MARD: A Multi-Agent Framework for Robust Android Malware Detection Xueying Zeng⋆§ , Youquan Xian‡§ , Sihao Liu⋆ , Xudong Mou⋆ ,Yanze Li⋆ , Lei Cui‡ , Bo Li⋆ B ⋆ School of Computer Science and Engineering, Beihang University, Beijing, China
arXiv:2604.25264v1 [cs.CR] 28 Apr 2026
‡ School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China
Abstract—With the rapid evolution of Android applications, traditional machine learning-based detection models suffer from concept drift. Additionally, they are constrained by shallow features, lacking deep semantic understanding and interpretability of decisions. Although Large Language Models (LLMs) demonstrate remarkable semantic reasoning capabilities, directly processing massive raw code incurs prohibitive token overhead. Moreover, this approach fails to fully unleash the deep logical reasoning potential of LLMs within complex contexts. To address these limitations, we propose MARD, a multi-agent framework for robust Android malware detection. This framework effectively bridges the gap between the semantic understanding of LLMs and traditional static analysis. It treats underlying deterministic analysis engines as on-demand execution tools, while utilizing the LLM to orchestrate the entire decision-making process. By designing an autonomous multi-agent interaction mechanism based on the ReAct paradigm, MARD constructs a highly interpretable evidentiary chain for conviction. Furthermore, we radically reduce the total cost of conducting a deep analysis of a single complex APK to under $0.10. Evaluations demonstrate that, without any domain-specific fine-tuning, MARD achieves an F1 score of 93.46%. It not only outperforms continual learning baselines but also exhibits robustness against concept drift and strong cross-domain generalization capabilities in evaluations spanning up to five years. Index Terms—Malware Detection, Large Language Models, Concept Drift, Autonomous Processing
I. I NTRODUCTION The Android operating system occupies a dominant position in the mobile ecosystem, making it the primary target for global malware attacks and posing a severe security threat to hundreds of millions of users for an extended period [1], [2]. Consequently, both academia and industry are continuously committed to enhancing malware detection capabilities [3]– [8]. Early research primarily relied on extracting static features such as API calls [9]–[11], permissions [12], [13], and function call graphs [14]–[16]. These approaches utilized data-driven methods based on Machine Learning (ML) or Deep Learning (DL) to fit statistical patterns of malicious behavior on largescale training sets. However, with the rapid iteration of the Android ecosystem, the distribution of benign and malicious applications in shallow feature spaces has undergone significant shifts [17]. This causes detection models trained on historical data to face severe concept drift and performance aging issues upon deployment [18]. § Equal contribution. B Corresponding author.
To maintain long-term detection efficacy in dynamically evolving environments, MaMaDroid [19] introduces an API call abstraction mechanism and utilizes Markov chains to model call sequences and capture program behavioral patterns. Subsequently, some research perspectives delved into the semantic level [20]–[22]. These methods effectively capture the invariant core behavioral rules of malware by extracting the semantic features of APIs and mapping newly emerged APIs into existing semantic spaces. Meanwhile, LDCDroid [23], CADE [24], and FeSAD [25] approach the problem from the perspective of data distribution. They address the distribution shifts caused by malware evolution by deeply learning and capturing data drift characteristics. To reduce the retraining costs associated with model adaptation to evolution, Xu et al. [26] and Huang et al. [27] explored automatic incremental update mechanisms based on pseudo-labeling techniques. Furthermore, Chen et al. [28] combined active learning with similarity uncertainty sampling in a continual learning approach. This method effectively overcomes the rapid failure of detection models by precisely selecting high-value new samples for manual annotation and model retraining. Although existing continual learning and active learning strategies alleviate model aging to some extent, traditional deep learning methods still possess inherent limitations. First, their mining of deep semantic information, such as the contextual logic of API calls, permission configurations, and their intentional correlation with real behaviors, remains insufficient. Second, such models typically operate as black boxes, lacking interpretability of decisions, and still rely on continuous data annotation and retraining to maintain performance. In recent years, Large Language Models (LLMs) have made significant progress, and their semantic understanding and reasoning capabilities in complex contexts have improved rapidly [29]. SRDC [30], AppPoet [31], ForeDroid [32], and Yan et al. [33] utilized LLMs to assist traditional classification models in semantic enhancement at the feature dimension. Simultaneously, Zheng et al. [34] combined ML outputs with LLMs for comprehensive reasoning. Furthermore, He et al. [35] and Qian et al. [36] directly fed decompiled function snippets and code fragments into LLMs for adjudication. However, directly feeding massive and verbose raw code features into LLMs incurs tremendous token consumption. This approach easily hits the context window limits, leading to high deployment costs and low efficiency. Additionally, simply reducing LLMs
to advanced feature extractors fails to truly uncover and fully utilize their deep logical reasoning and intent deduction capabilities within complex malware behavior contexts. To bridge the profound gap between the deep semantic reasoning of LLMs (constrained by context windows) and the precise control-flow tracking of static analysis (inherently lacking intent awareness), this paper proposes MARD, a multi-agent framework for robust Android malware detection. Specifically, deterministic underlying static analysis engines (such as Soot and FlowDroid) serve as on-demand execution tools, while the LLM acts as the orchestrating brain. Together, they construct an end-to-end collaborative architecture that autonomously executes macro-level screening, micro-level forensics, and global adjudication. The main contributions of this paper are as follows: • We propose MARD, which deeply integrates the continuously escalating high-order semantic reasoning capabilities of LLMs with underlying static analysis engines. It constructs an Android malware detection framework capable of executing high-dimensional intent reasoning and low-level logical forensics without any domain-specific fine-tuning. • We design a multi-agent autonomous interaction mechanism based on the ReAct paradigm. This mechanism autonomously plans actions for high-risk APIs and dynamically drives the underlying engines to extract definitive control-flow and data-flow slices, realizing an interpretable evidentiary chain for conviction. • By leveraging a heterogeneous model strategy, MARD achieves precise allocation of computational resources, compressing the total end-to-end cost of deeply analyzing a single complex APK to under $0.10. • Extensive empirical evaluations demonstrate that MARD achieves an F1-score of 93.46% on the datasets. It comprehensively outperforms continual learning baseline models reliant on large-scale data training. Furthermore, in long-span tests from 2017 to 2021, the framework exhibits profound resilience against concept drift and robust cross-domain generalization capabilities. The remainder of this paper is structured as follows: Section II introduces the relevant background knowledge and existing challenges. Section III briefly outlines the framework of MARD. Section IV provides the implementation details of the proposed scheme. Section V presents the experimental results and analysis. Finally, Section VI concludes this paper and envisions future work.
