Hybrid Machine Learning Model for Android Ransomware Detection Using URL-Based Features
Meenakshi Jalandra -, Megha Kuliha, Jasmeet Kaur · International Journal on Science and Technology · 2025
With the rapidly evolving cybersecurity landscape, ransomware – which primarily targets Android systems via malicious URLs – has become a serious concern. This work explores the use of supervised machine learning models for accurate and early ransomware detection. We compared the performance of Random Forest, Light GBM, SVM, Logistic Regression, and Naive Bayes in handling complex, high- dimensional data. The results obtained from these models were compared and light GBM and Random Forest showed accurate and robust results that were significantly better than other models. Using these results, we integrated them into a hybrid model. Deep feature interactions are better captured using Multi-Layer Perceptron (MLP) In the dynamic era of cybersecurity, the growing number of ransomware is emerging as a serious threat, especially on the Android platform, with URL threat emerging as a new fraud. This paper works on detecting URL ransomware threats in Android and presents a hybrid MAC layering model for the same. The results emphasize the effectiveness of URL type identification and multiple accurate intelligent identification of ransomware and dangerous URLs compared to traditional URL based detection. Future work includes scalable analysis and aggregation of real- time analysis. To improve the model performance and get better results, a hybrid model was built by taking the best outputs of both Random Forest and Light GBM models and combining them into an ensemble of Multi-Layer Perceptrons (MLP) and getting better outputs at different layers. This model was able to detect URLs well and used both static and dynamic URLs from the data set which proved helpful in reactive threat detection. Future extensions of this study may also include applying deep neural networks and deep learning on industrial and URL data to accurately identify URLs in real-time.