Source-linked AI summary
LAMD: Context-driven Android Malware Detection and Classification with LLMs
Xingzhi Qian, Xinran Zheng, Yiling He, Shuo Yang, Lorenzo Cavallaro
TL;DR
Android malware detection must handle evolving threats, dataset bias, limited explainability, and codebases whose size and structure exceed straightforward LLM analysis. LAMD addresses this gap with context extraction, hierarchical reasoning, and factual consistency verification, and it outperforms conventional detectors in real-world and distribution-shift settings.
Problem
Android malware detection remains challenged by evolving attacks, dataset bias, limited explainability, excessive support code, and complex program structures.
Method
LAMD uses static analysis and backward slicing to extract security-critical context, then applies tier-wise code reasoning with factual consistency verification.
Results
LAMD outperforms conventional learning-based detectors under distribution shift and improves average F1-scores by 23.12% while reducing average FNR by 71.59%.
Takeaways & Limitations
LAMD provides a practical framework for explainable LLM-powered Android malware detection in real-world settings.
Takeaways & Limitations
LAMD has non-trivial per-APK operational costs, and LLMs still struggle with fine-grained behavior analysis and require more computational resources.
Abstract
from arXiv · showhide
The rapid growth of mobile applications has escalated Android malware threats. Although there are numerous detection methods, they often struggle with evolving attacks, dataset biases, and limited explainability. Large Language Models (LLMs) offer a promising alternative with their zero-shot inference and reasoning capabilities. However, applying LLMs to Android malware detection presents two key challenges: (1)the extensive support code in Android applications, often spanning thousands of classes, exceeds LLMs' context limits and obscures malicious behavior within benign functionality; (2)the structural complexity and interdependencies of Android applications surpass LLMs' sequence-based reasoning, fragmenting code analysis and hindering malicious intent inference. To address these challenges, we propose LAMD, a practical context-driven framework to enable LLM-based Android malware detection. LAMD integrates key context extraction to isolate security-critical code regions and construct program structures, then applies tier-wise code reasoning to analyze application behavior progressively, from low-level instructions to high-level semantics, providing final prediction and explanation. A well-designed factual consistency verification mechanism is equipped to mitigate LLM hallucinations from the first tier. Evaluation in real-world settings demonstrates LAMD's effectiveness over conventional detectors, establishing a feasible basis for LLM-driven malware analysis in dynamic threat landscapes.
1. Introduction
Android malware detection faces evolving threats, dataset bias, and limited explainability, while LLMs additionally struggle with application scale and structural complexity. LAMD addresses these challenges through context extraction, tier-wise reasoning, and factual consistency verification.
- Android malware threatens user privacy, financial security, and sensitive data, while existing detectors face adaptive attacks, dataset bias, and limited explainability.
- LLMs offer zero-shot inference and human-readable analysis, but Android applications contain extensive support code that exceeds context limits and obscures malicious code.
- The paper asks whether crucial semantic and structural information can be extracted from complete applications to guide LLM-based malware detection.
- LAMD extracts suspicious-API context through static analysis and backward slicing, then represents dependencies and invocations for LLM reasoning.
- LAMD progressively reasons from fine-grained code to higher-level behavior using tier-wise analysis and factual consistency verification.
- On a real-world dataset, LAMD outperforms conventional learning-based detectors under distribution shift while supporting malware detection and explanation.
2. Related Work
Related work covers conventional Android malware detectors and emerging LLM-based approaches, emphasizing distribution drift, zero-shot generalization, and the difficulty of analyzing complex Android code.
- Conventional learning-based detectors improve scalability through automatically learned static or dynamic features but struggle with concept drift in real-world deployments.
- LLMs provide zero-shot inference that can generalize beyond predefined training data and feature spaces for security analysis.
- LAMD is positioned as a response to these limitations through a workflow combining suspicious-API extraction, static analysis, and structured reasoning.
