Explainable AI-Based Android Malware Detection and Risk Analysis Using Machine Learning

Explainable AI-Based Android Malware Detection and Risk Analysis Using Machine Learning

IEEE BASE PAPER TITLE:

Defending Against Adversarial Malware Attacks on ML-Based Android Malware Detection Methods

IEEE BASE PAPER ABSTRACT:

Android malware presents a persistent threat to users’ privacy and data integrity. To combat this, researchers have proposed machine learning-based (ML-based) Android malware detection (AMD) methods. However, adversarial Android malware attacks compromise the detection integrity of the ML-based AMD methods, raising significant concerns. Existing defenses against adversarial Android malware mainly focus on feature space attacks that generate adversarial feature vectors only, while defenses against realistic problem space attacks that generate real adversarial malware remain relatively underexplored. In this paper, we take a step toward this gap by proposing ADD, a practical adversarial Android malware defense framework designed as a plug-in to enhance the adversarial robustness of the ML-based AMD methods against problem space attacks. Our evaluation across multiple ML-based AMD methods shows that ADD performs well against the evaluated state-of-the-art problem space adversarial Android malware attacks. Additionally, ADD shows the defense effectiveness in enhancing the adversarial robustness of real-world antivirus solutions.

PROJECT OUTPUT VIDEO:

ALGORITHM / MODEL USED:

Support Vector Machine (SVM), ExtraTree Classifier, Random Forest Classifier, Stacking Classifier, XGBoost (Gradient Boosting Classifier), Logistic Regression.

OUR PROPOSED ABSTRACT:

The rapid growth of Android applications has increased the risk of malware attacks, privacy violations, unauthorized access, and other security threats targeting mobile users. Traditional malware detection techniques often rely on predefined signatures and may struggle to identify emerging or previously unseen malicious applications. To address these challenges, this project proposes an Explainable AI-Based Android Malware Detection and Risk Analysis System Using Machine Learning that combines machine learning, Android permission analysis, APK security inspection, and explainable artificial intelligence techniques.

The proposed system analyzes Android application characteristics, particularly permission-based features, to identify potentially malicious applications. Multiple machine learning algorithms, including Logistic Regression, Extra Tree Classifier, Random Forest, Stacking Classifier, Support Vector Machine (SVM), and XGBoost, are employed for malware classification. In addition to manual permission-based prediction, the system provides an APK scanning mechanism that extracts relevant security characteristics from uploaded Android applications and examines dangerous permissions, suspicious API calls, malware-related signatures, native libraries, multiple DEX files, dynamic code loading, and other potentially risky behaviors. Based on these characteristics, the system generates a risk score and categorizes applications as Benign, Suspicious, or Malware.

To improve the transparency of machine learning predictions, the proposed system integrates Explainable AI techniques such as SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-Agnostic Explanations). These techniques identify the important features contributing to each prediction and provide understandable explanations of why an application is considered potentially malicious. The system is implemented as a Python Flask-based web application, providing an interactive interface for malware prediction, APK analysis, risk assessment, model comparison, and explanation of detection results.

The proposed approach provides a comprehensive framework for Android malware detection, application risk assessment, and interpretable machine learning-based security analysis, helping users understand not only whether an application is potentially malicious but also the security characteristics that contribute to the prediction.

SYSTEM REQUIREMENTS:

HARDWARE REQUIREMENTS: 

• System : Pentium i3 Processor.
• Hard Disk : 20 GB.
• Monitor : 15’’ LED.
• Input Devices : Keyboard, Mouse.
• Ram : 8 GB.

SOFTWARE REQUIREMENTS: 

• Operating System : Windows 10 / 11.
• Coding Language : Python 3.13.15.
• Web Framework : Flask.
• Frontend : HTML, CSS, JavaScript.
• Database : SQLite.

REFERENCE:

Ping He, Lorenzo Cavallaro, and Shouling Ji, “Defending Against Adversarial Malware Attacks on ML-Based Android Malware Detection Methods”, IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 21, 2026.

👉CLICK HERE TO BUY THIS PROJECT “Explainable AI-Based Android Malware Detection and Risk Analysis Using Machine Learning” SOURCE CODE👈

What is the main objective of this project?

The main objective is to develop a machine learning-based system that can detect potentially malicious Android applications and assess their security risk. The system also uses Explainable AI techniques to explain the factors contributing to machine learning predictions.

Why is Android malware detection important?

Android applications can request sensitive permissions and perform activities that may affect user privacy and device security. Malware detection helps identify applications containing suspicious characteristics before they cause potential security problems.

Which dataset is used in the project?

The machine learning component uses the TUANDROMD dataset for Android malware classification.

Which machine learning algorithms are implemented?

The proposed system implements the following machine learning algorithms: Logistic Regression Extra Tree Classifier Random Forest Stacking Classifier Support Vector Machine (SVM) XGBoost

Which machine learning model achieved the highest test accuracy?

Among the implemented models, Support Vector Machine (SVM) achieved the highest test accuracy of 97.48% in the evaluated experiment.

What are the two major detection approaches in the system?

The system provides two major approaches: Permission-based malware detection Automated APK-based malware analysis These approaches allow the system to analyze Android applications using both extracted permission information and detailed APK characteristics.

What is APK analysis?

APK analysis involves examining an Android application package to identify security-related information and suspicious characteristics. The proposed system analyzes elements such as permissions, APIs, signatures, DEX files, native libraries, and other structural indicators.

What is risk analysis in this project?

Risk analysis assigns a numerical risk score to an analyzed application based on the identified security-related characteristics. The score is then used to categorize the application into different security levels.

What is Explainable AI?

Explainable Artificial Intelligence refers to techniques that help explain why a machine learning model produced a particular prediction. Instead of displaying only the final classification, the system provides information about the features that contributed to the prediction.

Which Explainable AI techniques are used?

The project uses: SHAP (SHapley Additive exPlanations) LIME (Local Interpretable Model-Agnostic Explanations)

What is the purpose of SHAP?

SHAP is used to identify the contribution of individual features toward a machine learning prediction. It helps show which features have an influence on the classification result.

What is the purpose of LIME?

LIME provides a local explanation of an individual machine learning prediction by identifying the features that are influential for that particular input.

Is the system suitable for academic implementation?

Yes. The project combines concepts from Machine Learning, Artificial Intelligence, Cyber Security, Android Security, Web Development, and Explainable AI, making it suitable for an academic project involving multiple technical components.