Feature Rich Clustering Techniques for Android Malware Families

The rapid growth of the Android ecosystem has resulted in a significant increase in sophisticated malware targeting mobile devices. Traditional signature-based detection mechanisms are ineffective against obfuscated and zero-day variants, while supervised learning approaches rely heavily on labeled datasets and often fail to generalize to newly emerging malware families. To address these limitations, this paper proposes a feature-rich unsupervised clustering framework for Android malware family classification that integrates deep embedding representation learning with spectral clustering and HDBSCAN. The approach leverages syscall-binder frequency features to capture fine-grained behavioral characteristics of malware samples. Feature normalization and dimensionality reduction are applied to mitigate high-dimensional sparsity and redundancy. A neural network-based encoder then learns compact latent representations that improve structural separability in the embedding space. Spectral clustering is employed to capture complex non-linear relationships, while HDBSCAN enhances robustness by identifying clusters of varying density and filtering noise samples. The experimental results show that Spectral clusteringachieves 0.8993 in terms of normalized mutual information(NMI),0.9365 in terms of adjusted rand index (ARI) demonstrates that the proposed framework outperforms conventional clustering techniques such as K-Means and standalone density-based methods. The results indicate improved cluster cohesion, inter-family separation, and scalability, making the proposed framework suitable for largescale Android malware family analysis.