
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Current systems lack real multimodal fusion, mobile optimization, and judicial explainability. Field evaluations are also very limited. |
| ICACT20260079 Slide.11
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
We use Drebin, CIC-AndMal2017, and real Android captures to build a large multimodal dataset. A total of 15,660 samples were used for training and testing. |
| ICACT20260079 Slide.12
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
We extract permissions, system call sequences, and network flow fingerprints. These features represent static, dynamic, and network behaviors. |
| ICACT20260079 Slide.13
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The proposed architecture is organized as a modular multimodal forensic pipeline. It begins with an artifact collection module that gathers static, dynamic, and network evidence from Android applications. These heterogeneous inputs are then processed by a preprocessing and normalization module, where CNNs handle static features, stacked LSTMs model temporal behavioral sequences, and autoencoders learn compact representations of network traffic. The extracted features are forwarded to a unified feature representation module and subsequently combined through a fusion and classification module, enabling joint decision-making across modalities. Finally, an optimization and deployment module applies model compression and tuning techniques to ensure efficient execution on Android devices. The entire architecture is trained using the Adam optimizer with dropout regularization and early stopping to improve generalization and prevent overfitting. |
| ICACT20260079 Slide.14
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
We apply early fusion for joint feature learning and late fusion for decision aggregation. Weighted voting ensures robust final classification. |
| ICACT20260079 Slide.15
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
We optimize the model using pruning, quantization, transfer learning, and incremental learning. The model size was reduced from 52 MB to 18 MB. |
| ICACT20260079 Slide.16
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The experimental results demonstrate that the proposed hybrid fusion model significantly outperforms the individual CNN and LSTM models during training and validation. While the standalone CNN and LSTM achieve competitive accuracy and F1-scores, the hybrid architecture attains the highest performance with 96.9% accuracy and a 95.7% F1-score. Importantly, this performance gain is achieved without sacrificing efficiency, as the hybrid model maintains a low inference latency of approximately 20 ms, comparable to the unimodal models. These results confirm that multimodal fusion effectively enhances detection accuracy while remaining suitable for near real-time deployment on Android devices. |
| ICACT20260079 Slide.17
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The evaluation conducted under real Android deployment conditions demonstrates the robustness and effectiveness of the proposed hybrid fusion model. Compared to the standalone CNN and LSTM models, the hybrid approach achieves the highest accuracy at 95.4% while simultaneously maintaining the lowest false positive rate of 3.8%. These results indicate a substantial improvement in detection reliability, which is critical in forensic applications where minimizing false alarms is essential. The performance gains observed in real-world environments further confirm the suitability of the proposed architecture for practical Android forensic deployment. |
| ICACT20260079 Slide.18
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
The discussion highlights the effectiveness and reliability of the proposed hybrid fusion framework. Statistical validation using the Wilcoxon signed-rank test confirms that the observed performance improvements over unimodal models are statistically significant and not due to random variation. Beyond accuracy gains, the framework demonstrates practical viability by achieving near real-time detection with an average inference latency of approximately 20 ms. These results indicate that the proposed architecture successfully balances detection performance and computational efficiency, making it suitable for deployment in real-world Android forensic scenarios where both accuracy and responsiveness are critical. |
| ICACT20260079 Slide.19
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Future research will focus on enhancing the adaptability and scalability of the proposed framework through adaptive incremental learning mechanisms, enabling continuous model updates in response to emerging threats. In addition, federated learning will be explored to support collaborative training across multiple devices while preserving data privacy. Beyond Android environments, the framework will be extended to IoT and 5G ecosystems to address broader cybersecurity challenges. Finally, efforts will be directed toward achieving judicial-level certification to ensure the reliability and admissibility of the proposed system in legal and forensic contexts. |
| ICACT20260079 Slide.20
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
In this work, we proposed a hybrid multimodal deep learning architecture for Android forensic analysis that effectively combines CNNs, LSTMs, and autoencoders to analyze heterogeneous forensic artifacts. The experimental results demonstrate that the proposed framework achieves high detection accuracy under real-world conditions while maintaining a false positive rate below 4%. In addition to its strong performance, the model is optimized for mobile deployment, making it suitable for practical and scalable Android forensic applications. |
| ICACT20260079 Slide.21
[Big Slide]
[YouTube] |
Chrome Click!! |
 |
Thank you very much for your attention.
I would be happy to answer any questions you may have. |
