Cost-Aware Android Malware Detection Using an Early-Warning Behaviour Score

Abstract

Android malware detection systems commonly emphasize predictive accuracy while paying less attention to feature-acquisition cost, deployment efficiency, and early decision making. This paper presents a staged model-input budget framework for cost-aware Android malware screening and evaluates classification performance under progressively expanded static feature representations. The proposed framework uses a lightweight Behaviour Score as an early-warning model input derived from multiple static behavioural indicators, including permission risk, encryption evidence, network activity, and suspicious keyword evidence. Rather than treating the score as a cost-free feature, the framework distinguishes between the derived model input and the underlying static indicators required to construct it. Uncertain samples are progressively escalated from the early-warning stage to richer feature budgets using a confidence-based decision rule, while confident samples can be resolved before full-feature analysis. The experimental evaluation reports hyperparameter-tuned model performance, empirical inference-time profiling, confidence-based escalation behaviour, Matthews correlation coefficient, false positive rate analysis, low false-positive-rate operating points, cross-validation, statistical testing, and external proxy-budget validation using the Drebin benchmark. On the main Android application dataset, the Behaviour-Score stage achieved an F1-score of 0.8750. When low-cost static indicators were added, the framework achieved an F1-score of 0.9654 and a Matthews correlation coefficient of 0.9267. The full feature set achieved the highest F1-score of 0.9878 and Matthews correlation coefficient of 0.9741. The confidence-based escalation experiment showed that, at a predefined 0.95 confidence operating point, 90.32% of samples were resolved before full-feature analysis, reducing the average number of classifier model inputs used from 9 to 3.50 while maintaining an F1-score of 0.9785. These findings indicate that the proposed framework provides an incremental model-input budget approach for deployment-oriented Android malware screening, while preserving full analysis for uncertain samples.