applications by quantifying a score for each API. Beyond focusing solely on the critical feature of APIs, the methods in [8], [41]–[43] integrate multiple features to construct sequential representations. These approaches combine these representations with ML or DL techniques, further improving malware classification accuracy. However, both the Android ecosystem and malware itself continuously evolve. This evolution results in feature discrepancies between old and new applications. Consequently, detection models trained on historical data experience a significant decline in performance when encountering novel malware. This problem is known as concept drift or model aging. To maintain long-term detection capabilities, MaMaDroid [19] constructs static methods resilient to API changes. Subsequently, frameworks like SDAC [20], APIGRAPH [21], and AMDASE [22] extract semantic embeddings of APIs. They conduct clustering analysis to capture the invariant essential behavioral patterns of malware at the feature level. This strategy effectively delays model aging. In addition to mining invariant underlying features, another line of research focuses on adapting to changes in data distribution. Yang et al. [24] pioneered the use of contrastive learning to detect and explain concept drift samples in security applications within the latent space. Following this trajectory, FeSAD [25], [44] constructs dedicated drift adaptation layers for ransomware and Android malware. These layers proactively perceive and quantify the distribution shifts caused by evolution. Regarding dynamic model updating, DroidEvolver [26] and LDCDroid [23] utilize pseudo-labels to update or retrain detection models by dynamically identifying data drift in new applications. However, the presence of noise in these pseudo-labels can lead to rapid deterioration of model performance. To address this, Chen et al. [28] introduced a sample selection strategy from active learning. Their work proposes a continual learning mechanism to tackle continuously evolving malware more reliably. Nevertheless, all the aforementioned data-driven paradigms fundamentally remain constrained by the shallow fitting of statistical features. They lack the semantic understanding capability required to grasp the deep business intent and complex code logic of applications. Moreover, frequent model retraining in continual or active learning consumes massive computational resources and incurs high expert annotation costs. Furthermore, the inherent black-box nature of deep learning renders these models incapable of outputting a definitive, code-level evidentiary chain for conviction.
II. R ELATED W ORK A. Learning-based Malware Analysis API calls, as the core static features characterizing the key behaviors of applications, are widely used in Android malware detection systems [37], [38]. AppContext [39] utilizes static analysis to extract the contextual features of sensitive APIs in applications, including their triggering events and related control-flow factors. Yumlembam et al. [40] captured the differences in API usage patterns between benign and malicious
B. LLM-based Malware Analysis Large Language Models, with their exceptional code comprehension and commonsense reasoning capabilities, offer a highly promising technological pathway for addressing cybersecurity challenges [45]. The utilization of LLMs to assist in Android malware analysis can be broadly categorized into two main paradigms: LLM-based feature semantic enhancement and LLM-based direct reasoning analysis. The specific architectural differences are illustrated in Fig. 1.
Training Required APK
Decompile
File LLM (Auxiliary feature enhancement All API, or knowledge supplementation) Permission, etc Feature semantic enhancement based on LLM High Token Consumption
APK
Decompile Primitive function, All API
LLM (Summarize thousands of original functional fragments or APIs)
III. MARD OVERVIEW
Direct reasoning analysis based on LLM Information analysis APK
Decompile
Autonomous LLM Planning
Execution and feedback analysis Capability enhancement
system with exorbitant model retraining overheads. Furthermore, directly feeding the full volume of code, invocation chains, or massive API contexts into LLMs easily triggers context window truncation and incurs exceedingly high token overhead. Most crucially, some methods treat LLMs merely as feature summarization tools. They fail to truly unleash the immense potential of LLMs for deep logical reasoning within complex, malicious behaviors.
No training required, cost as low as $0.10
Chain of evidence
Our architecture: MARD
Fig. 1. Comparison of different scheme architectures.
In the feature semantic enhancement paradigm, there is a tendency to treat the LLM as an advanced feature extractor to compensate for the deficiencies of traditional machine learning models in semantic understanding. AppPoet [31] prompts the LLM to generate natural language summaries for three distinct views: permissions, APIs, and URLs & Uses-features. These summaries are subsequently fed into a Deep Neural Network (DNN) for downstream classification. Yan et al. [33] and Li et al. [32] leveraged LLMs to translate obscure API call sequences or code invocation chains into descriptive text enriched with domain knowledge. CNN-based or unsupervised learning models then process this text to perform anomaly detection. Furthermore, SRDC [30] utilizes a ransomware semantic knowledge base, collaboratively constructed by human experts and LLMs, to pre-train a GPT-2 model. This pre-training enhances the model’s capability to capture the semantics of zero-day attacks. Conversely, the direct reasoning analysis paradigm attempts to stimulate and harness the autonomous decision-making and end-to-end adjudication potential of LLMs. AV-Agent [34] integrates the confidence scores of ML models and key string features into two distinct reasoning stages of the LLM to yield the final analysis result. LLMalware [46] utilizes LLMs to achieve automated feature extraction and fusion. It mitigates the concept drift problem by dynamically updating an external knowledge base. At a more fine-grained level, CAMA [35] delves into the function level. It requires the LLM to output function summaries and quantified maliciousness scores to evaluate localized malicious intent. LAMD [36] proposes a progressive framework starting from predefined suspicious APIs. It sequentially feeds the extracted structured knowledge into the LLM according to a Function-API-APK hierarchical structure to make the final adjudication. Despite the significant progress achieved by the aforementioned explorations, some studies remain highly dependent on downstream classifiers. This dependency constrains the
Data-flow-based static analysis tools provide high determinism and precise instruction-level tracking capabilities, yet they fundamentally lack an understanding of high-level malicious semantics and the true intent of developers. Conversely, LLMs exhibit remarkable emergent capabilities in zero-shot semantic reasoning. However, their direct application to massive raw Android Application Packages (APKs) is entirely infeasible due to strict context window constraints. Consequently, we propose MARD, a multi-agent framework for robust Android malware detection. As illustrated in Fig. 2, MARD deeply integrates the continuously escalating high-order semantic reasoning capabilities of LLMs with underlying static analysis engines. This integration constructs an architecture capable of executing high-dimensional intent reasoning and low-level logical forensics without requiring any domain-specific finetuning. Our architecture consists of four core modules: Deterministic Static Representation. Serving as the data foundation of the system, this module leverages the Apktool and Soot engines to perform reverse engineering and dimensionality reduction on the APK. It extracts critical configuration metadata from AndroidManifest.xml. Furthermore, it elevates obscure Dalvik bytecode into the Jimple Intermediate Representation (IR), which closely aligns with human semantics. Additionally, it pre-constructs a global Call Graph (CG) and an API inverted index. Macro-level Heuristic Screening. The Reconnaissance Agent conducts a review of the Manifest through cross-modal semantic analysis. This process precisely identifies semantic misalignments between the application’s declared intent and its requested permissions. Subsequently, it utilizes these macrolevel warnings to perform extensive filtering across the global API index. This action exponentially condenses the vast search space into a minimal set of high-risk API candidates. Consequently, it significantly alleviates the cognitive load and token overhead for subsequent deep analysis. Micro-level Autonomous Forensics. Acting as the definitive forensic hub of the system, the Traceability Agent dynamically drives the underlying advanced static analysis tools. Targeting the high-risk API candidates, the agent autonomously plans analytical actions. It commands the backend engines to execute backward call graph traversal to determine the triggering source. Moreover, it issues taint analysis and program slicing instructions to trace the precise data-flow context. After multiple iterations, fragmented code snippets are abstracted into conclusive evidence vectors with strict topological constraints.
