Separating Behavioral Effect from Predictive Value in Dynamic Android Malware Detection: An Empirical Decomposition Study
Year: 2026
Type: preprint
Abstract: Dynamic Android malware detectors routinely combine behavioral views, but a reported score rarely separates class discrimination, execution-exposure effects, redundancy, and incremental value. This paper measures that separation empirically; it does not propose a new representation-learning or fusion mechanism. We use a study-specific paired corpus built from AndroZoo applications. After 300- s AndroPyTool executions, SHA-256 reconciliation and output-quality control reduced 13,654 audited unique APKs to a common predictive cohort of 11,457 applications (5,525 benign and 5,932 malware) with usable Strace and DroidBox outputs. We extracted 122 syscall features, actual execution duration, three compact same-PID sequence descriptors, and 74 DroidBox runtime features. Behavioral effects used rank-based statistics and Fisher exact tests under Benjamini-Hochberg correction; prediction used five-fold outer, three-fold inner nested cross-validation. Five core representations were tested across seven model families, compact-sequence increments with the three primary models, and paired class-stratified bootstrap analysis used pooled out-of-fold predictions. Execution duration was strongly associated with total syscall volume (Spearman ρ ≈ 0.727); per-runtime rates reduced the median absolute feature-duration association from 0.254 to 0.129 (about 49%) but did not consistently improve discrimination. Same-PID ordering was behaviorally rich, with 773 of 1,142 bigrams and 4,411 of 5,956 trigrams significant after this correction, yet the compact descriptors added little after fusion. Strace and DroidBox provided reciprocal incremental gains, and fusion outperformed the best singlemodality representation across all seven model families, with XGBoost reaching the highest observed fold-mean ROC-AUC (0.947) and PR-AUC (0.952). Behavioral enrichment and predictive utility are therefore distinct properties of a dynamic representation.
Source: Research Square
Authors: Özgür TONKAL, Hakkı Batuhan SÜTÇÜ
Institution: Samsun University
Language: English
Subfield: Software
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7225325462