PaperlayerView exact revision on arXiv

Source-linked AI summary

Moirae: A Multimodal Agent Collaborative Framework for Dynamic Android Malware Detection

Xueying Zeng, Youquan Xian, Yanze Li, bowen hu, Ziqi Shan, Xu Luo, DanPing Yang, Peng Liu, Lei Cui, Bo Li

arXiv:2608.27994v1cs.CRcs.SE

TL;DR

Android malware detectors struggle with concept drift and existing LLM-based detectors often rely on code-centric or single-dimensional evidence. Moirae dynamically fuses visual, UI, and API runtime evidence through specialized collaborative agents, achieving 90.06% accuracy without target-domain fine-tuning on unseen datasets.

  • Problem

    Android malware detectors face concept drift from evolving application implementations, while existing LLM-based detectors rely on code-centric or single-dimensional evidence.

  • Method

    Moirae dynamically collects and aligns visual inducements, UI transitions, and system-level API operations, then uses specialized agents and a judge for collaborative reasoning.

  • Results

    90.06% accuracy was achieved on temporally and distributionally unseen datasets without target-domain fine-tuning, outperforming SOTA baselines.

  • Takeaways & Limitations

    Moirae provides zero-shot generalization by reconstructing cross-level behavioral chains and inferring high-level malicious intent from runtime evidence.

  • Takeaways & Limitations

    Raw low-level API sequences would likely exceed the LLM context window and add substantial inference latency and computational cost without intermediate abstraction.

Abstract

from arXiv · show

The Android ecosystem faces persistent and rapidly evolving malware threats. Existing machine learning detectors are vulnerable to concept drift because they rely on implementation-specific features whose distributions change over time. Large language models (LLMs) offer strong semantic understanding and zero-shot reasoning, but current LLM-based detectors typically depend on code-centric or single-dimensional evidence, making them susceptible to obfuscation and limiting comprehensive behavior analysis. We present {\sysname}, a multimodal agent collaborative framework for dynamic Android malware detection. {\sysname} dynamically collects multimodal runtime evidence and employs ReAct-based specialized agents to analyze complementary behavioral views. The detection process begins by identifying visual deception cues, modeling UI state transitions, and integrating runtime API behaviors to fuse multi-dimensional evidence across user-visible interfaces and hidden backend operations. Experiments on temporally and distributionally unseen datasets show that {\sysname} achieves an accuracy of 90.06\% without fine-tuning, outperforming state-of-the-art baselines and demonstrating strong zero-shot generalization against Android malware concept drift.

INTRODUCTION

Android malware detectors face concept drift as evolving applications shift feature distributions, while existing LLM-based approaches often rely on code-centric or single-dimensional evidence. Moirae addresses this gap by fusing multimodal runtime evidence with collaborative specialized agents and achieves 90.06% accuracy without fine-tuning.

  • Historical-feature detectors degrade as benign and malicious applications evolve and their feature distributions shift over time.
  • Existing LLM-based detectors either summarize program features for classifiers or reason over decompiled code, leaving them vulnerable to obfuscation or limited behavioral coverage.
  • Cross-level evidence is motivated by complementary behavioral views: interfaces reveal inducement, interactions reveal state transitions, and APIs expose consequences.
  • Moirae dynamically captures visual presentation, UI interaction transitions, and system-level API operations to connect user-visible behavior with underlying consequences.
  • Specialized ReAct-based LLM agents collaboratively process, align, and mutually verify multimodal evidence.
  • 90.06% accuracy was achieved, with excellent generalization compared to the SOTA baseline.

RELATED WORK

Prior Android malware detectors use static, dynamic, adaptive, or LLM-assisted approaches but remain tied to evolving feature distributions or incomplete evidence. Moirae instead constructs cross-modal causal evidence and applies collaborative LLM-agent reasoning.

