Android Malware Detection Using LightGBM with Intelligent Threat Attribution

Abstract

The Android platform accounts for the overwhelming majority of mobile devices in use worldwide, and that dominance has made it the principal target for authors of mobile malware [1], [2]. Applications distributed outside curated stores routinely abuse the permission model, conceal payloads behind obfuscation, or masquerade as repackaged versions of trusted banking and utility software. Detection schemes built on static signatures cannot follow threats that mutate between releases, and while machine learning classifiers have improved raw detection rates considerably, most of them return a bare verdict that an analyst has no means of interrogating. This paper describes a static analysis framework for Android malware detection that couples a LightGBM classifier with SHapley Additive exPlanations and a mapping layer built on the MITRE ATT&CK knowledge base. Features are drawn exclusively from the application manifest, which keeps extraction inexpensive and avoids the provenance artefacts observed when heterogeneous feature families are combined. Trained and evaluated on the AndroMD dataset and benchmarked against XGBoost, Random Forest and CatBoost under identical conditions, the proposed model attained 99.13% accuracy, a 99.84% ROC-AUC and a Matthews correlation coefficient of 98.26% while completing training in 27.84 seconds, between forty and fifty-nine per cent faster than the competing ensembles. Every prediction is accompanied by a per-sample attribution identifying the permissions responsible for it, and samples judged malicious are additionally mapped onto adversary tactics and techniques. The pipeline is delivered as a Flask application, APKGuard, which accepts an uploaded package and returns a scored verdict, an explanation and a behavioural summary in a single pass.