XGCN-GAT: An Explainable and Robustness-Aware Hybrid Graph Neural Network Framework for Android Malware Detection

Abstract

The continued growth of the Android ecosystem has been accompanied by an escalating volume of malicious applications, motivating the development of detection methods that are simultaneously accurate, transparent, and resilient to evasion. Graph-based learning has emerged as a powerful paradigm for Android malware detection because it represents applications as function call graphs (FCGs) that preserve both semantic node attributes and structural relationships. However, most existing graph neural network (GNN) detectors rely on a single learning architecture, offer little insight into their decisions, and are rarely evaluated against adversarial manipulation. This paper presents XGCN-GAT, a hybrid framework that processes each application graph in parallel through Graph Convolutional Network (GCN) and Graph Attention Network (GAT) branches and fuses their embeddings for classification. Beyond detection, the framework is subjected to a three-part trustworthiness evaluation: (i) post hoc explainability using SHapley Additive exPlanations (SHAP) and GNNExplainer, (ii) a quantitative assessment of explanation faithfulness, stability, and cross-explainer agreement, and (iii) a feature-space adversarial robustness analysis under an add-only threat model. On a Drebin-based dataset of 10,249 applications, the final XGCN-GAT model attains 95.65% accuracy and 97.8% AUC on a held-out test set of 2000 applications. In a controlled comparison with its individual branches under the same training protocol, the hybrid is significantly more accurate than the GCN branch at two of three model widths and on par with the GAT branch in accuracy at every width, while missing the fewest malicious applications at every width. The explainability analysis identifies permission features as the largest contributor in aggregate, while method-type features show the largest per-feature attribution and the strongest impact under category-level ablation. The robustness analysis reveals a meaningful feature-space vulnerability under the defined add-only threat model: greedy perturbations achieve successful evasion with a small number of added features but plateau before complete evasion, whereas explanation-guided perturbations achieve higher ultimate evasion and require no model queries during the attack once feature attributions are available (in our experiments, these attributions were computed with full model access), outperforming random and FGSM attacks. Naive adversarial retraining yields no measurable improvement. These results establish XGCN-GAT as an effective detector while providing a candid, reproducible account of the interpretability and security limitations that remain open for graph-based malware detection.