Interpretable by Design: MH-AutoML for Transparent and Efficient Android Malware Detection without Compromising Performance
This work addresses the need for transparent and efficient malware detection tools for cybersecurity practitioners, though it is incremental as it builds on existing AutoML approaches with domain-specific enhancements.
The authors tackled the problem of black-box AutoML systems in Android malware detection by developing MH-AutoML, a domain-specific framework that automates the ML pipeline while incorporating interpretability features, achieving better recall rates compared to seven established AutoML frameworks.
Malware detection in Android systems requires both cybersecurity expertise and machine learning (ML) techniques. Automated Machine Learning (AutoML) has emerged as an approach to simplify ML development by reducing the need for specialized knowledge. However, current AutoML solutions typically operate as black-box systems with limited transparency, interpretability, and experiment traceability. To address these limitations, we present MH-AutoML, a domain-specific framework for Android malware detection. MH-AutoML automates the entire ML pipeline, including data preprocessing, feature engineering, algorithm selection, and hyperparameter tuning. The framework incorporates capabilities for interpretability, debugging, and experiment tracking that are often missing in general-purpose solutions. In this study, we compare MH-AutoML against seven established AutoML frameworks: Auto-Sklearn, AutoGluon, TPOT, HyperGBM, Auto-PyTorch, LightAutoML, and MLJAR. Results show that MH-AutoML achieves better recall rates while providing more transparency and control. The framework maintains computational efficiency comparable to other solutions, making it suitable for cybersecurity applications where both performance and explainability matter.