2.1.1. Non-graph-based features.

Regarding non-graph-based features, several commonly used features in Android malware detection models include permissions [12,21,27], API calls [13,29], intents [23], and image-based representations [14,22].

Permissions are an important and commonly used feature as they directly reflect the sensitive resources and functionalities that an application requests to access. This information is extracted from the AndroidManifest.xml file. The method in [12] selects 22 critical permissions out of a total of 135, achieving a detection accuracy of 93.62%. Reference [21] proposes the use of both native permissions and custom permissions for malware detection. After feature selection, 55 critical permissions were chosen as features, and the model achieved a detection accuracy of 96.95%. In study [27], a feature selection approach based on linear regression was proposed, reducing the feature set from 102 to 27 permissions, with an F1-score of 96.1% in malware detection. Methods relying solely on permission features result in limited detection effectiveness, as permissions can only capture coarse-grained features of the application.

Besides permission features, API calls also represent a critical feature for representing malicious behaviors, as applications must invoke APIs to interact with the Android operating system, thereby potentially indicating abnormal activities. Study [13] utilizes only critical API calls and their parameters to identify malicious behavior. Specifically, they performed frequency analysis to select APIs that were used more frequently in malware samples compared to benign. However, this method is limited when dealing with malware that employs less common or new APIs. Reference [29] proposes the combination of three feature types: API calls, permissions, and hardware features, where permissions and hardware features are extracted from AndroidManifest.xml, and API calls are derived from classes.dex. The authors introduce a Multi-Head Squeeze-and-Excitation Residual block architecture to mine and emphasize the intricate relationships between features from multiple perspectives, thereby enhancing malware detection performance, with the model achieving an accuracy of 96.48%.

Intents are also an important feature for identifying malicious behaviors in Android applications. They indicate how an application interacts with the system or other components, thereby helping to detect potential malicious activities. This feature is often combined with other features, such as permissions or API calls, to improve detection performance. The method in [23] combines intent features with permission features to detect Android malware. Experimental results show that this approach achieves a detection rate of 95.5%, significantly higher than the 91% obtained when using intent features alone.

Regarding image-based features, some methods convert the classes.dex file of applications into images, which can be in grayscale or RGB format. These images are then processed using Convolutional Neural Networks to automatically learn and extract features for malware detection tasks [14,22].

Recently, several studies have leveraged Transformer-based architectures to learn semantic representations of static features for Android malware detection. MalBERT [30] is a Transformer-based approach for Android malware detection. It extracts and preprocesses the AndroidManifest.xml file by removing non-informative terms, mainly repetitive words and punctuation. The processed text is then used to fine-tune a BERT model for semantic representation learning and malware classification. Experimental results show that the approach achieves an accuracy of 97.61%.

DetectBERT [31] is proposed to learn feature representations of Android application source code in the form of Smali. The method leverages DexBERT, a pretrained model based on the BERT architecture, to extract semantic features from disassembled Smali code at the class level. Since an application typically consists of a large number of Smali classes and DexBERT is limited to processing individual classes, DetectBERT adopts a correlated Multiple Instance Learning strategy to aggregate dependencies and interactions among class-level embeddings into an application-level representation for malware detection.

In addition, BERTroid [32] was proposed to learn semantic representations of permissions declared in the AndroidManifest.xml using a Transformer-based architecture. However, this approach primarily focuses on permission information at the application configuration level and does not incorporate behavioral features extracted from the executable code, which play a crucial role in modeling malicious behaviors.

In general, non-graph-based features can only capture discrete and coarse-grained characteristics of the application. These features lack the ability to represent contextual relationships or interactions between components in the source code. Therefore, they are not powerful enough to accurately reflect the overall behavior of the program. As a result, models that rely solely on these features may fail to detect sophisticated malware.

2.1.2. Graph-based features.

Graph-based features can provide an effective abstract representation for modeling sequences of activities or relationships between components in Android applications. Various types of graph-based features have been proposed, including function call graphs, control flow graphs, and program dependence graphs. Among them, function call graphs have been widely adopted in recent studies due to their ability to capture the relationships between functions, thereby providing rich behavioral information and supporting effective malware detection.

The method in [24] is based on analyzing the centrality of sensitive API calls within the FCG of an application. In this approach, the FCG is considered a complex social network, and the centrality analysis of sensitive API calls is conducted to extract semantic features from the graph. Experimental results show that the method achieves a detection accuracy of 98%. However, it relies on a fixed list of sensitive APIs, which may become outdated as Android updates, potentially missing malicious behaviors that involve APIs not covered by the list.

A malware detection model based on the FCG is proposed in [25], where each node is represented by features related to opcode occurrence and API packages. Graph Neural Networks (GNNs) are then applied to extract higher-level features from the graph. Experimental results show that the model achieves a detection accuracy of 92.29%. Nevertheless, the node representation is limited, as it considers only the occurrence of opcodes and API packages as discrete features, while ignoring their semantic information.

The work in [8] proposes a method that prunes the FCG based on a predefined list of sensitive APIs. Each node in the pruned graph is then represented using semantic features of function names and triad attributes of the sensitive APIs. This approach has limitations, as relying on a fixed list of sensitive APIs for pruning may cause the model to overlook malicious behaviors that involve other APIs not included in the list.

