Open Access

ARTICLE

A Graph-Based Interpretable Framework for Effective Android Malware Detection^#

Chun-I Fan^1,2, Sheng-Feng Lu¹, Cheng-Han Shie¹, Ming-Feng Tsai¹, Tomohiro Morikawa^3,*, Takeshi Takahashi⁴, Tao Ban⁴

1 Department of Computer Science and Engineering, National Sun Yat-sen University, Kaohsiung, Taiwan
2 Information Security Research Center, National Sun Yat-sen University, Kaohsiung, Taiwan
3 Graduate School of Information Science, University of Hyogo, Kobe, Japan
4 Cybersecurity Research Institute, National Institute of Information and Communications Technology, Tokyo, Japan

* Corresponding Author: Tomohiro Morikawa. Email:

(This article belongs to the Special Issue: Advanced Security and Privacy for Future Mobile Internet and Convergence Applications: A Computer Modeling Approach)

Computer Modeling in Engineering & Sciences 2026, 147(1), 47 https://doi.org/10.32604/cmes.2026.077799

Received 17 December 2025; Accepted 02 February 2026; Issue published 27 April 2026

Abstract

Due to its partly open-source architecture, which allows for application analysis and repackaging, along with its large market share, the Android operating system is a main target for malware. In recent years, researchers have widely adopted neural network-based methods for detecting Android malware, achieving impressive results but without interpretability. Interpretability is crucial for showing how models behave and identifying biases in their predictions, which helps in validating and improving them. Additionally, in urgent malware analysis situations, interpretability lets analysts quickly assess harmful behaviors and aids in future malware development and investigation. Therefore, interpretability is vital for ensuring that neural network-based malware detection models are trustworthy, predictable, and strong. To address these issues, we propose an interpretable Graph Attention Network (GAT)-based framework for Android malware detection. This framework includes data flow analysis of Android applications to identify malicious behaviors, providing clarity through the attention mechanism of GAT. Analysts and researchers can access detailed information, such as the names and execution order of the involved Android APIs, allowing for better validation and security checks. Experimental results show that our framework achieves a precision of 97.4%. Additionally, case studies highlight the insights that researchers can gain by using this framework.

---

Keywords

---