Work

SACD: Robust and Interpretable Android Malware Detection in Mobile and IoT Environments

Year: 2026

Type: article

Abstract: For Android malware detection in mobile and Internet-of-Things (IoT) environments, we need effective solutions that keep pace with the evolution of the Android ecosystem. Existing detectors commonly use syntactic instructions, system calls, and program structures to capture behavioral semantics. However, Android applications (apps) frequently exhibit evolving Application Programming Interfaces (APIs), causing intra-class concept drift within malware families. We propose SACD, a robust and interpretable detector, to mitigate such drift. SACD centers on stable features by screening security-relevant API calls via expert knowledge. To enhance detection accuracy, it treats these APIs as anchors and enriches them by constructing structural contexts, thereby providing stable behavioral views beyond individual API occurrences. For decision-making, SACD encodes structural contexts using lemmatization-based semantic embeddings, processes them with graph neural network modules, and aggregates the resulting graphical representations through gated-attention multiple-instance learning. Moreover, learned attention weights can support natural-language explanations. We conduct experiments on 42,227 Android apps spanning from the year of 2011 to 2021. The experimental results demonstrate that SACD outperforms representative baselines under both in-distribution malware detection and cross-year detection. It also remains stable under obfuscation transformations and maintains malware recall under problem-space perturbations.

Source: IEEE Internet of Things Journal

DOI: 10.1109/jiot.2026.3726951