In [7], the authors propose a malware detection method based on a sensitive function call graph. This graph is constructed by labeling sensitive nodes on the FCG, followed by extracting sensitive subgraphs and neighbor subgraphs to capture malicious behaviors from the application. Experimental results show that the model achieves an F1-score of 97.04%. However, this approach has certain limitations. First, it depends on a predefined list of sensitive APIs. In addition, it does not leverage node-level features, which could provide valuable information about the application’s behavior.

A feature enrichment method for nodes in the FCG based on Word2vec and node centrality is introduced in [9]. Specifically, if a node represents a system API, the API2vec model is employed to embed the corresponding package name. Conversely, for nodes representing user-defined functions, the Opcode2vec model is applied to embed the opcode sequences extracted from those functions. Additionally, the degree of each node is used as a weight for its feature vector. However, this approach has limitations, as it only exploits semantic features from package names, potentially overlooking critical information since functions within the same package may perform entirely different functions.

The work in [10] proposes a malware detection method based on the enriched FCG. The nodes in the FCG are augmented with features that combine graph-structured properties with semantic information related to function names, class names, and package names. This combination aims to enhance the modeling of application behavior at the function level. However, this method only exploits features from executable code and does not consider other important features, such as permissions, which are critical for identifying the sensitive resources or functionalities requested by the application.

Another approach in [11] constructs an API call graph by pruning the original FCG using a predefined list of sensitive APIs. The nodes in the API call graph are then represented using permission and opcode semantic features. However, this approach has several limitations. First, removing a large number of nodes from the original FCG may lead to the loss of important information, especially methods that are not directly linked to sensitive APIs but may still exhibit malicious behaviors. In addition, the effectiveness of this method strongly depends on the accuracy and completeness of the predefined sensitive API list.

Based on the review of the above studies, we compare static analysis-based Android malware detection methods in Table 1. The table summarizes these methods based on the extracted features, feature types, and publication year.

Download:

• PNG
  larger image
• TIFF
  original image

Table 1. Comparison of static analysis-based Android malware detection methods.

https://doi.org/10.1371/journal.pone.0349589.t001

3.2.1. Behavioral feature extraction.

1. a) Constructing the FCG

To extract behavioral features from an Android application, the classes.dex file is first decompiled into Smali code, which is a human-readable intermediate format, using the Androguard tool [39]. Then, the entire Smali code is analyzed to construct the FCG.

Definition 1. A Function call graph is a directed graph, denoted as FCG = (V, E), where V is the set of functions and E is the set of directed edges representing call relationships. Specifically, a directed edge from function A to function B indicates that A invokes B during the execution of the application.

The FCG plays an important role in modeling the structure and behavior of an application, as it provides detailed information about the relationships between functions and the program’s execution flow. However, in the original FCG, nodes only represent functions without incorporating detailed information about their roles or functionalities within the application. These details are important at the function level and can effectively reflect the application’s behavior. The lack of such information limits the capability of GNNs to learn meaningful representations from the graph. Therefore, to address this limitation and enhance the representational power of the FCG, the next step is to enrich the node information.

1. b) Enhancing node representations in the FCG

To represent nodes in the FCG, we adopt the node enrichment strategy from our previous work [10], which combines graph-structured properties with semantic information derived from package, class, and function names. For brevity, the detailed formulation is not repeated here.

In the context of FCGs, functions exhibit different roles and levels of influence within the execution flow. Functions with a high number of incoming or outgoing connections, or those located along important execution paths, often play a central role and are more likely to be involved in core application behaviors. Accordingly, structural features such as in-degree, out-degree, closeness centrality, Katz centrality, and clustering coefficient [40] are used to quantify the position and influence of each node, thereby capturing its role in the graph structure.

However, relying solely on structural information is insufficient to fully characterize the behavior of a function. Each node in the FCG corresponds to a specific function, and its functionality depends on its semantic context, including its class and package. These contextual elements provide important information about the function’s behavior, enabling the model to distinguish between functions that may share similar structural properties but exhibit different behaviors.

Therefore, integrating structural and semantic features enhances the representational capacity of the FCG. Each node is represented by an initial feature vector , obtained by combining its structural features and semantic representation.

1. c) Embedding the enriched FCG using GIN

Based on the enriched FCG, we propose using the GIN to extract behavioral features from the graph. GIN is a type of Graph Neural Network (GNN) introduced in [41], designed to improve the ability to distinguish between non-isomorphic graphs, which is an inherent limitation of many traditional GNN architectures. We choose GIN over other GNN models due to its advantage in effectively aggregating information from neighboring nodes and its strong discriminative power for complex graph structures. This is particularly important in Android malware detection, as malicious behaviors are often associated with specific structural patterns and abnormal interactions in the FCG.

GIN operates through a series of convolutional layers, where the feature vector of each node is updated by aggregating information from its neighboring nodes. At the l-th layer, the feature vector of node v is updated as follows:

(1)

where:

• is the feature vector of node v at the l-th layer, with ;
• is the initial feature vector of node v, obtained from the enriched node representation;
• denotes the set of neighboring nodes of node v;
• is a learnable parameter at the l-th layer;
• is a Multi-Layer Perceptron used in the l-th layer.

