From Signals to Behaviors: Evidence-Based Android Malware Detection

2026-07-25

AI Summary

This work addresses the limitations of existing Android malware detection approaches, which rely on superficial features and consequently suffer from high false positives on benign anomalous apps and poor detection of novel malware that masquerades as normal. To overcome these issues, the authors propose Praxis, a novel behavior-centric detection paradigm that operates through a three-stage “hypothesize–verify–judge” pipeline: it first generates behavioral hypotheses from static signals, then verifies their implementation in code via program analysis, and finally makes holistic judgments by integrating user perception, functional context, and behavioral combinations. This approach yields an interpretable, evidence-driven detection framework that achieves an F1 score of 87.4% across three challenging scenarios—outperforming baseline methods by 18.6 to 34.8 percentage points—and reduces false positives on privileged benign apps to 13.0%, while attaining a behavior-level F1 of 87.3%, surpassing prior techniques by 56.5 to 73.4 percentage points.

Abstract

Android malware remains a persistent threat, and detecting it accurately is a long-standing open problem. Whether an app is malicious depends on what it actually does and the context in which it does it, not on the surface signals it happens to exhibit. Existing detectors instead reason about proxies for behavior, such as learned features or local code slices, and flag whatever deviates from these proxies as malicious. But deviation is not maliciousness: benign apps that merely look unusual are over-flagged, evolving malware that looks ordinary slips through. We argue that detection should be behavior-oriented: recover an app's potentially malicious behaviors and judge which are truly malicious. To realize this, we present Praxis, which structures detection as a hypothesize-confirm-judge pipeline: it hypothesizes candidate behaviors from coarse static signals, confirms each by grounding it in code evidence verified with program analysis, and judges the confirmed behaviors in context: the user's awareness, the app's functional context, and how they compose into an attack. For a malicious app, Praxis returns a verdict and the supported behaviors. We evaluate Praxis against seven baselines across three challenging settings. It achieves the best overall detection performance (87.4% F1), outperforming the baselines by 18.6-34.8 percentage points. On high-permission benign apps, it reduces the false-positive rate to 13.0%, a reduction of 41.1-67.0 percentage points compared with the baselines. Beyond binary detection, Praxis recovers fine-grained malicious behaviors at 87.3% F1, outperforming prior behavior-level approaches by 56.5-73.4 percentage points. Ablation studies show that each stage of the pipeline contributes to the final performance.

Problem

• Android malware detection
• behavior-oriented detection
• false positives
• malicious behavior identification
• context-aware analysis

Innovation

• behavior-oriented detection
• hypothesize-confirm-judge pipeline
• program analysis
• Android malware
• fine-grained behavior recovery