HybFusion: A holistic Android malware detection framework with advanced feature fusion and ensemble learning

Abstract

Android malware detection remains a critical challenge due to the rapid increase in malware variants and the growing sophistication of obfuscation techniques. To address these issues, this paper introduces HybFusion, a holistic Android malware detection framework that integrates advanced feature fusion with ensemble learning to enhance detection effectiveness and reduce false positives. HybFusion combines two complementary feature types to overcome the limitations of existing methods in capturing a comprehensive representation of malware behaviors and semantics: (1) behavioral features extracted from the function call graph and embedded using the Graph Isomorphism Network, and (2) semantic permission features obtained from the AndroidManifest.xml file by applying a normalization process to convert permission identifiers into a permission sequence, which is then embedded using a lightweight pre-trained Transformer-based language model. This strategy enables better leveraging of semantic relationships among permissions while maintaining low computational cost. In addition, HybFusion adopts a stacking-based ensemble learning strategy that leverages the strengths of multiple classifiers to further improve detection robustness. Extensive experimental results demonstrate that HybFusion outperforms existing approaches across all evaluation metrics, achieving a recall of 99.24% and an F1-score of 99.27%.