2026 International Conference on Networks Computers and Communications (ICNCCom 2026)

With the fast growing of Android apps, the risk of malware attacks on mobile devices and user data has been increased dramatically. Therefore, the detection of Android mal ware has become an important research area for cybersecurity. Machine learning based malware detection techniques typically suffer from drawbacks such as high dimensional feature space, difficulty in determining the importance of the features, lack of interpretation and instability of the models. To overcome the above limitations, this paper presents an explainability assisted Android malware detection framework using feature stability analysis and Artificial Neural Network (ANN) classification. The framework is based on the Drebin Android malware dataset, which is pre-processed using an information-based feature reduc tion method based on variance in the high-dimensional sparse feature space to remove features with less information. Three machine learning models: Random Forest (RF), Support Vector Machine (SVM) and XGBoost (XGB) are trained separately to obtain feature importance information from various aspects of machine learning. Also embedded is SHAP (SHapley Addi tive exPlanations) analysis, which enhances interpretability and helps understand the role of features related to malware for classification decisions. To find the features with high mean and small variance of the feature importance values from RF, SVM and XGBoost, a joint stability score is calculated. High average importance features with low variance between models are considered to be stable and are chosen to build an optimized feature subset of the top 300 features. Selected stable features are normalized and balanced using random under-sampling to completely mitigate majority class bias. These refined dimensions are then given to an ANN Classifier at the downstream to detect the malware. The experimental results show that the ensemble-based feature stability analysis effectively identifies robust malware signatures, achieving a true final test accuracy of 95.27% while enhancing structural transparency and drastically reducing feature-space complexity.

Android Malware,Android Malware Detection,SHAP,Feature Stability,Machine learning