Interpretable by Design: MH-AutoML for Transparent and Efficient Android Malware Detection without Compromising Performance

TL;DR

This paper introduces MH-AutoML, a domain-specific AutoML framework for Android malware detection that emphasizes interpretability, transparency, and efficiency, outperforming existing solutions in recall and control.

Contribution

The paper presents MH-AutoML, a novel AutoML framework tailored for Android malware detection that integrates interpretability and experiment traceability without sacrificing performance.

Findings

MH-AutoML achieves higher recall rates than seven established AutoML frameworks.

It provides enhanced transparency, interpretability, and control over the ML pipeline.

The framework maintains computational efficiency comparable to existing AutoML solutions.

Abstract

Malware detection in Android systems requires both cybersecurity expertise and machine learning (ML) techniques. Automated Machine Learning (AutoML) has emerged as an approach to simplify ML development by reducing the need for specialized knowledge. However, current AutoML solutions typically operate as black-box systems with limited transparency, interpretability, and experiment traceability. To address these limitations, we present MH-AutoML, a domain-specific framework for Android malware detection. MH-AutoML automates the entire ML pipeline, including data preprocessing, feature engineering, algorithm selection, and hyperparameter tuning. The framework incorporates capabilities for interpretability, debugging, and experiment tracking that are often missing in general-purpose solutions. In this study, we compare MH-AutoML against seven established AutoML frameworks: Auto-Sklearn, AutoGluon, TPOT, HyperGBM, Auto-PyTorch, LightAutoML, and MLJAR. Results show that MH-AutoML achieves better recall rates while providing more transparency and control. The framework maintains computational efficiency comparable to other solutions, making it suitable for cybersecurity applications where both performance and explainability matter.