An Explainable Machine Learning Framework for Android Malware Detection Using Ensemble Models

Abstract

The problem of Android malware is considered to be a big challenge for mobile cybersecurity because of its continuous evolution and evasion capabilities of the conventional signature-based approaches used in detecting malicious software. In this paper, we propose an effective Android Malware Detection System which combines three state-of-the-art techniques, including ensemble machine learning, XAI, and GUI, in a single system. We use four state-of-the-art ensemble classifiers, namely XGBoost, LightGBM, CatBoost, and Random Forest, for multi-classification of the Android apps into several types. While the conventional methodologies concentrate solely on accuracy, the proposed one highlights interpretability and usability aspects. In order to increase transparency, the proposed approach uses LIME for explaining locally, feature importance for globally interpreting the model, and SHAP value for reliable feature attribution. Moreover, a completely interactive GUI was implemented to provide a full-cycle solution starting from loading and preprocessing data, training models, and predicting and visualizing explainable outputs. Experiments show that the best performance belongs to CatBoost, whose accuracy is 96.58%, while XGBoost and LightGBM perform almost equivalently, demonstrating excellent generalization capabilities among different malware types. In summary, applying XAI guarantees high transparency without degrading detection performance.