Jun 2025· International Journal of Information Security· Vol 25· 1 citation· 29 references
Computer Science
TL;DR
This work compiled a dataset of benign and malicious APKs and performed static analysis to extract features such as code structure, permissions, and manifest file content, without executing the apps, and used an LLM to generate high-level functional descriptions of APKs.
Abstract
The widespread use of Android applications has made them a prime target for cyberattacks, significantly increasing the risk of malware that threatens user privacy, security, and device functionality. Effective malware detection is thus critical, with static analysis, dynamic analysis, and Machine Learning being widely used approaches. In this work, we focus on a Machine Learning-based method utilizing static features. We first compiled a dataset of benign and malicious APKs and performed static analysis to extract features such as code structure, permissions, and manifest file content, without executing the apps. Instead of relying solely on raw static features, our system uses an LLM to generate high-level functional descriptions of APKs. To mitigate hallucinations, which are a known vulnerability of LLMs, we integrated Retrieval-Augmented Generation (RAG), enabling the LLM to ground its output in a relevant context. Using carefully designed prompts, we guide the LLM to produce coherent function summaries, which are then analyzed using a transformer-based model for binary classification.
The Android Malware Detection System provides a comprehensive, reliable, and user-friendly platform to safeguard mobile ecosystems against emerging threats, combining technical rigor with accessibility.
G. Vamsi, V. S. Vinay· International Scientific Jou...· 1 citation
The Android platform accounts for the overwhelming majority of mobile devices in use worldwide, and that dominance has made it the principal target for authors of mobile malware [1], [2]. Applications distributed outside curated stores routinely abuse the permission model, conceal payloads behind obfuscation, or masquerade as repackaged versions of trusted banking and utility software. Detection schemes built on static signatures cannot follow threats that mutate between releases, and while machine learning classifiers have improved raw detection rates considerably, most of them return a bare verdict that an analyst has no means of interrogating. This paper describes a static analysis framework for Android malware detection that couples a LightGBM classifier with SHapley Additive exPlanations and a mapping layer built on the MITRE ATT&CK knowledge base. Features are drawn exclusively from the application manifest, which keeps extraction inexpensive and avoids the provenance artefacts observed when heterogeneous feature families are combined. Trained and evaluated on the AndroMD dataset and benchmarked against XGBoost, Random Forest and CatBoost under identical conditions, the proposed model attained 99.13% accuracy, a 99.84% ROC-AUC and a Matthews correlation coefficient of 98.26% while completing training in 27.84 seconds, between forty and fifty-nine per cent faster than the competing ensembles. Every prediction is accompanied by a per-sample attribution identifying the permissions responsible for it, and samples judged malicious are additionally mapped onto adversary tactics and techniques. The pipeline is delivered as a Flask application, APKGuard, which accepts an uploaded package and returns a scored verdict, an explanation and a behavioural summary in a single pass.
Pavitra Murapala, L. Dr.· International Journal of Inn...· 0 citations
FUADroid is proposed, a static malware detection method that fuses structural and statistical-semantic views and achieves strong detection performance and exhibits improved robustness under cross-year evaluation settings.
Jiyun Yang, Fan Mei, Zheng-Dong Wan et al.· International Journal of Mac...· 0 citations
The rapid adoption of Android applications in mobile commerce has increased exposure to sophisticated malware capable of bypassing traditional security mechanisms through code obfuscation, dynamic code loading, and runtime-triggered malicious behaviors. Although static analysis offers efficient large-scale detection, it often fails to identify concealed runtime activities, while dynamic analysis provides richer behavioral evidence but suffers from limited execution coverage and high computational overhead. To address these complementary limitations, this paper proposes FusionDroid, a lightweight multimodal Android malware detection framework that integrates permission-based static features, permission co-occurrence graph representations, and engineered runtime behavioral features through probability-level ensemble fusion. The framework was evaluated using Android applications collected from the AndroZoo repository, comprising 24,055 valid applications for static analysis and a balanced paired benchmark of 1716 applications for multimodal evaluation. The experimental results show that complementary static and dynamic representations can improve Android malware detection, although the magnitude and nature of the improvement depend on class distribution and evaluation metric. The best-performing model, StackedFusion-LightGBM, achieved 93.31% accuracy, 96.86% precision, 89.53% recall, a 93.05% F1 score, 97.69% ROC–AUC, and 98.14% PR–AUC. A controlled five-fold evaluation on the common paired benchmark further showed an F1 score of 0.9175±0.0176 for the full Static+Graph+Dynamic configuration compared with 0.8781±0.0081 for the Static-only baseline. Paired statistical analysis further supported the improvement. These findings show that multimodal fusion can improve Android malware detection while preserving low-complexity manifest-derived representations. The results support FusionDroid as a staged, sandbox-assisted framework in which lightweight static analysis is complemented by runtime behavioral evidence when deeper inspection is required.
The results have shown how well-engineered static features coupled with overfitting-aware ensemble design can give robust results of multi-class malware classification in the absence of dynamic traces, to develop additional resilience from obfuscation and runtime-evasive threats.
H. Lamkuche, Mannat Pal· Journal of Computer Virology...· 0 citations
Experimental results demonstrate that the proposed approach achieves high classification performance while improving transparency in malware detection decisions, making it suitable for practical cybersecurity applications.
V. Padmapriya, S. Uma, S. Sumathi et al.· International journal of com...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
