A UNIFIED HYBRID DEEP LEARNING ARCHITECTURE FOR ANDROID MALWARE DETECTION AND CLOUD HONEYPOT INTRUSION IDENTIFICATION USING LIGHTGBM-DRIVEN QUANTUM DILATED CONVOLUTIONAL FUZZY MAXOUT NETWORK (LGBM-QDCFMNET)

Abstract

Both mobile devices powered by Android OS and cloud computing architectures constitute valuable attack targets within the modern cybersecurity scenario. Specifically, Android smartphones which make up more than seventy percent of the global mobile market face constant exposure to novel types of malwares that leave legacy signature-based detection mechanisms insufficient. Moreover, intrusions into cloud computing infrastructures usually involve sophisticated attacks bypassing standard firewalls and rule-based intrusion prevention systems, hence making honeypots essential in identifying security threats. While two recent works managed to address these problems separately, with the former proposing the Quantum Dilated Convolutional Fuzzy Maxout Network (QDCFMNet) for intrusion detection in cloud environments and the latter presenting a tuned version of the LightGBM classifier for detecting Android malware, none of the two could provide any means of detecting threats across these distinct areas. To fill this gap, this paper presents LGBM-QDCFMNet—a new model which combines the output of the feature embedding stage of the LightGBM algorithm with raw data through Deep Kronecker Networks (DKN) followed by QDCFMNet-based processing. SMOTE balances the classes, Bayesian Optimization handles the tuning procedure, and SHAP allows post-analysis interpretability. When trained on both CICAndMal2017 and AWS Honeypot Attack datasets, the proposed solution delivers 98.34% accuracy, 94.21% precision, 93.87% recall rate, and F1-score of 94.04%, clearly outperforming all baselines introduced in both prior works.

Math. Subj. Classification 2020: 68M25 Computer security, 68U35 Information systems, 68M10 Network design and communication, 68T27 Logic in artificial intelligence, 68T27 Logic in artificial intelligence.