  • Existing approaches address concept drift through package-level abstractions, semantic embeddings, pseudo-labeling, active learning, and dynamic sandbox traces.
  • LLM-based paradigms commonly augment features or analyze code, limiting access to complete and mutually corroborating behavioral evidence.
  • Moirae represents runtime evidence as F = {V, S, E, T} and uses agents {Avis, Aue, Aapi, Ajudge} to connect user interactions with system API calls.
  • Dynamic preprocessing synchronously records screenshots, XML UI-state trees, and ART method-invocation traces during application execution.
  • Timestamp alignment binds semantic events to underlying traces within a defined time window, producing noise-eliminated cross-modal causal evidence.
  • Three expert agents reason in parallel, after which a judge agent aggregates their observation vectors into a threat classification and structured evidence chain.

Dynamic Driving and Multimodal Feature Capture

Moirae autonomously drives applications, captures synchronized visual, UI, and runtime traces, and compresses them into causally aligned evidence. Specialized agents then analyze each modality before a judge fuses their findings into the final decision.

  • The sandbox uses DroidBot and depth-first GUI traversal to generate autonomous interaction sequences while recording screens, UI trees, and ART profiling traces.
  • Causal alignment links critical API sequences to the UI events that trigger them within event time windows and produces a dense fusion report.
  • ReAct collaboration separates visual, UI-event, and API forensics to reduce the burden of complex multimodal contexts.
  • The Vision Agent identifies visual deception such as endless pop-ups, forced credentials, and threatening or extorting interfaces.
  • The UI/Event Agent analyzes temporal XML structures for semantic misalignment, silent triggers, and anomalous privilege escalation.
  • The Judge Agent fuses visual, interaction, and trace representations to output a malicious verdict and interpretable evidence chain.

EXPERIMENTAL EVALUATION

Experiments used specified Python, hardware, model, and emulator settings, with no domain-specific fine-tuning and two-minute dynamic execution per APK.

  • Experiments used Python 3.11 on an Intel Core i7-12700 CPU with 32 GB of RAM.
  • The framework used MiniMax-M3 for its three view modules and Qwen3.6-27b locally on a single NVIDIA A100 GPU server.
  • Models used default temperatures without domain-specific fine-tuning, and each APK underwent two minutes of Android Emulator execution.

Datasets:

The study uses AndroZoo for training and three datasets to assess effectiveness, temporal robustness, ablations, token efficiency, and standard classification metrics.

  • Datasets: AndroZoo, CICMalDroid 2020, and CIC-AndMal2017 form the evaluation datasets.AndroZoo contributes 16,216 applications, while CICMalDroid 2020 and CIC-AndMal2017 are reserved as unknown test sets.
  • Datasets: AndroZoo applications span 2011–2021 and are labeled using VirusTotal detection thresholds.Applications flagged by ≥10 engines are malicious, while those with 0 flags are benign.
  • Research questions: The experiments ask whether Moirae is effective overall and how it compares with traditional models trained on large-scale data.
  • Research questions: Temporal robustness is evaluated without target-domain fine-tuning under concept drift.
  • Research questions: Ablation studies examine the effects of different LLMs and multidimensional evidence-extraction stages.
  • Research questions: Token-efficiency analysis measures stage-wise overhead and the compression of raw runtime traces through hierarchical evidence extraction.
  • Metrics: Accuracy, precision, recall, and F1 are calculated from true positives, true negatives, false positives, and false negatives.

RQ1 -Effectiveness Analysis

Moirae maintains strong cross-dataset performance on unseen distributions and substantially outperforms conventional supervised detectors, without target-domain fine-tuning.

  • Evaluation setting: Table I compares models trained on AndroZoo 2011–2016 against unseen datasets from different time periods.
  • Results: Moirae maintains strong and consistent detection performance on previously unseen datasets under cross-dataset evaluation.
  • Baseline comparison: MalScan (RF) achieves only 25.00% accuracy on CICMalDroid 2020, illustrating degradation among conventional baselines on newer malware variants.
  • Baseline comparison: All KNN- and RF-based baselines show substantial degradation on CIC-AndMal2017.
  • Results: 88.01% average ACC and 88.43% F1 on unseen data exceed the best baseline by 9.13% and 11.41%, respectively, without fine-tuning.

RQ2: Temporal Robustness

Moirae remains relatively stable under temporal concept drift, whereas baseline performance declines as the temporal gap from historical training data increases.