Intuitively, Equation (1) allows each node to refine its representation by combining its own previous features with the aggregated features of its neighboring nodes. Through this process, the model captures structural relationships and interaction patterns in the FCG. The MLP then applies a nonlinear transformation to the combined information, enabling the model to learn more expressive and discriminative node representations. Repeating this update across multiple layers allows the network to progressively capture higher-order structural dependencies in the graph.

To obtain the graph embedding vector, GIN employs a readout layer that aggregates the representations of all nodes at each layer and then concatenates the results from all layers. Specifically, the graph embedding vector, denoted as h_G, is defined as follows:

(2)

where V denotes the set of all nodes in the FCG, and L is the number of convolutional layers.

In this paper, we design the GIN architecture with two convolutional layers (L = 2) to balance computational efficiency and representation learning capability. After applying GIN, we obtain the output vector h_G, which represents the behavioral characteristics of the application.

3.2.2. Permission feature extraction.

Permission features play an important role in Android malware detection and have been widely adopted in previous studies. Typically, the list of permissions is extracted from the AndroidManifest.xml file and represented using one of two common approaches: (1) representing them as a binary vector based on a permission dictionary constructed from the entire dataset; or (2) selecting a subset of important permissions based on their frequency in both malware and benign samples, and then encoding each as a binary vector whose dimensions correspond to the selected permissions.

However, both of the above approaches have some notable limitations. First, such representations are discrete and fail to reflect the actual usage context of the permissions, which reduces the ability to distinguish between malicious and benign applications. For example, the RECORD_AUDIO permission may be requested by both legitimate calling apps and spyware, but with entirely different purposes. Second, these traditional representations overlook the semantic relationships among permissions, while many malicious behaviors can only be detected through the combination of several related permissions used together. For instance, the co-occurrence of READ_CONTACTS and INTERNET may indicate potential user data exfiltration.

To overcome these limitations, we propose a novel method that learns semantic features from the permission list using a pre-trained language model. This approach allows for effective extraction of latent semantic relationships between permissions.

1. a) Permission extraction and normalization

First, we extract all permissions of an APK file from the AndroidManifest.xml file. Subsequently, the permissions are normalized by removing prefixes and replacing underscores with spaces (e.g., ‘READ_CONTACTS’ is converted to ‘READ CONTACTS’). This step converts permission identifiers into a normalized textual form, making them more suitable for semantic embedding. The normalized permissions are then concatenated into a permission sequence and used as input to the embedding model.

1. b) Permission embedding with all-MiniLM-L6-v2

After normalization, the permission sequence of each application is used as input to a pre-trained language model to obtain a semantic vector. Specifically, we use the all-MiniLM-L6-v2 model [42], which is based on the SentenceTransformer architecture and is pre-trained to capture semantic relationships within a sequence [43].

The all-MiniLM-L6-v2 model is a lightweight version of MiniLM, consisting of 6 transformer layers, a 384-dimensional hidden size, and approximately 22 million parameters. With this architecture, the model is capable of encoding an input sequence into a 384-dimensional embedding vector while maintaining a good balance between performance and computational cost. We choose this model due to its compact size compared to larger language models, while still effectively capturing semantic relationships within a sequence. This makes it particularly suitable for large-scale data processing in Android malware detection.

For each permission sequence p of an application, we use the all-MiniLM-L6-v2 model to embed it into a semantic vector e_p, which represents the permission feature of the application.

By normalizing permissions before encoding, the model can effectively capture semantic relationships among permissions while maintaining computational efficiency, without relying on large and complex models such as BERT.

4.2.1. Evaluation criteria.

To evaluate the performance of HybFusion, we employ four commonly used metrics, including Accuracy, Precision, Recall, and F1-score. They are defined as follows:

(3)

(4)

(5)

(6)

where TP (True Positive) is defined as the number of malware applications correctly classified as malware, TN (True Negative) as the number of benign applications correctly classified as benign, FP (False Positive) as the number of benign applications incorrectly classified as malware, and FN (False Negative) as the number of malware applications incorrectly classified as benign.

Additionally, we use the confusion matrix to visually demonstrate the classification performance and make it easier to compare with other models. This matrix shows the values of TP, TN, FP, and FN, providing more detailed information about the model’s correct and incorrect predictions on the experimental dataset.

Classification performance was evaluated using 5-fold cross-validation, and the reported results correspond to the average values across the five folds.