Phase 2: Reasoning Multi Agent LLM and Report Results
Phase 1: Static Preprocessing
Tier 1: Reconnaissance Agent (Macro Profiling) Semantic Analysis XML
Intent-Permission Mismatch
Manifest
Tier 2: Forensics Tracing Hub
API
Raw Android APK
Traceability Agent (Micro forensic tracking) System API
Tools Box (Java Backend Engines)
Trigger Entry Point Tracing
Soot Slicer Requests and receives data
Data Flow Context APKtool
Suspicious API Candidates
Call Graphs
FlowDroid Call Graph Tracker
Tier 3: Verdict Agent (Comprehensive Adjudication)
Soot
Benign Tier 1 Result
Tier 2 Result
Java
Analyse
Jimple IR
Comprehensive Reasoning and Logical Deduction
Json
Malware
Final Analysis Report
Fig. 2. Overview of the MARD Architecture.
Multi-dimensional Evidence Fusion. The Verdict Agent, situated at the apex of the architecture, is responsible for completing the global logical closed loop. It deeply fuses the macro-level intentional risks extracted in Tier 1 with the structured, micro-level definitive evidence vectors from Tier 2. Based on this fusion, it executes high-order logical deduction and alignment with threat modeling. Ultimately, this agent outputs a standardized JSON analysis report. IV. P ROPOSED M ETHODOLOGY This section details the overall design and implementation of the MARD framework. By constructing a reduceddimensional data foundation through deterministic analysis engines and relying on multi-agent collaboration to execute high-order semantic reasoning, this framework achieves endto-end autonomous analysis and adjudication, bridging syntaxlevel program features to intent-level security semantics. A. LLM-Oriented Deterministic Code Representation and Dimensionality Reduction Android applications typically contain millions of lines of highly obfuscated Dalvik bytecode. To transform this convoluted binary logic into structured knowledge computable by LLMs, we construct a deterministic data foundation. Given a target application A, we first extract its global configuration manifest M through reverse engineering. For the core logic code, we utilize the Soot engine to disassemble and elevate the Dalvik bytecode into the Jimple IR. As a strongly-typed three-address code, Jimple abstracts away register allocation and low-level execution details. Simultaneously, it preserves control-flow semantics close to the source code level. This abstraction significantly reduces the complexity of program analysis.
Building upon this, we perform fine-grained syntax tree parsing on the Jimple IR to extract the comprehensive set of API calls P. Furthermore, we introduce the Android system API set W (built upon the Android SDK API Level 36) to perform semantic filtering on P. This step removes thirdparty library and framework calls, achieving noise suppression and search space compression. Ultimately, we construct the application’s global call graph G = (V, E), where nodes V represent methods and edges E denote invocation dependencies. In addition, we build an API inverted index space with O(1) time complexity. This index precisely maps each suspicious API signature to specific nodes and code lines in the abstract syntax tree. Consequently, it provides exact coordinates for the subsequent micro-level navigation of the agents. B. Intent-Permission Semantic Alignment Based on Zero-Shot Reasoning After completing the syntax-level dimensionality reduction, the system’s Reconnaissance Agent first intervenes at the macro level. This stage simulates the heuristic screening process of security experts. It rapidly locates potential attack surfaces by reasoning about the semantic consistency between the application’s declared intent and its permission requests. Specifically, the Reconnaissance Agent takes the manifest file M as input. It leverages the zero-shot commonsense reasoning capabilities of the LLM to extract the application’s declared intent set Idecl , and the actually requested sensitive permission set Preq . Internally, the agent implicitly evaluates the semantic consistency between Idecl and Preq based on the LLM’s prior knowledge. When a discrepancy between the application’s functional scope and its requested permis-
sions triggers a structured risk signal, it indicates a potential privilege overreach. For instance, a simple tool application requesting an unreasonable READ_SMS permission would be flagged as a high-risk anomaly. Based on these macro-level warnings, the Reconnaissance Agent performs mapping within the pre-constructed API inverted index. It prunes the raw API set P into a minimal, high-risk API candidate subset Csus . As illustrated in Fig. 3, this process significantly condenses the search space and effectively minimizes the token overhead of LLM reasoning.
$ Y H U D J H & R X Q W S H U $ 3 .
% \ W H F R G H 6 F D O H - L P S O H / 2 &
7 R W D O ( [ W U D F W H G $ 3 , V
6 \ V W H P $ 3 , V
) L Q D O $ 3 , & D Q G L G D W H 6 H W
Fig. 3. Dimension Reduction of API Context per APK.
execution flow from the suspicious API back to the application’s entry points. Consequently, the agent determines whether the API is triggered by explicit user interaction (e.g., onClick) or silently awakened in the background by system events (e.g., BootReceiver). • Data-Flow Reachability Analysis: The agent invokes FlowDroid to execute deterministic forward taint analysis. It marks the return value of the suspicious API vi as a taint source (Source) and dynamically verifies whether there exists a reachable path to data sinks (Sink), such as network transmission or local storage. • Dependency Slicing Extraction: For critical behaviors such as encryption or external connections, the agent executes backward program slicing. It systematically eliminates irrelevant branches and dead code. Thus, it retains only the minimal dependency subgraph that logically affects the target variables, and filters out deceptive code injections. Through multiple rounds of autonomous Observe-ThoughtAction iterations, the Traceability Agent structures the dynamically collected control-flow and data-flow fragments. This process generates a multi-dimensional evidence vector E with strict topological constraints. D. Two-Stage Evidence Fusion and Interpretable Adjudication
C. Tool-Augmented Autonomous Context Traceability For each suspicious API in the set Csus , we design a Traceability Agent based on the ReAct architecture. Because LLMs cannot endogenously execute program flow computations, this agent is endowed with the authority to invoke underlying Java static analysis engines as tools. This design achieves the decoupling of cognition and computation. For each suspicious API node vi ∈ Csus , the agent autonomously plans its forensic path during dynamic interactions. Its action space includes: • Local Context Retrieval: To support semantic-sensitive analysis of malicious behavior, we provide fine-grained code navigation capabilities, such as API localization and global search. Leveraging these capabilities, the agent can pinpoint suspicious API calls with statement-level precision and extract highly relevant Jimple Intermediate Representation (IR) snippets. Based on empirical statistics of function-level code size (calculated using APKs from the CICMalDroid 2020 [47] dataset), function lengths exhibit a significant long-tail distribution. As shown in Fig. 4, approximately 80% and 90% of the functions do not exceed 31 and 51 lines of code, respectively. Inspired by this distribution characteristic, we adopt a context window centered on the suspicious API. This window expands by 20 lines before and after, totaling 40 lines. This strategy covers the vast majority of semantic dependencies. Simultaneously, it avoids the introduction of redundant context and noise propagation. • Trigger Path Search: The Call Graph engine executes backward call chain traversal and reachability analysis on G = (V, E). This process systematically traces the
In the final decision stage, the Verdict Agent acts as the central decision-making hub of the system. It receives the static semantic anomalies Mrisk from the macro-level profiling and the dynamic structured evidence vector E from the micro-level forensics. During the adjudication process, the agent conducts logical deduction based on the multi-dimensional evidence. It maps isolated code behaviors into high-order malicious semantic patterns. By verifying whether the evidence vector satisfies the behavioral characteristics of specific malware families, it outputs the final classification decision Y ∈ {Benign, Malicious}. More importantly, unlike the black-box predictions of traditional deep learning models, the Adjudication Agent is capable of outputting fine-grained threat categories and confidence scores. Furthermore, it generates an evidentiary chain fully supported by actual data-flow and control-flow logic, providing a high degree of human readability and interpretability. V. E XPERIMENTS AND R ESULT A NALYSIS A. Experimental Setup All experiments were implemented in Python 3.11 and conducted on a machine equipped with an Intel Core i7-12700 processor and 32 GB of RAM. All Large Language Models utilized in this research adopted their official vanilla versions without any task-specific fine-tuning or domain adaptation, including the Qwen, DeepSeek, Gemini, GLM, and GPT series models. Specifically, our IV-B and IV-C modules employ the Qwen3-Coder-30B-A3B-Instruct model, while the IV-D module utilizes the Gemini-3-Pro model.
