Jul 2026· International Journal of Machine Learning and Cybernetics· Vol 17· 0 citations· 44 references
Computer Science
TL;DR
FUADroid is proposed, a static malware detection method that fuses structural and statistical-semantic views and achieves strong detection performance and exhibits improved robustness under cross-year evaluation settings.
The results have shown how well-engineered static features coupled with overfitting-aware ensemble design can give robust results of multi-class malware classification in the absence of dynamic traces, to develop additional resilience from obfuscation and runtime-evasive threats.
H. Lamkuche, Mannat Pal· Journal of Computer Virology...· 0 citations
The rapid adoption of Android applications in mobile commerce has increased exposure to sophisticated malware capable of bypassing traditional security mechanisms through code obfuscation, dynamic code loading, and runtime-triggered malicious behaviors. Although static analysis offers efficient large-scale detection, it often fails to identify concealed runtime activities, while dynamic analysis provides richer behavioral evidence but suffers from limited execution coverage and high computational overhead. To address these complementary limitations, this paper proposes FusionDroid, a lightweight multimodal Android malware detection framework that integrates permission-based static features, permission co-occurrence graph representations, and engineered runtime behavioral features through probability-level ensemble fusion. The framework was evaluated using Android applications collected from the AndroZoo repository, comprising 24,055 valid applications for static analysis and a balanced paired benchmark of 1716 applications for multimodal evaluation. The experimental results show that complementary static and dynamic representations can improve Android malware detection, although the magnitude and nature of the improvement depend on class distribution and evaluation metric. The best-performing model, StackedFusion-LightGBM, achieved 93.31% accuracy, 96.86% precision, 89.53% recall, a 93.05% F1 score, 97.69% ROC–AUC, and 98.14% PR–AUC. A controlled five-fold evaluation on the common paired benchmark further showed an F1 score of 0.9175±0.0176 for the full Static+Graph+Dynamic configuration compared with 0.8781±0.0081 for the Static-only baseline. Paired statistical analysis further supported the improvement. These findings show that multimodal fusion can improve Android malware detection while preserving low-complexity manifest-derived representations. The results support FusionDroid as a staged, sandbox-assisted framework in which lightweight static analysis is complemented by runtime behavioral evidence when deeper inspection is required.
This work compiled a dataset of benign and malicious APKs and performed static analysis to extract features such as code structure, permissions, and manifest file content, without executing the apps, and used an LLM to generate high-level functional descriptions of APKs.
Saraga Sakthidharan, S. Anagha, Dincy R. Arikkat et al.· International Journal of Inf...· 1 citation
An intelligent Android malware detection framework that combines deep learning with the Equilibrium Optimizer to improve detection performance is presented, providing an effective and reliable solution for securing Android devices against evolving malware threats.
Aishwarya Eklar, G.Rajini· International Journal of Eng...· 0 citations
The Android ecosystem faces persistent and rapidly evolving malware threats. Existing machine learning detectors are vulnerable to concept drift because they rely on implementation-specific features whose distributions change over time. Large language models (LLMs) offer strong semantic understanding and zero-shot reasoning, but current LLM-based detectors typically depend on code-centric or single-dimensional evidence, making them susceptible to obfuscation and limiting comprehensive behavior analysis. We present {\sysname}, a multimodal agent collaborative framework for dynamic Android malware detection. {\sysname} dynamically collects multimodal runtime evidence and employs ReAct-based specialized agents to analyze complementary behavioral views. The detection process begins by identifying visual deception cues, modeling UI state transitions, and integrating runtime API behaviors to fuse multi-dimensional evidence across user-visible interfaces and hidden backend operations. Experiments on temporally and distributionally unseen datasets show that {\sysname} achieves an accuracy of 90.06\% without fine-tuning, outperforming state-of-the-art baselines and demonstrating strong zero-shot generalization against Android malware concept drift.
Xueying Zeng, Youquan Xian, Yanze Li et al.· 0 citations
Despite outstanding results, machine learning-based Android malware detection models struggle with concept drift, where rapidly evolving malware characteristics degrade model effectiveness. This study examines the impact of concept drift on Android malware detection, evaluating two datasets and nine machine learning and deep learning algorithms, as well as Large Language Models (LLMs). Various feature types—static, dynamic, hybrid, textual, and image-based—were considered. The results showed that concept drift is widespread and significantly affects model performance. Factors influencing the drift include feature types, data environments, and detection methods. Balancing algorithms help with class imbalance but do not fully address drift, which primarily stems from the dynamic nature of malware. No strong link was found between the type of algorithm used and concept drift; the impact was relatively minor compared to other variables because hyperparameters were not fine-tuned, and the default algorithm configurations were used. The LLM evaluation is treated as an exploratory baseline because the original feature spaces were compressed using PCA to satisfy token-length constraints. Under this setting, LLMs showed promising few-shot performance but remained sensitive to temporal drift.
Ahmed Sabbah, Mohammed F. Kharma, Radi Jarrar et al.· Journal of Cybersecurity and...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