4.2.2. Evaluation scenarios.

To evaluate the effectiveness of the proposed HybFusion model, we design nine evaluation scenarios as described below:

1. - Scenario 1: This scenario evaluates the effectiveness of feature fusion across multiple APK components, integrating behavioral features extracted from classes.dex and permission features extracted from AndroidManifest.xml. The results are compared with single-feature models to quantify each feature type’s contribution and confirm the effectiveness of fusion.
2. - Scenario 2: This scenario assesses the effectiveness of permission feature extraction using the pre-trained language model all-MiniLM-L6-v2. The proposed approach is compared with traditional permission representation methods, including: (1) binary vector representation based on a predefined permission dictionary, and (2) representation based on a subset of important permissions selected using frequency statistics. In addition, we compare our approach with Word2vec, a widely used semantic embedding technique, to demonstrate the advantages of using the pre-trained MiniLM model for permission feature representation.
3. - Scenario 3: This scenario evaluates the effectiveness of the stacking-based ensemble learning technique by comparing the classification performance of the stacking architecture with individual classification algorithms, including KNN, MLP, XGBoost, and RF.
4. - Scenario 4: This scenario investigates the impact of key model parameters on detection performance. Specifically, we focus on two aspects: the number of GIN layers used for embedding the FCG, and the choice of meta learner in the stacking-based ensemble classifier.
5. - Scenario 5: This scenario compares the performance of HybFusion with other methods on the primary experimental dataset.
6. - Scenario 6: This scenario evaluates the cross-dataset generalization capability of HybFusion by comparing it with other methods on the Drebin benchmark dataset. All models are trained on the primary experimental dataset described in Section 4.1 and evaluated on unseen Drebin malware samples.
7. - Scenario 7: This scenario assesses the robustness of the proposed HybFusion model under adversarial evasion attacks, where four attack types are considered: Permission stuffing, FCG poisoning, Name obfuscation, and Permission reordering.
8. - Scenario 8: This scenario evaluates the robustness of HybFusion under common obfuscation techniques, including class and method renaming, call indirection, constant string encryption, and manifest randomization.
9. - Scenario 9: This scenario analyzes the computational cost of HybFusion in terms of runtime and resource consumption, including average processing time per sample, peak RAM usage, peak VRAM usage, and throughput measured in applications processed per hour.

Unless otherwise specified, Scenarios 1–5 and 7–9 are conducted on the primary experimental dataset described in Section 4.1.

4.4.1. Experimental results of scenario 1.

This scenario aims to evaluate the effectiveness of combining behavioral features and permission features compared to using each feature type individually. Table 4 presents the model’s performance under the three different settings.

Download:

• PNG
  larger image
• TIFF
  original image

Table 4. Comparison of model performance using individual and combined features (%).

https://doi.org/10.1371/journal.pone.0349589.t004

The results in Table 4 show that both types of features achieve high detection performance when used independently. Specifically, when using only permission features, the model achieves an accuracy of 97.51% and an F1-score of 97.49%. This demonstrates the effectiveness of our proposed semantic permission feature extraction method in capturing an application’s access privileges.

Compared to the permission features, the behavioral features demonstrate superior performance. When the model uses only behavioral features, it achieves an F1-score of 98.57%, which is 1.08% higher than when using only permission features. This indicates that function call graph-based behavioral features provide richer information about the application’s operational behavior, thereby improving the model’s ability to distinguish between benign and malicious applications.

Notably, when combining both feature types, the model achieves the highest performance across all metrics, with an accuracy of 99.27%, a precision of 99.30%, a recall of 99.24%, and an F1-score of 99.27%, outperforming the use of each feature type individually. This demonstrates that the two feature types are complementary, and their integration enables the model to capture more comprehensive information about the application, thereby significantly improving malware detection effectiveness.

Fig 2 presents the confusion matrices of three models: (a) the proposed model using fused behavioral and permission features, (b) the model using only behavioral features, and (c) the model using only permission features. Specifically, Fig 2a shows that when both types of features are combined, the model correctly predicts 3,541 out of 3,568 malware samples, achieving a detection rate of 99.24%. Meanwhile, only 25 out of 3,580 benign samples are incorrectly predicted as malware, corresponding to a false prediction rate of just 0.76%. These results demonstrate the high accuracy and stable classification performance of the model. Compared to Fig 2b, when using only behavioral features, the model correctly predicts 3,504 malware samples (98.21%) and incorrectly predicts 64 samples. Fig 2c shows that the model using only permission features yields lower performance, correctly predicting 3,454 malware samples (96.80%) while incorrectly predicting 114 samples. These findings further confirm that each feature type, when processed and extracted using the proposed method, produces good results in malware detection. However, combining both feature types leads to superior performance.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 2. Confusion matrices under different feature configurations.

https://doi.org/10.1371/journal.pone.0349589.g002

4.4.2. Experimental results of scenario 2.

This scenario aims to evaluate the effectiveness of the proposed permission semantic feature extraction method, which employs the all-MiniLM-L6-v2 language model, by comparing it with three other permission feature extraction approaches. Specifically:

1. (1) The permission list of each APK file is represented as a binary vector based on a pre-constructed permission dictionary.
2. (2) Based on the frequency of permissions in malicious and benign files, the 20 most significant permissions are selected using the approach outlined in [12]. Each APK file is subsequently represented by a 20-dimensional binary vector.
3. (3) The normalized permission list is embedded using the Word2vec technique to generate a feature vector.

It should be noted that this scenario focuses solely on assessing the quality of the permission feature vectors generated by each method, without combining them with any other features. These permission feature vectors are then used as input for a classifier to compare the representational effectiveness of each approach. Detailed experimental results are presented in Table 5.