& X P X O D W L Y H 3 H U F H Q W D J H
) U H T X H Q F \ 1 X P E H U R I ) X Q F W L R Q V
/ L Q H V R I & R G H $ ' L V W U L E X W L R Q R I ) X Q F W L R Q / 2 &
/ 2 & / 2 &
/ L Q H V R I & R G H % & X P X O D W L Y H ' L V W U L E X W L R Q R I / 2 &
Fig. 4. Distribution and cumulative distribution of function-level lines of code (LOC). The left subfigure show the histogram and kernel density estimation of LOC, revealing a long-tailed distribution. The right subfigure presents the cumulative distribution, indicating that approximately 80% and 90% of functions contain no more than 31 and 51 LOC, respectively.
1) Datasets: To verify the system’s generalization capabilities across in-distribution, cross-temporal, and cross-domain scenarios, we selected three representative Android malware datasets for experimental evaluation: AndroZoo [48], CICMalDroid 2020 [47], and CIC-AndMal2017 [49]. Specifically, we selected applications from AndroZoo spanning the years 2011 to 2021 and constructed an experimental set based on VirusTotal 1 detection results. Applications flagged by more than 10 engines were treated as malicious samples, while applications with 0 detections were randomly sampled as benign samples. Ultimately, a sub-dataset comprising 14,090 applications was constructed, including 6,968 malicious samples and 7,122 benign samples. For the CICMalDroid 2020 dataset, we utilized a total of 7,825 application samples, consisting of 3,923 malicious samples and 3,902 benign samples. Furthermore, CIC-AndMal2017 was utilized entirely as an unseen test set, primarily designed to challenge and benchmark the models’ robustness in cross-domain scenarios. 2) Baseline Models: To comprehensively evaluate the detection performance of MARD, we compared it against four representative categories of baseline methods based on the aforementioned real-world Android application datasets. Static Structural & Behavioral Models represent classic static detection methods that rely on deep feature engineering and graph analysis. MaMaDroid [19] is a representative static malware detection system that abstracts API calls to the Package and Family levels, utilizing Markov chains to perform high-dimensional modeling of an application’s behavioral transition probabilities. Malscan [14] is a market-oriented malware scanning framework. Its core idea is to introduce centrality analysis techniques from social networks to process and extract key topological features from application structure graphs (e.g., function call graphs). Adaptive & Drift-Resistant Models represent adaptive learning methods designed to mitigate software evolution and 1 https://www.virustotal.com/
TABLE I E VALUATION M ETRICS .
Metric Accuracy Precision Recall F1-score
Formula (TP + TN)/(TP + TN + FP + FN) (TP)/(TP + FP) (TP)/(TP + FN) 2 · (Precision · Recall)/(Precision + Recall)
concept drift issues. DroidEvolver [26], operating as a selfevolving Android malware detection system, utilizes pseudolabels to automatically update and calibrate its detection model online, thereby coping with the rapid iteration of malware. CL-Malware [28] combines active learning with continual learning mechanisms. It aims to enable the detection model to continuously accumulate knowledge over time, thereby effectively adapting to newly emerging malware variants. 3) Evaluation Metrics: Based on the True Positives (TP), True Negatives (TN), False Positives (FP), and False Negatives (FN) from the confusion matrix, we calculate Accuracy (ACC), Precision (Pre), Recall (Rec), and the F1-score (F1). The specific calculations are presented in Table I. B. Research Questions (RQs) RQ1 (Effectiveness of MARD): How does the proposed zero-shot LLM multi-agent framework perform in Android malware detection compared to traditional learningbased baselines trained on large-scale datasets? • RQ2 (Temporal Generalization): How resilient is the LLM-based framework against concept drift over time compared to baseline models? • RQ3 (Cross-Domain Generalization): Can the proposed framework maintain high detection efficacy across entirely different and unseen dataset distributions without domain-specific retraining? • RQ4 (Model Capability and Component Analysis): How do different state-of-the-art LLMs (e.g., GPT-5.2, •
TABLE II OVERALL P ERFORMANCE C OMPARISON ON D IFFERENT DATASETS (%)
CICMalDroid 2020
Method
MaMaDroid (family) MaMaDroid (package) DroidEvolver CL-Malware Malsca (knn-1) Malscan (knn-3) Malscan (random) MARD (Ours)
AndroZoo
Acc
Pre
Rec
F1
Acc
Pre
Rec
F1
60.16 48.78 40.32 92.74 58.00 44.00 46.00 94.35
51.04 44.44 40.65 85.00 52.94 42.03 44.71 89.29
96.08 94.12 98.04 100.0 60.00 64.44 84.44 98.04
66.67 60.38 57.47 91.89 56.25 50.88 58.46 93.46
72.58 48.28 69.58 87.57 66.26 62.98 68.74 89.19
75.40 48.08 74.18 90.67 70.48 64.61 91.01 87.76
64.30 98.67 50.47 83.30 52.90 47.41 40.44 86.46
69.34 64.62 57.85 86.67 59.76 53.89 54.09 87.01
Note: Bold indicates the best performance, and underlined indicates the second-best.
DeepSeek-R1, GLM-4.7) impact the final verdict accuracy, and what is the impact of removing the micro-level independent forensics module? • RQ5 (Cost and Feasibility Analysis): What is the token consumption and economic cost of the multi-agent framework, and how feasible is it for actual deployment? C. Effectiveness of MARD (RQ1) We conducted a comprehensive overall performance evaluation of MARD against learning-based Android malware detection baseline models on two heterogeneous datasets: CICMalDroid 2020 and AndroZoo. As shown in Table II, MARD demonstrates outstanding detection efficacy on both datasets. On the CICMalDroid 2020 dataset, MARD achieves the highest accuracy of 94.35% and an F1-score of 93.46%. Traditional baselines like DroidEvolver sustain high recall (∼98%) at the cost of abysmal precision (∼40%) and sub-50% accuracy, which makes them unusable in practice. Although the State-Of-The-Art (SOTA) continual learning model, CLMalware, achieves a 100% recall rate, its precision is only 85.00%, indicating a tendency to generate a large volume of false positives. In contrast, MARD achieves an optimal balance between a precision of 89.29% and a recall of 98.04%. When the testing environment shifts to the AndroZoo dataset, which is characterized by a more complex data distribution and a significantly larger scale, the performance of traditional data-driven models suffers a catastrophic degradation. The recall rates of MaMaDroid (family) and DroidEvolver plummet from 96.08% and 98.04% down to 64.30% and 50.47%, respectively. Although Malscan (random) attains a precision of 91.01% on AndroZoo, its recall is a mere 40.44%. This implies that it misses nearly 60% of actual malware, rendering it of very little practical value in real-world security deployments. On the contrary, MARD does not require any domain-specific fine-tuning, parameter updates, or retraining on the AndroZoo dataset, yet it still maintains an accuracy of 89.19% and an F1-score of 87.01%, exceeding the bestperforming baseline model, CL-Malware.
