Android malware detection collapses when the context stage comes out - Help Net Security

Help Net Security newsletters : Daily and weekly news, cybersecurity jobs, open source projects, breaking news – subscribe here!

Please turn on your JavaScript for this page to function normally.

Anamarija Pogorelec, Senior Staff Writer, Help Net Security

July 29, 2026

Share

Android malware detection collapses when the context stage comes out

A phone backup app asks for storage, contacts, SMS, and call logs. A device-management tool asks for more than that. Run either one past a machine learning malware scanner and it comes back flagged.

Six Android detectors in wide research use, including Drebin, MalScan, and MaskDroid, produced that result on more than half the apps in a benign test set assembled from 49 Google Play categories. The worst performer, an LLM-based detector called LAMD, flagged 80% of them. Anyone gating an app store, an enterprise deployment, or a build pipeline on those verdicts is working a queue made mostly of legitimate software.

Researchers at Singapore Management University and Nankai University built that set by pulling benign apps from AndroZoo, ranking them by declared dangerous permissions, and keeping the top 270. Every app in it declares at least nine. Their detector, PRAXIS, flagged 13%.

Detectors match patterns from old malware

Drebin encodes manifest and code features into a vector and trains a support vector machine on it. MalScan, MsDroid, and MaskDroid work over call graphs and sensitive-API subgraphs. Each one learns a distribution from past malware and scores new apps by fit.

Permission breadth correlates with malware. It also correlates with backup tools, antivirus, parental controls, and anything that manages a device. The correlation carries the verdict, and legitimate software with a large permission surface lands on the wrong side of it.

The researchers reduce the failure to four words: "deviation is not maliciousness."

The same operation flips depending on who triggered it and what the app advertises. A messaging app reads incoming SMS. A cloud backup app uploads files in the background with no user watching. Both are ordinary. A banking app that silently reads SMS and posts the contents to a remote server is running an OTP interception attack, and the API calls involved look the same in all three cases.

Make the code prove the guess

PRAXIS runs three stages. It pulls permissions and components from the manifest, sensitive API calls and implicit intent actions from bytecode through Soot, and function names from native libraries through Ghidra, then hands the pile to an LLM and asks for attack intents an attacker might pursue with them.

PRAXIS overview (Source: Research paper)

Each intent comes back as a guess with no pointer to code. The second stage casts it as an entry, a source, and an effect, retrieves candidate functions for each role, and keeps only the triples that reach one another in that order through call edges, inter-component transitions, or a shared field. A hypothesis with no reachable chain gets thrown out.

The third stage judges what survived. A behavior reached only through a background broadcast runs without the user knowing. A behavior triggered from a screen gets checked against what that screen says it does.

On a banking trojan impersonating Bank Mellat, that chain runs from an exported SMS_RECEIVED receiver through PDU parsing to an HttpURLConnection write, with a Flutter login form on top and no banking backend underneath.

One stage carries the detection

Run all three stages and PRAXIS misses about one malware sample in nine. Pull out the context stage and it misses 95.3%.

The behaviors are still there. The code evidence is still there. Handed the same material with a plain judgment prompt, the model waves almost everything through. The final prompt carries most of the detection power. Everything upstream feeds it.

What is still open

Summarizing every app-specific function costs about $0.56 per app before the detection model spends anything. That price suits an analyst working a sample. It does not suit a store scanning submissions.

The judgment stage reads UI text, app labels, package names, and decompiled identifiers. An attacker controls all four. A login screen that plausibly explains an SMS permission attacks the context reasoning directly, and no evaluation here covers an adversary who writes one.

Then there is the training data. The learning baselines were retrained on apps from 2021 through 2023 and tested against samples running to 2026. PRAXIS runs on DeepSeek-V4-Pro, GPT-5.2, and GPT-5.4-mini, models whose training corpora plausibly include both those samples and the published Kaspersky and ESET reports the authors used to build their ground truth. The threats-to-validity section covers dataset breadth, annotator subjectivity, and decoding variance. Contamination goes unmentioned.

Thirteen benign apps in every...