Download:

• PNG
  larger image
• TIFF
  original image

Table 5. Classification performance of different permission feature extraction methods (%).

https://doi.org/10.1371/journal.pone.0349589.t005

The results in Table 5 indicate that the proposed method using the all-MiniLM-L6-v2 model achieves the highest classification performance. Specifically, compared to the two traditional permission feature extraction methods based on a permission dictionary and frequency based approaches, our method improves accuracy by approximately 1.15% and F1-score by about 1.18%. These results demonstrate the superior capability of the all-MiniLM-L6-v2 model in learning semantic representations from normalized permission lists.

Notably, compared to Word2vec, a widely used semantic embedding technique, the all-MiniLM-L6-v2 method still achieves an F1-score 0.77% higher. This suggests that modern pre-trained language models like MiniLM can capture contextual information and relationships between permissions more effectively than traditional embedding methods.

Fig 3 presents the confusion matrices of two permission list embedding methods: (a) the proposed method using the all-MiniLM-L6-v2 language model and (b) the method using Word2vec. It can be observed that the proposed method reduces the number of benign files incorrectly predicted as malware by approximately 46% (from 119 files to 64 files). This result confirms that lightweight pre trained language models like MiniLM can be effectively utilized to extract semantic features from normalized permission lists.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 3. Comparison of confusion matrices between all-MiniLM-L6-v2 and Word2vec embeddings.

https://doi.org/10.1371/journal.pone.0349589.g003

In summary, the results confirm that normalizing the permission list into a permission sequence and embedding it using a lightweight pre-trained language model such as all-MiniLM-L6-v2 can significantly enhance malware detection effectiveness. This approach enables better exploitation of latent semantic relationships among permissions, thereby increasing classification accuracy.

4.4.3. Experimental results of scenario 3.

This scenario aims to evaluate the effectiveness of the classification model using the proposed stacking-based ensemble learning technique, compared to several popular individual classifiers, including KNN, MLP, RF, and XGBoost. Fig 4 presents a detailed summary of the experimental results for this scenario.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 4. Performance comparison between individual classifiers and the stacking-based ensemble (%).

https://doi.org/10.1371/journal.pone.0349589.g004

The results in Fig 4 indicate that the proposed model outperforms all individual classifiers across all evaluation metrics. Specifically, when comparing the highest and lowest values for each metric, the proposed model improves accuracy by 1.07%, precision by 1.23%, recall by 1.34%, and F1-score by 1.08%. These results demonstrate that the stacking-based ensemble learning technique effectively leverages the strengths of each base learner, thereby enhancing the overall performance of the malware detection model.

To further evaluate the stability and reliability of these results, Table 6 reports the mean and standard deviation obtained from 5-fold cross-validation. The proposed ensemble model achieves an F1-score of 99.27 0.03, compared with 99.00 0.08 for RF, which is the best-performing individual classifier. This shows that the proposed model not only provides higher classification performance, but also exhibits greater stability across multiple folds.

Download:

• PNG
  larger image
• TIFF
  original image

Table 6. Comparison of classifier performance across five folds with mean and standard deviation (%).

https://doi.org/10.1371/journal.pone.0349589.t006

Furthermore, the individual classifiers also achieve strong predictive performance, with F1-scores ranging from 98.19% (KNN) to 99.00% (RF). This further confirms that the proposed intelligent feature extraction and fusion strategy provides a rich representation of Android applications, thereby offering effective support for machine learning algorithms in classification tasks.

4.4.4. Experimental results of scenario 4.

This scenario evaluates how variations in two key model parameters affect detection performance. These parameters include the number of GIN layers applied for graph embedding and the choice of meta learner used in the stacking-based ensemble classifier. Results are detailed in Tables 7 and 8.

Download:

• PNG
  larger image
• TIFF
  original image

Table 7. Performance of the proposed model with varying GIN layers (%).

https://doi.org/10.1371/journal.pone.0349589.t007

Download:

• PNG
  larger image
• TIFF
  original image

Table 8. Performance of the proposed model with varying meta learner configurations (%).

https://doi.org/10.1371/journal.pone.0349589.t008

Table 7 presents the performance metrics of the proposed model with varying numbers of GIN layers, from 1 to 4, while keeping all other parameters constant. The results indicate that the model achieves its best performance when using two GIN layers, reaching an accuracy of 99.27%, precision of 99.30%, recall of 99.24%, and F1-score of 99.27%. This suggests that two layers provide sufficient depth for the GIN to effectively learn expressive representations from the enriched FCG. With only one layer, the F1-score drops to 99.09%, implying that the network lacks sufficient depth to fully capture the structural patterns of the graph. As the number of layers increases to 3 and 4, the performance slightly declines, with F1-score of 99.19% and 99.14%, respectively. This decline likely reflects overfitting or the loss of relevant information due to excessive aggregation, suggesting that deeper layers may introduce noise and reduce the model’s ability to distinguish important graph patterns. These findings highlight that a two-layer GIN configuration offers the best trade-off between expressiveness and generalization for this task.

Table 8 presents the performance of the proposed model with different classifiers serving as the meta learner in the ensemble framework. Among the tested options, LightGBM yields the best results with an F1-score of 99.27%, followed by Logistic Regression (99.24%) and XGBoost (99.23%). Although SVM and CatBoost also achieve strong performance, their scores are slightly lower. Overall, these results demonstrate that the ensemble framework is robust across various meta learners, with gradient-boosting-based methods offering a marginal advantage in classification accuracy.