Answer for RQ1: Without any domain-specific training, MARD significantly outperforms SOTA baseline models reliant on large-scale data, achieving an optimal balance between precision and recall on heterogeneous datasets. Our architecture successfully overcomes the catastrophic degradation experienced by traditional data-driven models when confronted with complex samples in dynamic environments. D. Temporal Generalization (RQ2) To evaluate the models’ temporal generalization capabilities against malware evolution, we adopted a strict chronological evaluation strategy. We partitioned the test set based on the year of the applications’ first appearance (from 2017 to 2021). Fig. 5 illustrates the long-term evolutionary trends of the baseline models and MARD. The experimental data clearly reveal the catastrophic impact of concept drift on data-driven models. As shown in Fig. 5, models relying on fixed feature spaces maintain acceptable performance during 2017-2018, but experience a precipitous drop starting in 2019. Specifically, the recall of DroidEvolver plummets from 78.38% in 2018 to a mere 8.00% in 2021, with its F1-score correspondingly plunging to 13.56%. This implies that when confronted with novel malware variants in 2021, the model almost entirely loses its detection capabilities, degrading to mere random guessing. This exposes the inherent flaw of traditional shallow features, which are highly susceptible to aging as attack vectors evolve. CL-Malware introduces a dynamic model update mechanism based on active learning to mitigate the aging issue. The data indicate that this strategy delays the performance degradation to some extent, enabling it to maintain an F1-score of approximately 90% between 2017 and 2019. However, with the evolution of the Android ecosystem post-2020, CLMalware still fails to overcome the concept drift problem, as its accuracy and F1-score fall to 71.43% and 71.01%, respectively, in 2021. This proves that solely performing incremental
learning and pseudo-label updating within a legacy feature space cannot fundamentally bridge the gap caused by the highorder semantic mutations of malware. In stark contrast to all baseline models, MARD demonstrates unparalleled temporal stability and generalization capabilities. Over the five years, the F1-score of MARD remains consistently stable above 84%. Similarly, its accuracy is maintained at a highly competitive level, stabilizing around 92.75% in recent years. Also, the recall of MARD remains remarkably steady, within a margin of 82.05% to 88.89% throughout the entire timeline. This indicates that the system is profoundly immune to temporal aging, possessing an intrinsic and stable capacity to capture novel threats with complex disguises accurately. 0 D O V F D Q
' U R L G ( Y R O Y H U
$ F F X U D F \
5 H F D O O
& / 0 D O Z D U H
0 D 0 D ' U R L G
< H D U
< H D U
% $ F F X U D F \
3 U H F L V L R Q
) 6 F R U H
TABLE III C ROSS -DATASET P ERFORMANCE ON CICM AL D ROID 2020 (%).
Method
Acc
Pre
Rec
F1
MaMaDroid (package) DroidEvolver CL-Malware Malscan (knn-1) MARD (Ours)
57.72 86.29 95.97 83.87 94.35
40.00 75.76 91.07 73.85 89.29
3.92 98.04 100.0 94.12 98.04
7.14 85.47 95.33 82.76 93.46
$ 5 H F D O O
2 X U V
indicates that this target dataset might share a high degree of in-distribution overlap in certain underlying statistical features with the baseline models’ AndroZoo training set. However, even when facing this extremely advantageous scenario for pre-trained models, MARD still demonstrates astonishing competitiveness, closely following with a high F1-score of 93.46%. This strongly proves that even in the absence of domain prior knowledge, zero-shot analysis based on multiagent collaboration can achieve or even rival SOTA models trained on domain-specific data.
< H D U
& ) 6 F R U H
< H D U
' 3 U H F L V L R Q
Fig. 5. 2017-2021 results on AndroZoo dataset.
Answer for RQ2: In stark contrast to traditional and continual learning models that suffer from a precipitous performance decline over time, MARD demonstrates exceptional temporal generalization capabilities. By substituting the fitting of shallow statistical features with deep semantic reasoning of attack intent, the framework maintains stable detection efficacy across a time span of up to five years. E. Cross-Domain Generalization (RQ3) We constructed a cross-domain evaluation scenario to test the model’s cross-domain generalization capabilities on completely unknown datasets. In this setting, all learning-based baseline models underwent large-scale pre-training on the AndroZoo (2011-2016) dataset and were subsequently subjected to direct transfer testing on two target datasets with completely different distributions, namely CICMalDroid 2020 and CICAndMal2017. As shown in Table III, on the CICMalDroid 2020 dataset, the continual learning model CL-Malware achieves the best performance with an F1-score of 95.33%. This phenomenon
When the test target shifts to CIC-AndMal2017, as seen in Table IV, the performance of all data-driven models suffers a catastrophic degradation because the malware family composition, collection strategies, and API usage patterns of this dataset exhibit severe spatial distribution shifts compared to AndroZoo. The F1-score of the most robust model, CLMalware, shrinks drastically by nearly 21% (dropping to 74.45%), and its recall plummets to 64.56%, indicating that it generates a massive number of false negatives when confronted with unknown domain features. Conversely, MARD demonstrates stability across datasets, achieving an accuracy of 91.14%. TABLE IV C ROSS -DATASET P ERFORMANCE ON CIC-A ND M AL 2017 (%).
Method
Acc
Pre
Rec
F1
MaMaDroid (package) DroidEvolver CL-Malware Malscan (knn-1) MARD (Ours)
48.30 68.79 77.71 74.54 91.14
53.33 67.05 87.93 70.99 92.31
10.39 74.68 64.56 83.54 90.00
17.39 70.66 74.45 76.74 91.14
Answer for RQ3: In cross-domain evaluation scenarios, when confronted with severe data distribution shifts, traditional learning-based models suffer a precipitous performance decline due to dataset bias. In contrast, MARD, leveraging its evidence-chain-based deep semantic understanding, maintains a detection accuracy exceeding 91% on completely unseen heterogeneous datasets, demonstrating outstanding and stable cross-domain generalization capabilities.
TABLE V A BLATION S TUDY ON D IFFERENT LLM BACKBONES (%)
Organization
CIC-AndMal2017
LLM
CICMalDroid 2020
Acc
Pre
Rec
F1
Acc
Pre
Rec
F1
Gemini-3-pro Gemini-2.5-flash
91.14 82.91
92.31 81.18
90.00 86.25
91.14 83.64
94.35 85.48
89.29 73.91
98.04 100.0
93.46 85.00
Zhipu
GLM-4.7 GLM-4-flash
86.71 76.43
85.54 69.37
88.75 96.25
87.12 80.63
88.71 75.00
81.36 62.20
94.36 100.0
87.27 76.69
OpenAI
GPT-5.2 GPT-5-mini GPT-4o
89.87 82.91 81.01
85.56 80.46 75.00
96.25 87.5 93.75
90.59 83.83 83.33
91.13 83.87 79.84
82.26 72.46 67.11
100.0 98.04 100.0
90.27 83.33 80.31
86.08
81.52
93.75
87.75
83.87
71.83
100.0
83.61
w/o Micro-level Autonomous Forensics
Note: ”w/o Micro-level Autonomous Forensics” represents the system using GPT-5.2 but skipping the code context tracing stage.