  • Evaluation setting: The evaluation uses chronologically organized AndroZoo samples, with baselines trained on historical 2011–2016 data and Moirae performing zero-shot inference.
  • Baseline degradation: CL-Malware accuracy falls from 92.46% in 2017 to 61.50% in 2021 as the temporal gap increases.
  • Baseline degradation: DroidEvolver F1 decreases from 91.71% to 60.23% between 2017 and 2021.
  • Moirae over time: Moirae accuracy remains approximately 87%–92% across five years and reaches around 90.70% in 2021.
  • Remaining limitation: Moirae recall decreases to approximately 77% in 2021 because conditionally triggered or environment-dependent behaviors may remain unactivated during dynamic exploration.
  • RQ2 Conclusion: Approximately 90% accuracy on 2021 samples outperforms baselines by approximately 18–29 percentage points without fine-tuning.

RQ3 - Ablation Study

RQ3 evaluates how Judge Agent choices and evidence modules affect Moirae’s detection performance. Heterogeneous judges offer precision-recall trade-offs, while combining all three evidence views produces the strongest overall results.

  • Judge Agent ablation: 90.06% accuracy and 92.15% F1 score are achieved when MiniMax-M3 extracts evidence and GLM-5.1 provides the reasoning layer.Different LLMs exhibit distinct decision behaviors as Judge Agents.
  • Judge Agent ablation: 92.09% precision is achieved by Gemini-3.1-Pro, whereas Qwen3.6-27b reaches 97.44% recall at lower precision.These Judge Agents provide different precision-recall operating points for diverse security scenarios.
  • Evidence module ablation: Removing View 2 reduces accuracy by 10.11 percentage points to 78.82%, the largest degradation among single-module removals.The ablation results identify View 2 as especially important within the cross-modal evidence chain.
  • Evidence module ablation: 86.32% accuracy is maintained when only View 2 is retained, indicating that UI interaction states provide highly discriminative behavioral evidence.The full three-view configuration nevertheless achieves the strongest overall detection performance.
  • Evidence module ablation: Using only View 3 yields 95.37% precision but 54.50% recall, showing that API evidence alone does not provide comprehensive detection.Adding semantic information from Views 1 and 2 connects user-visible behavior with underlying sensitive operations.

RQ4 - Token Efficiency

RQ4 analyzes Moirae’s token consumption across datasets and malware families. The framework compresses lengthy runtime evidence before Judge Agent reasoning, while token costs vary with behavioral complexity.

  • Consumption patterns: 105 to 10^6 tokens comprise the overall consumption range across malware families and datasets.Consumption patterns differ according to behavioral characteristics.
  • Consumption patterns: On CIC-AndMal2017, Adware consumes 766k tokens, Scareware 742k, and SMSmalware 646k, exceeding Benign at 397k and Ransomware at 372k.On CICMalDroid 2020, SMSmalware has the highest average consumption at 835k, while Benign samples remain relatively stable.
  • Agent contributions: View 3 contributes most of the token overhead because low-level API sequences and system-call traces contain repetitive, fine-grained information.The Judge Agent consumes only a small fraction after receiving compressed evidence representations.
  • Evidence compression: Input tokens span roughly 105 to 10^6, while evidence-extraction outputs cluster around 104 tokens.Views 1–3 transform lengthy behavioral traces into compact semantic representations.
  • Evidence compression: 10×–100× compression enables Judge Agent reasoning within a constrained context window, despite higher costs for interaction-intensive malware families.Moirae’s token utilization adapts to malware complexity while supporting scalable analysis.

CONCLUSION

Moirae addresses Android malware detection under concept drift by integrating multimodal runtime evidence rather than relying on implementation-specific or single-dimensional features. Experiments on temporally and distributionally unseen datasets show zero-shot generalization without target-domain fine-tuning.

  • CONCLUSION: Moirae dynamically integrates visual inducements, UI interaction transitions, and system-level API operations to reconstruct cross-level behavioral chains.The framework infers high-level malicious intent from user-visible behavior and underlying system consequences.
  • CONCLUSION: 90.06% accuracy is achieved on temporally and distributionally unseen datasets without target-domain fine-tuning.The paper reports that Moirae outperforms state-of-the-art baselines in this setting.
Loading 2608.27994v1…