4.4.5. Experimental results of scenario 5.

In this scenario, we compare HybFusion with state-of-the-art approaches on the primary experimental dataset. Specifically, the selected methods include DexRay [14], NATICUSdroid [21], Permission [28], Malscan [24], Mamadroid [48], and S³Feature [7]. These are well-known and open-source methods for Android malware detection. DexRay converts bytecode from DEX files into grey-scale images and uses them as the primary features for detection; NATICUSdroid leverages both native permissions and custom permissions to construct features; Permission applies a genetic algorithm to select an optimal subset of requested permissions; Malscan is a malware detection method based on analyzing the centrality of sensitive API calls within a function call graph of an application; Mamadroid proposes constructing abstracted API sequences from a function call graph, subsequently using a Markov model to transform these sequences into a feature vector representing the application; S³Feature extracts sensitive subgraphs and neighbor subgraphs from the sensitive function call graph to mine suspicious behaviors of applications. Detailed comparison results between the proposed model and the other methods are presented in Table 9.

Download:

• PNG
  larger image
• TIFF
  original image

Table 9. Performance comparison with other methods (%).

https://doi.org/10.1371/journal.pone.0349589.t009

The results in Table 9 demonstrate that the proposed method outperforms all other methods across all evaluation metrics. Specifically, our model achieves an accuracy of 99.27%, precision of 99.30%, recall of 99.24%, and F1-score of 99.27%, clearly outperforming the next best methods, Malscan with an F1-score of 97.82% and NATICUSdroid with an F1-score of 97.78%. These findings highlight the proposed model’s accurate and stable malware detection capability.

Among the remaining methods, DexRay shows stable performance, achieving an accuracy of 96.67% and an F1-score of 96.66%, but still significantly lower than our approach. The main reason is that DexRay relies solely on grayscale images converted from bytecode, without deeply leveraging behavioral and permission features. NATICUSdroid utilizes both native and custom permissions, resulting in the highest recall among the compared methods at 98.39%, with an F1-score of 97.78%. However, its overall accuracy remains low due to the lack of behavioral features from the function call graph. The Permission method employs a genetic algorithm to optimize the permission set, achieving a recall of 98.72%, but its precision is notably lower at 96.12%, reflecting an imbalance in classification performance.

For graph-based methods, Malscan achieves an F1-score of 97.82%, which is still noticeably lower than our proposed model. This is primarily because the method does not leverage permission features or employ ensemble learning techniques. S³Feature shows low performance, with an accuracy of 85.67% and a recall of 74.87%. This is mainly due to its dependence on a predefined list of sensitive APIs, which can quickly become outdated as Android versions evolve, potentially overlooking critical behaviors. Mamadroid performs the worst, with an accuracy of only 66.30% and a precision of just 60.40%. The main reason lies in its abstraction of API calls into package families, which leads to the loss of significant semantic information, thereby reducing classification performance.

Overall, the experimental results indicate that the proposed model effectively leverages information from multiple components of Android applications by extracting and combining behavioral and permission features. Additionally, the stacking-based ensemble learning architecture plays a key role in enhancing classification performance by integrating the strengths of various machine learning algorithms.

4.4.6. Experimental results of scenario 6.

This scenario evaluates the cross-dataset generalization capability of HybFusion on the Drebin benchmark dataset. HybFusion is compared with baseline methods, including DexRay [14], NATICUSdroid [21], Permission [28], Malscan [24], Mamadroid [48], and S³Feature [7]. All models were trained on the primary experimental dataset described in Section 4.1 and then tested on unseen Drebin malware samples. Since Drebin contains only malware samples, we report the True Positive Rate (TPR), which measures the proportion of malware correctly detected, and the False Negative Rate (FNR), which measures the proportion of malware incorrectly classified as benign. Detailed results are presented in Table 10.

Download:

• PNG
  larger image
• TIFF
  original image

Table 10. Cross-dataset detection performance on Drebin (%).

https://doi.org/10.1371/journal.pone.0349589.t010

The results in Table 10 demonstrate that HybFusion achieves the best cross-dataset detection performance among all compared methods, obtaining the highest TPR of 98.15% and the lowest FNR of 1.85%. These results indicate that the proposed model can effectively detect previously unseen malware samples from a different dataset.

Among the baseline methods, Malscan achieves the best baseline performance with a TPR of 97.11% and an FNR of 2.89%. Nevertheless, HybFusion still surpasses Malscan by improving the TPR by 1.04% while further reducing the FNR to 1.85%. This performance gain suggests that combining behavioral and semantic permission features yields more robust representations.

Overall, the results confirm that HybFusion exhibits strong cross-dataset generalization capability and maintains high detection effectiveness on unseen malware samples.

4.4.7. Experimental results of scenario 7.

To evaluate the robustness of HybFusion under evasion attacks, adversarial experiments were conducted using four common attack strategies: Permission stuffing, FCG poisoning, Name obfuscation, and Permission reordering. These attacks simulate realistic manipulation techniques that preserve application functionality while attempting to evade detection.