F. Model Capability and Component Analysis (RQ4) We investigated the impact across two core dimensions: first, the differences in final adjudication results among Large Language Models of varying capability tiers; second, the necessity of the micro-level autonomous forensics module’s existence within the system architecture. The detailed evaluation results are presented in Table V. The experimental results clearly indicate that the final detection efficacy of MARD is highly positively correlated with the high-order logical reasoning capabilities of the underlying LLM. Among all evaluated models, the Gemini-3-pro model demonstrates an overwhelming advantage, achieving the best F1-scores of 91.14% and 93.46% on CIC-AndMal2017 and CICMalDroid 2020, respectively. Models of the same tier, such as GPT-5.2 and GLM-4.7, also exhibit extremely strong competitiveness. In contrast, models with smaller parameter sizes or those positioned as lightweight, such as Gemini-2.5flash, GPT-5-mini, and GLM-4-flash, fall into obvious falsepositive traps. Taking GLM-4-flash and GPT-4o as examples, their recall on CICMalDroid 2020 both reach 100%, but their precision plummets to 62.20% and 67.11%, respectively. This profoundly reveals that lightweight models suffer from severe cognitive overload and a conservative classification tendency when confronting complex code evidentiary chains; that is, when unable to precisely disentangle data flows, the models tend to uniformly classify all suspicious applications as malicious, thereby generating false positives. Therefore, LLMs equipped with deep reasoning and long-context orchestration capabilities are a necessary prerequisite for achieving precise zero-shot detection. To verify the necessity of the tool-augmented architecture, we designed an experiment that strips away the micro-level traceability stage (w/o Micro-level Autonomous Forensics). Under this setting, GPT-5.2 can only rely on the Manifest intent misalignment information provided by macro-level heuristic screening for adjudication, lacking the support of actual control-flow and data-flow slices from the underlying
Soot/FlowDroid engines. The data in Table V show that after removing the micro-level autonomous forensics module, the system’s precision on CICMalDroid 2020 plummets from 82.26% to 71.83%, and the overall F1-score drops to 83.61%. This precipitous decline intuitively demonstrates the core value of the micro-level autonomous forensics module: macro-level semantic screening is restricted to uncovering potential risks, whereas micro-level autonomous dynamic tool invocation is essential for verifying definitive maliciousness. Lacking the constraint of underlying deterministic code evidence, the LLM falls into unfounded inference, which once again validates the scientific soundness and necessity of the framework proposed in this paper. Answer for RQ4: The high-order logical reasoning capabilities of LLMs play a decisive role in system efficacy, and flagship models can effectively avoid the high recall and low precision false-positive trap faced by lightweight models. Furthermore, ablation experiments confirm the indispensability of the microlevel traceability module; removing the underlying toolchain support causes precision to plummet by over 10%, proving that a deterministic code-level evidentiary chain is the cornerstone for achieving precise adjudication. G. Cost and Feasibility Analysis (RQ5) To comprehensively evaluate the engineering feasibility of MARD in real-world deployment scenarios, we detailed and quantified the token consumption distribution, the cost overhead trends over time, and the economic efficiency of different LLMs when processing a single APK. The evaluation results are illustrated in Fig. 6 and Fig. 7. Fig. 6(C) clearly reveals the internal operational mechanism of the multi-agent framework. Across all test datasets and time spans, Tier 2 (Trace - Deep Analysis) consistently acts as the absolute resource consumption bottleneck, accounting for
$ Q G U R = R R & , & $ Q G 0 D O & , & 0 D O ' U R L G
' H Q V L W \
7 R W D O 7 R N H Q V S H U $ 3 .
< H D U
$ 7 H P S R U D O ( Y R O X W L R Q R I 7 R N H Q & R V W $ Q G U R = R R
7 R W D O 7 R N H Q V S H U $ 3 .
% & U R V V ' D W D V H W 7 R N H Q & R Q V X P S W L R Q ' L V W U L E X W L R Q
3 H U F H Q W D J H R I 7 R W D O 7 R N H Q V
R R
= $ Q G U R
= R R = R R $ Q G U R $ Q G U R 7 L H U 5 H F R Q 3 U H S U R F H V V L Q J
O L G = R R = R R Q G 0 D D O ' U R $ Q G U R $ Q G U R & , & $ & , & 0 7 L H U 7 U D F H ' H H S $ Q D O \ V L V 7 L H U 9 H U G L F W 6 X P P D U \
& 6 W D J H Z L V H & R V W 3 U R S R U W L R Q D F U R V V ' D W D V H W V < H D U V Fig. 6. Token consumption analysis results.
over 85% to 90% of the system’s total token consumption. This phenomenon not only aligns with expectations but also strongly validates the core design philosophy of MARD. The macro-level pre-screening in Tier 1 successfully intercepts a massive volume of risk-free code, consuming only a minimal fraction of tokens (< 10%); meanwhile, the system skews the vast majority of computational resources towards the dynamic tool interaction (ReAct loop) and deep program slice reading in Tier 2. The token consumption in the Tier 3 adjudication and summary stage is negligible (< 1%). This indicates that the LLM is not merely performing superficial text summarization but is substantively engaging in deep code review. As shown in Fig. 6(A), alongside the increasing complexity of the Android application ecosystem (from 2017 to 2021), the total amount of tokens required to process a single APK exhibits a slow but inevitable upward trend. The Kernel Density Estimation (KDE) curve in Fig. 6(B) further demonstrates that the analysis overhead for the vast majority of APKs is concentrated between 105 and 106 tokens. This highlights the absurdity of strategies that directly feed the full volume of code into an LLM. Without relying on our preliminary static analysis infrastructure for dimensionality reduction, modern
giant APKs would easily breach the context limits of any commercial LLM and incur incalculable economic costs. But it is worth noting that our density distribution maintains a consistent shape, ensuring that the cost is stable. Fig. 7 intuitively illustrates the relationship between the average input and output cost (in USD) for processing a single APK and the final detection F1-score. To maximize the feasibility of commercial deployment, MARD adopts an economical heterogeneous model strategy. Specifically, the heavy preliminary tasks, which account for over 90% of the token consumption in the system, are assigned to the Qwen3Coder-30B-A3B-Instruct model, which specializes in code comprehension and possesses a significant cost advantage. This establishes a highly affordable foundation for the system. Building upon this, Fig. 7 demonstrates the variations in the overall pipeline overhead when switching to different LLMs exclusively during the comprehensive adjudication stage. Because the adjudication stage only needs to process the highly condensed, structured evidence vectors extracted from the first two stages, the context billing for commercial LLMs is drastically reduced. The data indicates that even when utilizing models with exceptionally strong reasoning capabilities, the
) 6 F R U H
' H H S 6 H H N 5 ' L V W L O O * H P L Q L ) O D V K * / 0 ) O D V K * / 0 * 3 7 R * 3 7 P L Q L
& , & $ Q G 0 D O & , & 0 D O ' U R L G
7 R N H Q 9 R O X P H 6 F D O H
R I 0 D [ 7 R N H Q V
R I 0 D [ 7 R N H Q V
R I 0 D [ 7 R N H Q V
$ Y H U D J H , Q S X W & R V W S H U $ 3 . 8 6 ' $ , Q S X W & R Q W H [ W $ Y J & R V W S H U $ 3 . Y V )
$ Y H U D J H 2 X W S X W & R V W S H U $ 3 . 8 6 ' % 2 X W S X W & R Q W H [ W $ Y J & R V W S H U $ 3 . Y V )
Fig. 7. Average consumption cost per APK.
