An Ensemble Approach Based on Fuzzy Logic Using Machine Learning Classifiers for Android Malware Detection

Round 1

Reviewer 1 Report

In this paper, the authors suggested using Mamdani-type fuzzy inference system (FIS) for combining the outputs of ML-based methods. 

Suggestions and remarks:

1)In the abstract: authors by mistake repeat the accuracy measure twice in the following sentence “The obtained results showed us that the FL-BDE model had a much  higher performance than the ML-based models with an accuracy of 0.9933, sensitivity of 1.00, specificity of 0.98.67, accuracy of 0.9868, and F-measure of 0.9934”. Please correct the second with “precision” or the appropriate measure

2)In Section 2. Literature Review:

- I suggest that authors should focus more on the previous works that applied the ensemble and hybrid methods. The standalone and single classifiers applied in Android malware detection can be summarized in one paragraph.

- At the end of this section, the authors should explain how different the proposed work about the previous works mentioned in this section.

3) In Section 3.3. Performance Assessment: Figure 4. is not clear

4) In Section 4. Results and Discussion:

 

The authors compared the proposed FL-BDE Method only with single classifiers such as SVM, LR, BPM, BDT, DF, and NN. I suggest also adding comparison results of the proposed FL-BDE Method against common ensemble classifiers used in literature as mentioned in Section 2 such as a Bagging classifier, Adaboost, stacking, and Random Forest 

Author Response

Dear  Reviewer,

Thank you for the reviewers’ comments concerning my manuscript entitled “An Ensemble Approach Based on Fuzzy Logic Using Machine Learning Classifiers for Android Malware Detection”. Those comments are all valuable and very helpful for revising and improving my manuscript, as well as the important guiding significance to my studies. I have studied comments carefully and have done all corrections. The responses to the reviewer comments are enclosed attached file.

Best regards,

İsmail ATACAK

Author Response File: Author Response.docx

Reviewer 2 Report

The paper proposes a fuzzy logic-based model to detect Android malware. The idea is to combine 6 ML algorithms through a voting process, the obtained scores are sent to a fuzzy inference system to determine the malicious score of the input sample. The paper is well written and easy to understand. However, the novelty of the work is limited. Also, the paper contains several weaknesses that the authors should take into consideration:

- The choice of the feature selection method is not justified. Why did you use the Fisher-score method even though there are other techniques more recent? Why did you choose to select only the 50 best features?

- In the voting process, it is not clear how the weight values are obtained.

- In the Combining scores subsection, the FIS outputs named D0, D1, ..., D12 and Table 1 need more explanation.

- Figure 4 is of poor quality; it is better to describe the evaluation measures in a textual format.

- The experimental tests are performed by dividing the dataset into training and testing data with two different ratios 0.6 and 0.7. In my opinion it would be better to opt for a k-fold cross validation.

- In Table 5, it is interesting to compare the performance of your approach with related works, however I find it unfair to say that your approach is better as long as the other works do not use the same datasets. 

Author Response

Dear Reviewer,

Thank you for the reviewers’ comments concerning my manuscript entitled “An Ensemble Approach Based on Fuzzy Logic Using Machine Learning Classifiers for Android Malware Detection”. Those comments are all valuable and very helpful for revising and improving my manuscript, as well as the important guiding significance to my studies. I have studied comments carefully and have done all corrections. The responses to the reviewer comments are enclosed attached file

Best regards,

İsmail ATACAK

Author Response File: Author Response.pdf

Round 2

Reviewer 2 Report

The authors have addressed the comments in a satisfactory way.