Android malware continues to evolve, posing significant challenges in generalization, fine-grained detection, and interpretability for existing detection systems. Existing methods struggle to generalize to unseen malware, lack fine-grained behavioral understanding, and provide limited interpretability due to their reliance on rigid rules or the inability to recover complete causal behavior paths. To this end, we present ForeDroid, a unified and interpretable framework for Android malware detection and explanation via scenario-aware analysis. ForeDroid models malicious intent as behavioral inconsistencies within functional scenarios. It clusters semantically coherent scenarios, extracts sensitive API call chains, and summarizes them into natural language using LLMs. These summaries are embedded and compared against benign behavior distributions within the same scenario for unsupervised anomaly detection. High-risk behaviors showing strong semantic inconsistency are further interpreted by an LLM-driven module that generates fine-grained anomaly reports. We evaluated ForeDroid on two challenging tasks: zero-day malware detection and fine-grained behavior analysis. The result shows ForeDroid outperforms MaMaDroid, MalScan, DeepRefiner, and a continuous learning-based approach in zero-day malware detection under the temporal-split setting. Besides, ForeDroid achieves an F1-score of 0.94 in fine-grained behavior detection on the manually annotated GPMalware dataset, surpassing ProMal. Our results demonstrate ForeDroid's ability to bridge low-level call graph analysis with high-level semantic reasoning, making it a practical, interpretable solution for malware detection.

Malware family labels and key features used for the decision-making of Android malware detection models fall short of precise comprehension of malicious behaviors due to their coarse granularity. To solve these problems, in this paper, we first introduce the concept of the malicious behavior trajectory ( MBT ) and propose an innovative approach called ProMal . ProMal aims to automatically generate malware descriptions with fine granularity through extracted MBTs from malware for users. Specifically, a labeled dataset of MBTs is constructed through substantial human efforts to build a behavioral knowledge graph ( BxKG ). The BxKG is scalable and can be automatically updated using two strategies to ensure its completeness and timeliness: 1) taking into consideration the evolution of Android SDKs, and 2) mining new MBTs by leveraging the widely-used malware datasets. We highlight that the knowledge graph is essential in ProMal , which can reason new MBTs based on existing MBTs because of its structured data representation and semantic relation modeling, and thus helps effectively extract real MBTs in Android malware. We evaluated ProMal on a recent malware dataset where researcher-crafted malware descriptions are available, and the Precision, Recall, and F1-Score of MBT identification based on BxKG reached 96.97%, 91.43%, and 0.94, respectively, outperforming the state-of-the-art approaches. Taking MBTs identified from Android malware as inputs, precise, fine-grained, and human-readable descriptions can be generated using the large language model, whose readability and usability are verified through a user study. The generated descriptions play a significant role in interpreting and comprehending malware behaviors.