GSIDroid: A Suspicious Subgraph-Driven and Interpretable Android Malware Detection System.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Android malware poses significant economic and security risks.
• Existing machine learning methods often lack subgraph analysis and interpretability.
• Graph-based detection methods can be computationally intensive and overlook node semantics.

Purpose of the Study:

• To introduce GSIDroid, a novel framework for subgraph-driven and interpretable Android malware detection.
• To enhance detection performance, reduce computational overhead, and improve user security.
• To provide transparent and analyzable detection results for cybersecurity professionals.

Main Methods:

• Developed a subgraph-driven framework (GSIDroid) for Android malware detection.
• Integrated deep and shallow semantic features with permission information.
• Incorporated global and local interpretability modules for transparent analysis.

Main Results:

• GSIDroid achieved an F1 score of 97.14% on 14,520 samples.
• The interpretability module successfully identified critical nodes and permission features.
• Demonstrated enhanced detection performance and reduced computational overhead.

Conclusions:

• GSIDroid offers an effective and interpretable solution for Android malware detection.
• The framework aids cybersecurity experts in rigorous malware analysis and understanding malicious behaviors.
• GSIDroid enhances practical deployment and supports further security research.