total input cost for processing a single APK across the entire pipeline is strictly controlled between $0.0675 and $0.0825 (Fig. 7(A)), while the output cost is as low as $0.004 to $0.011 (Fig. 7(B)). This means that the total overhead for completing a deep, automated code forensics and malware adjudication process is well under $0.10 2 . Answer for RQ5: MARD achieves high engineering feasibility and cost efficiency. By using a heterogeneous model architecture, token-intensive preliminary screening is handled by low-cost models, reducing perAPK cost to under $0.10, while mid-to-large models perform final adjudication to ensure precise and reliable detection, enabling scalable deployment of multiagent frameworks in industrial settings. VI. C ONCLUSION In this paper, we propose MARD, an Android malware detection framework that integrates deep semantic reasoning from LLMs with deterministic static analysis. By leveraging engines like Soot and FlowDroid within a collaborative workflow of macro-level screening, micro-level forensics, and global adjudication, MARD enables zero-shot end-to-end detection with evidentiary chains supported by actual code and data-flow logic. Evaluations over five years of heterogeneous datasets demonstrate strong detection performance with an F1-score of 93.46%, robust cross-domain generalization, and resilience against concept drift. Furthermore, a heterogeneous model strategy reduces the per-APK analysis cost to under 2 The Qwen, DeepSeek, and GLM series models were invoked via the API interface provided by SiliconFlow (https://siliconflow.cn/), while the Gemini and GPT series models were accessed via the API interface provided by OpenRouter (https://openrouter.ai/).
$0.10. Limitations remain when analyzing heavily packed or dynamically loaded apps. Future work will integrate dynamic sandbox logs and memory forensics to extend MARD toward hybrid static-dynamic analysis for more stealthy threats. R EFERENCES [1] Parvez Faruki, Ammar Bharmal, Vijay Laxmi, Vijay Ganmoor, Manoj Singh Gaur, Mauro Conti, and Muttukrishnan Rajarajan. Android security: a survey of issues, malware penetration, and defenses. IEEE communications surveys & tutorials, 17(2):998–1022, 2014. [2] Parnika Bhat and Kamlesh Dutta. A survey on various threats and current state of security in android platform. ACM Computing Surveys (CSUR), 52(1):1–35, 2019. [3] Iker Burguera, Urko Zurutuza, and Simin Nadjm-Tehrani. Crowdroid: behavior-based malware detection system for android. In Proceedings of the 1st ACM workshop on Security and privacy in smartphones and mobile devices, pages 15–26, 2011. [4] Zhenlong Yuan, Yongqiang Lu, Zhaoguo Wang, and Yibo Xue. Droidsec: deep learning in android malware detection. In Proceedings of the 2014 ACM conference on SIGCOMM, pages 371–372, 2014. [5] Daniel Arp, Michael Spreitzenbarth, Malte Hubner, Hugo Gascon, Konrad Rieck, and CERT Siemens. Drebin: Effective and explainable detection of android malware in your pocket. In Ndss, volume 14, pages 23–26. San Diego, CA, 2014. [6] Roberto Jordaney, Kumar Sharad, Santanu K Dash, Zhi Wang, Davide Papini, Ilia Nouretdinov, and Lorenzo Cavallaro. Transcend: Detecting concept drift in malware classification models. In 26th USENIX security symposium (USENIX security 17), pages 625–642, 2017. [7] Federico Barbero, Feargus Pendlebury, Fabio Pierazzi, and Lorenzo Cavallaro. Transcending transcend: Revisiting malware classification in the presence of concept drift. In 2022 IEEE Symposium on Security and Privacy (SP), pages 805–823. IEEE, 2022. [8] Junyang Qiu, Qing-Long Han, Wei Luo, Lei Pan, Surya Nepal, Jun Zhang, and Yang Xiang. Cyber code intelligence for android malware detection. IEEE Transactions on Cybernetics, 53(1):617–627, 2022. [9] Yousra Aafer, Wenliang Du, and Heng Yin. Droidapiminer: Mining apilevel features for robust malware detection in android. In International conference on security and privacy in communication systems, pages 86–103. Springer, 2013. [10] Moutaz Alazab, Mamoun Alazab, Andrii Shalaginov, Abdelwadood Mesleh, and Albara Awajan. Intelligent mobile malware detection using permission requests and api calls. Future Generation Computer Systems, 107:509–521, 2020.
[11] Xiaohui Chen, Zhiyu Hao, Lun Li, Lei Cui, Yiran Zhu, Zhenquan Ding, and Yongji Liu. Cruparamer: Learning on parameter-augmented api sequences for malware detection. IEEE Transactions on Information Forensics and Security, 17:788–803, 2022. [12] Jin Li, Lichao Sun, Qiben Yan, Zhiqiang Li, Witawas Srisa-An, and Heng Ye. Significant permission identification for machine-learningbased android malware detection. IEEE Transactions on Industrial Informatics, 14(7):3216–3225, 2018. [13] Janani Thiyagarajan, A Akash, and Brindha Murugan. Improved realtime permission based malware detection and clustering approach using model independent pruning. IET Information Security, 14(5):531–541, 2020. [14] Yueming Wu, Xiaodi Li, Deqing Zou, Wei Yang, Xin Zhang, and Hai Jin. Malscan: Fast market-wide mobile malware scanning by social-network centrality analysis. In 2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 139–150. IEEE, 2019. [15] Minghui Cai, Yuan Jiang, Cuiying Gao, Heng Li, and Wei Yuan. Learning features from enhanced function call graphs for android malware detection. Neurocomputing, 423:301–307, 2021. [16] Ce Li, Zijun Cheng, He Zhu, Leiqi Wang, Qiujian Lv, Yan Wang, Ning Li, and Degang Sun. Dmalnet: Dynamic malware analysis based on api feature engineering and graph learning. Computers & Security, 122:102872, 2022. [17] Lihong Tang, Xiao Chen, Sheng Wen, Li Li, Marthie Grobler, and Yang Xiang. Demystifying the evolution of android malware variants. IEEE Transactions on Dependable and Secure Computing, 21(4):3324–3341, 2023. [18] Alejandro Guerra-Manzanares. Machine learning for android malware detection: mission accomplished? a comprehensive review of open challenges and future perspectives. Computers & Security, 138:103654, 2024. [19] Lucky Onwuzurike, Enrico Mariconti, Panagiotis Andriotis, Emiliano De Cristofaro, Gordon Ross, and Gianluca Stringhini. Mamadroid: Detecting android malware by building markov chains of behavioral models (extended version). ACM Transactions on Privacy and Security (TOPS), 22(2):1–34, 2019. [20] Jiayun Xu, Yingjiu Li, Robert H Deng, and Ke Xu. Sdac: A slow-aging solution for android malware detection using semantic distance based api clustering. IEEE transactions on dependable and secure computing, 19(2):1149–1163, 2020. [21] Xiaohan Zhang, Mi Zhang, Yuan Zhang, Ming Zhong, Xin Zhang, Yinzhi Cao, and Min Yang. Slowing down the aging of learningbased malware detectors