1. (1) Permission stuffing: The attacker injects benign permissions into the AndroidManifest.xml file to dilute malicious semantic signals. In this experiment, 100 benign permissions were added to each malicious sample.
2. (2) FCG poisoning: The attacker inflates the FCG with dummy benign nodes and edges to perturb graph aggregation in the GNN. In this experiment, call indirection transformations were applied using the Obfuscapk [49] tool to insert additional intermediate method calls without altering program semantics.
3. (3) Name Obfuscation: The attacker renames original class and method identifiers with meaningless symbols to remove semantic information embedded in class and method names. This transformation was implemented using the Obfuscapk tool.
4. (4) Permission reordering: The attacker shuffles the order of permissions declared in the AndroidManifest.xml file to evaluate permutation sensitivity in Transformer-based embeddings. In this experiment, permissions were randomly shuffled 100 times per sample to assess prediction stability under permutation.

We use clean accuracy and adversarial accuracy to evaluate the detection performance under clean and adversarial conditions. In addition, the Attack Success Rate (ASR) is adopted to measure the effectiveness of each attack. The ASR is defined as:

(7)

where denotes the number of malware samples correctly classified under clean conditions, and denotes the number of such samples that become misclassified after the attack.

Table 11 presents the robustness evaluation results of HybFusion under four representative evasion attack strategies. The experimental results indicate that HybFusion maintains stable detection performance under adversarial manipulations, with adversarial accuracy remaining above 97.8% across all evaluated scenarios.

Download:

• PNG
  larger image
• TIFF
  original image

Table 11. Robustness evaluation of HybFusion under adversarial attacks (%).

https://doi.org/10.1371/journal.pone.0349589.t011

Under the permission stuffing attack, where 100 benign permissions are injected to dilute malicious semantic signals, the model achieves an adversarial accuracy of 98.77% with an ASR of 1.01%. This result suggests that the feature fusion strategy mitigates the impact of semantic dilution, as behavioral features extracted from the FCG complement the permission-based representation.

For the permission reordering attack, the model achieves the highest adversarial accuracy of 98.98% and the lowest ASR of 0.60% among the evaluated attacks. This result suggests that the permission-based semantic representation remains relatively stable under permutation.

In the case of FCG poisoning, adversarial accuracy decreases slightly to 98.11% with an ASR of 2.34%. Despite the structural perturbations resulting from call indirection, the model maintains strong detection performance, suggesting that the GNN captures robust structural patterns within the call graph.

Regarding name obfuscation, the adversarial accuracy is 97.83% with an ASR of 2.91%, indicating a slightly larger impact compared with the other attacks. Even when the semantic information embedded in class and method names is removed, HybFusion maintains strong performance by leveraging structural topology features such as in-degree, out-degree, closeness centrality, Katz centrality, and clustering coefficient.

Overall, the experimental results demonstrate that HybFusion maintains strong robustness against multiple evasion strategies. Across all evaluated attacks, the adversarial accuracy remains above 97.8% while the ASR stays below 3%, indicating that the proposed model preserves stable detection capability under realistic adversarial manipulations.

4.4.8. Experimental results of scenario 8.

This scenario evaluates the resilience of HybFusion against several common malware obfuscation techniques, including manifest randomization, class and method renaming, call indirection, and constant string encryption. We use the Obfuscapk tool to generate obfuscated malware samples from the original test set. The experimental results are summarized in Table 12.

Download:

• PNG
  larger image
• TIFF
  original image

Table 12. Performance of HybFusion under various obfuscation techniques (%).

https://doi.org/10.1371/journal.pone.0349589.t012

The results in Table 12 show that HybFusion maintains strong detection performance across common malware obfuscation techniques, with F1-score remaining above 97.80%.

Class and method renaming leads to the most noticeable performance reduction, with the F1-score decreasing to 97.80%. This result is expected because identifier renaming removes semantic information embedded in function and class names. Nevertheless, the model still maintains stable detection performance by leveraging the structural role of nodes in the FCG and integrating permission-based semantic features.

The remaining obfuscation techniques have only a limited impact on the model. Specifically, call indirection yields an F1-score of 98.09%, indicating that the GIN-based graph representation learning remains robust against malware that obfuscates the structure of the FCG. Constant string encryption results in an F1-score of 98.24%, suggesting that the feature representation does not heavily rely on string literals. In contrast, manifest randomization causes only a minor performance change, with an F1-score of 98.78%.

4.4.9. Experimental results of scenario 9.

This scenario evaluates the computational efficiency of HybFusion by analyzing its runtime performance and resource consumption. All experiments were conducted on the Kaggle platform equipped with an Intel Xeon 2.00 GHz CPU, 13 GB of RAM, and an NVIDIA Tesla P100 GPU with 16 GB of VRAM.

Table 13 summarizes the computational cost and throughput of the proposed model. The results show that HybFusion processes each application with an average runtime of 5.5 seconds per sample. This processing speed is particularly notable considering that the underlying FCGs may contain thousands of nodes, while the experiments were conducted in a relatively modest computing environment. With an observed throughput of approximately 655 applications per hour, HybFusion demonstrates strong potential for scalability. In parallel processing environments, the analysis capacity can be further increased. Moreover, deploying the system on mid-range or high-performance computing platforms may further improve the processing speed.