- Existing LLM security studies largely target simpler ecosystems, including npm packages, PowerShell scripts, Linux binaries, and JavaScript threats.
- Prior Android LLM detection work either lacks filtering, allowing benign code to obscure malicious patterns, or relies on predefined feature summaries instead of raw-code analysis.
3. Methodology
LAMD extracts security-relevant Android program context and analyzes it through three hierarchical reasoning tiers. Static analysis, backward slicing, and consistency verification preserve relevant behavior while controlling noise and hallucination risk.
- LAMD has two components: key context extraction and tier-wise code reasoning for efficient malware detection and interpretation.
- Key context extraction identifies suspicious APIs and analyzes their control and data dependencies while pruning potentially irrelevant calling relationships.
- The reasoning strategy processes function, API, and APK information sequentially, with each tier informing the next and first-tier verification limiting error propagation.
- Suspicious APIs are selected using sensitive-data access and transmission criteria informed by public knowledge bases, while applications without such APIs are handled individually.
- Backward slicing removes CFG instructions irrelevant to suspicious API invocations while preserving variables, dependencies, control flow, and unresolved caller context.
- Tier 1 summarizes sliced function behavior, Tier 2 infers API intent from function-call graphs, and Tier 3 judges APK maliciousness using API intents and indicators of compromise.
- Factual consistency verification checks LLM function summaries against explicitly extracted variable and inter-variable dependencies before higher-tier reasoning.
4. Evaluation
LAMD is evaluated on a temporally realistic Android malware dataset using detection, explanation-quality, ablation, OOD, and cost analyses. It improves detection under distribution drift, supports category-level analysis, and remains operationally feasible but non-trivial in cost.
- Dataset construction: The dataset preserves temporal order, real-world malware-to-benign ratios, and diversity across packed, obfuscated, and varied-market samples.Samples are selected from AndroZoo by VirusTotal submission time, with labels based on more than four vendor detections.
- Malware detection performance: 23.12% average F1-score improvement and 71.59% average FNR reduction show stronger detection reliability under increasing distribution drift.LAMD’s FPR increases slightly, but the evaluation notes that FPR is less indicative under severe class imbalance.
- Ablation analysis: Removing tier-wise reasoning reduces performance, while removing hallucination mitigation causes a smaller decline, supporting both components’ contribution.The ablations are LAMD-R without tier-wise reasoning and LAMD-F without factual consistency verification.
- Out-of-distribution evaluation: LAMD outperforms baselines on temporally aligned post-cutoff samples, although it exhibits higher FPR and lower FNR than learning-based approaches.The OOD experiment aligns GPT-4o-mini’s October 2023 cutoff with newer November–December 2023 samples.
- Explanation quality: 81 of 100 correctly detected malware samples are assigned to their respective categories, with Adware and Riskware posing greater classification challenges.The evaluation attributes these difficulties to less distinct malicious patterns.
- Cost: Approximately $1800 is spent evaluating 9,046 APKs, averaging $0.199 per APK, while per-APK cost varies with extracted CFG slices and suspicious APIs.The authors describe deployment as feasible but note that the operational expense remains non-trivial at large scale.
5. Case Study
The case study shows that context extraction enables LLMs to analyze applications too large for direct processing and to recover malicious behavior obscured by benign support code.
- Context-window failure: A 1,547,806-line application exceeds Gemini 1.5 Pro’s 20,971,520-byte context limit, whereas LAMD enables GPT-4o-mini to produce an accurate prediction.LAMD succeeds despite GPT-4o-mini having one-tenth the token capacity described for Gemini 1.5 Pro.
- Malware behavior analysis: LAMD correctly identifies SMSReg as malware after Gemini misclassifies it as benign because extensive benign classes obscure malicious behavior.Both GPT-4o-mini and Gemini 1.5 Pro correctly identify the sample when using LAMD.
