Android malware continues to evolve, posing significant challenges in generalization, fine-grained detection, and interpretability for existing detection systems. Existing methods struggle to generalize to unseen malware, lack fine-grained behavioral understanding, and provide limited interpretability due to their reliance on rigid rules or the inability to recover complete causal behavior paths. To this end, we present ForeDroid, a unified and interpretable framework for Android malware detection and explanation via scenario-aware analysis. ForeDroid models malicious intent as behavioral inconsistencies within functional scenarios. It clusters semantically coherent scenarios, extracts sensitive API call chains, and summarizes them into natural language using LLMs. These summaries are embedded and compared against benign behavior distributions within the same scenario for unsupervised anomaly detection. High-risk behaviors showing strong semantic inconsistency are further interpreted by an LLM-driven module that generates fine-grained anomaly reports. We evaluated ForeDroid on two challenging tasks: zero-day malware detection and fine-grained behavior analysis. The result shows ForeDroid outperforms MaMaDroid, MalScan, DeepRefiner, and a continuous learning-based approach in zero-day malware detection under the temporal-split setting. Besides, ForeDroid achieves an F1-score of 0.94 in fine-grained behavior detection on the manually annotated GPMalware dataset, surpassing ProMal. Our results demonstrate ForeDroid's ability to bridge low-level call graph analysis with high-level semantic reasoning, making it a practical, interpretable solution for malware detection.

Malware family labels and key features used for the decision-making of Android malware detection models fall short of precise comprehension of malicious behaviors due to their coarse granularity. To solve these problems, in this paper, we first introduce the concept of the malicious behavior trajectory ( MBT ) and propose an innovative approach called ProMal . ProMal aims to automatically generate malware descriptions with fine granularity through extracted MBTs from malware for users. Specifically, a labeled dataset of MBTs is constructed through substantial human efforts to build a behavioral knowledge graph ( BxKG ). The BxKG is scalable and can be automatically updated using two strategies to ensure its completeness and timeliness: 1) taking into consideration the evolution of Android SDKs, and 2) mining new MBTs by leveraging the widely-used malware datasets. We highlight that the knowledge graph is essential in ProMal , which can reason new MBTs based on existing MBTs because of its structured data representation and semantic relation modeling, and thus helps effectively extract real MBTs in Android malware. We evaluated ProMal on a recent malware dataset where researcher-crafted malware descriptions are available, and the Precision, Recall, and F1-Score of MBT identification based on BxKG reached 96.97%, 91.43%, and 0.94, respectively, outperforming the state-of-the-art approaches. Taking MBTs identified from Android malware as inputs, precise, fine-grained, and human-readable descriptions can be generated using the large language model, whose readability and usability are verified through a user study. The generated descriptions play a significant role in interpreting and comprehending malware behaviors.

To reduce the attack surface from app source code, massive tools focus on detecting security vulnerabilities in Android apps. However, some obvious weaknesses have been highlighted in the previous studies. For example, (1) most of the available tools such as AndroBugs, MobSF, Qark, and Super use pattern-based methods to detect security vulnerabilities. Although they are effective in detecting some types of vulnerabilities, a large number of false positives would be introduced, which inevitably increases the patching overhead for app developers. (2) Similarly, static taint analysis tools such as FlowDroid and IccTA present hundreds of vulnerability candidates of data leakage instead of confirmed vulnerabilities. (3) Last but not least, a relatively complete vulnerability taxonomy is missing, which would introduce a lot of false negatives. In this paper, based on our prior knowledge in this research domain, we empirically propose a vulnerability taxonomy as the baseline and then extend AUSERA by augmenting the detection capability to 50 security vulnerability types. Meanwhile, a new benchmark dataset including all these 50 vulnerability types is constructed to demonstrate the effectiveness of AUSERA. The tool and datasets are available at https://github.com/tjusenchen/AUSERA and the demonstration video can be found at https://youtu.be/UCiGwVaFPpY.