Download:

• PNG
  larger image
• TIFF
  original image

Table 13. Computational cost and throughput analysis of HybFusion.

https://doi.org/10.1371/journal.pone.0349589.t013

In addition to runtime efficiency, HybFusion exhibits low memory consumption, with peak RAM and VRAM usage of 50.47 MB and 96.65 MB, respectively. Notably, the GPU memory consumption accounts for less than 1% of the available 16 GB VRAM, indicating that the model requires only modest computational resources.

These results highlight the practical deployability and scalability of HybFusion, making it well suited for large-scale Android malware analysis scenarios where thousands of applications must be processed efficiently.

4.5.1. Advantages of the proposed model.

The experimental results presented in this study demonstrate the superior performance of the proposed model compared to other approaches. We believe there are three main reasons contributing to the model’s high performance.

1. a) Effective feature extraction and fusion strategy

The results from Scenario 1 indicate that combining behavioral and permission features significantly enhances malware detection performance compared to using a single feature type independently. Specifically, the model employing combined features achieves an F1-score of 99.27%, whereas using only behavioral or permission features individually yields 98.57% and 97.49%, respectively. This confirms that the two feature types are complementary, enabling the model to comprehensively capture malicious behaviors.

Regarding the behavioral feature extraction method, our approach relies on a function call graph with enriched nodes. This rich representation, when combined with GIN, which is one of the powerful GNN architectures, enables the model to effectively learn complex behavioral patterns of malware.

For the permission feature extraction method, this study is among the first to apply the pre-trained language model all-MiniLM-L6-v2 to embed permission lists into a semantic representation. This approach allows the model to learn semantic relationships between permissions, thereby improving its ability to distinguish between normal permissions and those potentially abused by malware.

In summary, each feature extraction method effectively captures a distinct aspect of the application. By integrating these complementary features, the model is able to construct a more comprehensive behavioral profile, which significantly improves malware detection performance compared to approaches that rely on a single feature type.

1. b) Effectiveness in semantic feature extraction from permission lists

The results from Scenario 2 demonstrate that the proposed permission feature extraction method using the pre-trained all-MiniLM-L6-v2 language model outperforms traditional approaches. This advantage stems from the capability of Transformer-based models to capture latent semantic relationships among normalized permissions. Unlike discrete representations or traditional embedding techniques like Word2vec, the all-MiniLM-L6-v2 model enables global representation learning for permission sequences, thereby providing richer semantic features for the classifier.

1. c) Effectiveness of stacking ensemble learning technique

The results from Scenario 3 show that the classification model using the proposed stacking-based ensemble learning architecture significantly outperforms individual classifiers such as KNN, MLP, RF, and XGBoost. Specifically, the ensemble model achieves the highest performance across all metrics, with an accuracy of 99.27%, precision of 99.30%, recall of 99.24%, and F1-score of 99.27%. This demonstrates that combining multiple machine learning algorithms can effectively leverage the strengths of individual base classifiers, thereby enhancing the overall performance of the model.

4.5.2. Threats to validity.

Although the experimental results demonstrate that the proposed method achieves high malware detection performance, this study still has some limitations.

First, the large size and complex structure of the function call graph can significantly increase computational costs and affect the effectiveness of graph representation learning. In this study, the entire FCG is used as input to the GNN model; however, not all nodes and edges reflect malicious behaviors. Without applying graph optimization techniques, such as pruning less relevant components, the input representation may contain noise, which reduces the quality of learned features. This not only affects the model’s performance but also limits its scalability.

Second, the model relies solely on static features, while modern malware variants often employ sophisticated evasion techniques such as code obfuscation, packing, or dynamic code loading to bypass detection mechanisms. These behaviors are typically difficult to capture through static analysis and only manifest during runtime. As a result, the lack of dynamic features may reduce the model’s ability to detect malware, especially in cases involving complex obfuscation techniques.

Third, although the all-MiniLM-L6-v2 model enables effective semantic representation learning for permission features, it has an inherent limitation in input length, with a maximum context size of 256 tokens. In a small number of cases where applications declare unusually long permission lists, truncation of the input sequence may lead to partial information loss, particularly if sensitive permissions appear toward the end of the list.

Fourth, the potential impact of concept drift represents a significant challenge in the evolving Android malware landscape. Although our dataset spans multiple years, the rapid evolution of malware may affect long-term detection performance. In addition, potential dataset bias may influence the model’s ability to generalise to previously unseen malware families, as the dataset may not fully capture the diversity of real-world malware ecosystems. While the hybrid feature representation in HybFusion is designed to capture robust behavioral patterns, the model’s effectiveness against future or previously unseen malware variants requires further validation through continuous temporal evaluation.

Fifth, the stacking-based ensemble introduces additional computational overhead compared to individual classifiers. Specifically, the training time increases from 47.88 seconds for the best-performing individual classifier (RF) to 111.13 seconds for the stacking model, corresponding to an increase of approximately 2.3 times. In addition, the average inference time per sample at the classification stage increases from 0.02 seconds to 0.07 seconds. This reflects the additional computational cost required to achieve improved detection performance.