with api knowledge. IEEE Transactions on Dependable and Secure Computing, 20(2):902–916, 2022. [22] Hongyu Yang, Youwei Wang, Liang Zhang, Xiang Cheng, and Ze Hu. A novel android malware detection method with api semantics extraction. Computers & Security, 137:103651, 2024. [23] Zhen Liu, Ruoyu Wang, Bitao Peng, Lingyu Qiu, Qingqing Gan, Changji Wang, and Wenbin Zhang. Ldcdroid: Learning data drift characteristics for handling the model aging problem in android malware detection. Computers & Security, 150:104294, 2025. [24] Limin Yang, Wenbo Guo, Qingying Hao, Arridhana Ciptadi, Ali Ahmadzadeh, Xinyu Xing, and Gang Wang. {CADE}: Detecting and explaining concept drift samples for security applications. In 30th USENIX Security Symposium (USENIX Security 21), pages 2327–2344, 2021. [25] Damien Warren Fernando and Nikos Komninos. Fesad ransomware detection framework with machine learning using adaption to concept drift. Computers & Security, 137:103629, 2024. [26] Ke Xu, Yingjiu Li, Robert Deng, Kai Chen, and Jiayun Xu. Droidevolver: Self-evolving android malware detection system. In 2019 IEEE European Symposium on Security and Privacy (EuroS&P), pages 47–62. IEEE, 2019. [27] Lu Huang, Jingfeng Xue, Yong Wang, Junbao Chen, and Tianwei Lei. Strengthening llm ecosystem security: Preventing mobile malware from manipulating llm-based applications. Information Sciences, 681:120923, 2024. [28] Yizheng Chen, Zhoujie Ding, and David Wagner. Continuous learning for android malware detection. In 32nd USENIX Security Symposium (USENIX Security 23), pages 1127–1144, 2023. [29] Hui Wei, Zihao Zhang, Shenghua He, Tian Xia, Shijia Pan, and Fei Liu. Plangenllms: A modern survey of llm planning capabilities. In Proceedings of the 63rd Annual Meeting of the Association for
Computational Linguistics (Volume 1: Long Papers), pages 19497– 19521, 2025. [30] Ce Zhou, Yilun Liu, Weibin Meng, Shimin Tao, Weinan Tian, Feiyu Yao, Xiaochun Li, Tao Han, Boxing Chen, and Hao Yang. Srdc: Semanticsbased ransomware detection and classification with llm-assisted pretraining. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 28566–28574, 2025. [31] Wenxiang Zhao, Juntao Wu, and Zhaoyi Meng. Apppoet: Large language model based android malware detection via multi-view prompt engineering. Expert Systems with Applications, 262:125546, 2025. [32] Jiaming Li, Sen Chen, Chunlian Wu, Yuxin Zhang, and Lingling Fan. Foredroid: Scenario-aware analysis for android malware detection and explanation. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, pages 1379–1393, 2025. [33] Pei Yan, Shunquan Tan, Miaohui Wang, and Jiwu Huang. Prompt engineering-assisted malware dynamic analysis using gpt-4. IEEE Transactions on Dependable and Secure Computing, 2025. [34] Rui Zheng, Zhibo Wang, Kui Ren, and Chun Chen. Av-agent: A bottomup interpretable malware classifier based on large language models. IEEE Transactions on Information Forensics and Security, 2025. [35] Yiling He, Hongyu She, Xingzhi Qian, Xinran Zheng, Zhuo Chen, Zhan Qin, and Lorenzo Cavallaro. On benchmarking code llms for android malware analysis. In Proceedings of the 34th ACM SIGSOFT International Symposium on Software Testing and Analysis, pages 153– 160, 2025. [36] Xingzhi Qian, Xinran Zheng, Yiling He, Shuo Yang, and Lorenzo Cavallaro. Lamd: Context-driven android malware detection and classification with llms. In 2025 IEEE Security and Privacy Workshops (SPW), pages 126–136. IEEE, 2025. [37] Lei Cui, Jiancong Cui, Yuede Ji, Zhiyu Hao, Lun Li, and Zhenquan Ding. Api2vec: Learning representations of api sequences for malware detection. In Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis, pages 261–273, 2023. [38] Lei Cui, Yiran Zhu, Junnan Yin, Zhiyu Hao, Wei Wang, Peng Liu, Ziqi Yang, and Xiaochun Yun. Apibeh: Learning behavior inclination of apis for malware classification. In 2024 IEEE 35th International Symposium on Software Reliability Engineering (ISSRE), pages 1–12. IEEE, 2024. [39] Wei Yang, Xusheng Xiao, Benjamin Andow, Sihan Li, Tao Xie, and William Enck. Appcontext: Differentiating malicious and benign mobile app behaviors using context. In 2015 IEEE/ACM 37th IEEE international conference on software engineering, volume 1, pages 303–313. IEEE, 2015. [40] Rahul Yumlembam, Biju Issac, Longzhi Yang, and Seibu Mary Jacob. Android malware classification and optimisation based on bm25 score of android api. In IEEE INFOCOM 2023-IEEE conference on computer communications workshops (INFOCOM WKSHPS), pages 1–6. IEEE, 2023. [41] TaeGuen Kim, BooJoong Kang, Mina Rho, Sakir Sezer, and Eul Gyu Im. A multimodal deep learning method for android malware detection using various features. IEEE Transactions on Information Forensics and Security, 14(3):773–788, 2018. [42] Lingru Cai, Yao Li, and Zhi Xiong. Jowmdroid: Android malware detection based on feature weighting with joint optimization of weightmapping and classifier parameters. Computers & Security, 100:102086, 2021. [43] Chuanchang Liu, Jianyun Lu, Wendi Feng, Enbo Du, Luyang Di, and Zhen Song. Mobipcr: Efficient, accurate, and strict ml-based mobile malware detection. Future Generation Computer Systems, 144:140–150, 2023. [44] Damien Warren Fernando and Nikos Komninos. Fesa: Feature selection architecture for ransomware detection under concept drift. Computers & Security, 116:102659, 2022. [45] Qineng Wang, Zihao Wang, Ying Su, Hanghang Tong, and Yangqiu Song. Rethinking the bounds of llm reasoning: Are multi-agent discussions the key? In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 6106–6131, 2024. [46] Zijing Ma, Leming Shen, Xinyu Huang, and Yuanqing Zheng. Poster: Llmalware: An llm-powered robust and efficient android malware detection framework. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, pages 4737–4739, 2025. [47] Samaneh Mahdavifar, Andi Fitriah Abdul Kadir, Rasool Fatemi, Dima Alhadidi, and Ali A Ghorbani. Dynamic android malware category classification using semi-supervised deep learning. In 2020 IEEE Intl
Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech), pages 515–522. IEEE, 2020. [48] Kevin Allix, Tegawendé F. Bissyandé, Jacques Klein, and Yves Le Traon. Androzoo: Collecting millions of android apps for the research community. In Proceedings of the 13th International Conference on Mining Software Repositories, MSR ’16, pages 468–471, New York, NY, USA, 2016. ACM. [49] Arash Habibi Lashkari, Andi Fitriah A Kadir, Laya Taheri, and Ali A Ghorbani. Toward developing a systematic approach to generate benchmark android malware datasets and classification. In 2018 International Carnahan conference on security technology (ICCST), pages 1–7. ieee, 2018.