- Generated explanations: The generated analyses identify sensitive API misuse, SSL-error bypasses, and location tracking as key malicious behaviors.The reported findings include getDeviceId(), getSubscriberId(), sendTextMessage(), SslErrorHandler.proceed(), and location APIs.
6. Discussion
The discussion positions LAMD as effective against unseen threats while acknowledging limits in fine-grained analysis, computational efficiency, and cost.
- Limitations: General pre-training limits fine-grained behavior analysis, and over-squashing remains a challenge for identifying key aspects of complex programs.The authors suggest domain-specific fine-tuning or external knowledge integration as future directions.
- Trade-offs: LLMs adapt to unseen threats, but they require significantly more computational resources and incur higher costs than learning-based approaches.The authors propose studying combinations of both paradigms to exploit their complementary strengths.
7. Conclusion
LAMD addresses LLMs’ context and structural difficulties through context-driven processing and demonstrates stronger real-world Android malware detection than conventional detectors.
- Conclusion: LAMD combines suspicious-code context extraction with tier-wise reasoning to analyze complex Android structures and semantics for explainable detection.The conclusion presents it as a practical framework for applying LLMs to Android security.
- Conclusion: LAMD outperforms conventional detectors in real-world evaluation, supporting its use for evolving Android malware analysis.The conclusion links this outcome to handling distribution drift, dataset bias, and explainability gaps.
Appendix A. Baseline Models
The baseline models represent established Android malware detectors using handcrafted static features, graph-derived features, or learned classifiers. These methods are identified as current state-of-the-art baselines for evaluation.
- Drebin represents applications with binary vectors from nine data types and applies a linear classifier.
- DeepDrebin retains Drebin’s feature space but replaces its linear classifier with a three-layer deep neural network.
- Malscan extracts sensitive API calls, computes four centrality measures, and uses Random Forest classification for lower overhead.
- These baseline approaches are treated as current state-of-the-art Android malware detectors.
Appendix B. Impact of Training Dataset Sizes
The appendix examines training-data volume under distribution shift, showing that more data helps on in-distribution samples but does not improve detection of significantly drifted samples. Training dominated by older applications can reinforce outdated patterns and impair generalization to newer samples.
- Five-times-larger JS divergence between training and test distributions reflects substantial shift in the realistic evaluation setting.The test set contains more packed and obfuscated applications, which became more common after 2020.
- Additional training data does not improve detection of significantly drifted samples, though it enhances performance on in-distribution samples.
- Training sets dominated by older data can teach features representative of early applications, reducing performance on newer drifted samples.The authors connect this pattern to empirical risk minimization selecting features that distinguish the overall, temporally skewed training set.
Appendix C. Factual Consistency Verification
LAMD verifies factual consistency by checking dependencies linking variables, computations, control flow, and suspicious APIs. These relationships ground summarized malicious behaviors in program logic rather than hallucinated reasoning.
- Factual consistency verification uses five dependency types representing fundamental program relationships for malware reasoning and detection.
- Variable-to-API dependencies track whether direct, transitive, or conditional variable relationships influence suspicious API execution.
- Inter-variable dependencies capture relationships among variables that affect security-sensitive operations.
- Parallel dependencies identify jointly contributing variables, while derived dependencies expose transformations that may disguise malicious behavior.
- Incorporating these dependencies helps ensure that summarized malicious behaviors are grounded in actual program logic, improving precision and interpretability.
Appendix D. Backward Slicing Algorithm
LAMD’s backward slicing isolates code relevant to suspicious API invocations through variable retrieval and slice extraction. The procedure works backward through the control-flow graph to preserve influencing statements for subsequent analysis.
- The backward slicing algorithm has two phases: variable retrieval followed by slice extraction.
- Variable retrieval starts from a suspicious API invocation and tracks relevant variables backward through the control-flow graph.
- The procedure uses a worklist, visited set, variable map, and predecessor traversal to propagate relevance through preceding control-flow units.
- Slice extraction retains function parts that influence the suspicious API invocation, enabling focused downstream analysis.