Android malware detection by using graph optimization of static features based on pre-trained language models

The Android platform is the dominant mobile operating system, making it a prime target for malware attacks. The increasing complexity of Android malware necessitates advanced detection methods that integrate modern machine learning techniques with security analysis. This study aims to enhance Android malware detection and classification by leveraging pre-trained language models (PLMs) alongside graph learning techniques. The primary objective is to address challenges in transforming graph-based data into a format compatible with PLMs while preserving essential relational information. We propose APSDroid, a novel approach that combines permissions-intents (PIs) and API call graphs (ACGs) for Android malware analysis. APSDroid explores two distinct fusion strategies: raw-data-level fusion and feature-level fusion (including concatenation, self-attention, and cross-attention mechanisms) to evaluate their effectiveness in enriching semantic representations and improving detection robustness. The approach also incorporates forensic analysis to extract meaningful behavioral patterns and graph optimization techniques based on community detection and centrality measures to reduce complexity while retaining contextual flow. Experiments conducted on the CICMalDroid2020 dataset demonstrate the effectiveness of APSDroid. The model achieved an accuracy of 97.40% in malware detection and 94.23% in malware category classification. Furthermore, APSDroid with attention-based fusion mechanisms (e.g., self-attention and cross-attention) remained highly robust against obfuscation techniques, achieving 98.69% F1-score in binary classification and 83.98% in multi-class classification, outperforming several SOTA methods. APSDroid provides a robust and scalable solution for Android malware detection by integrating PLMs with optimized graph-based representations. This approach enhances malware analysis while addressing key challenges related to computational efficiency and relational data preservation. Future research will focus on improving scalability and extending APSDroid to detect emerging malware variants.