A Database-Driven Explainable AI Framework for Android Malware Detection Using a Comparative SHAP-Based Machine Learning Analysis

Abstract

As sophisticated Android malware continues to proliferate, detection frameworks must achieve high predictive accuracy, decision transparency, and computational efficiency. While complex ML models may provide a high classification performance, they are not always easily interpretable which can be a constraint to operational trust in security-critical mobile environments. In this work, we present an explainable static malware triage framework, which is evaluated on Drebin-215 malware benchmark dataset. In this study, five model families were tested: Logistic Regression (LR), Random Forest (RF), XGBoost, LightGBM, and a Multi-Layer Perceptron (MLP) Neural Network, all of which were tested with leakage-free 5-fold Stratified Cross-Validation. Empirical results indicate that the MLP Neural Network achieved the highest mean Recall (0.9827 ± 0.0056) and F1-Score (0.9847 ± 0.0026); however, XGBoost was able to execute more than 11× faster during the 5-fold cross validation evaluation (3.34 s vs 38.29 s), while also having a fast single sample inference latency (0.7647 ms) and small serialized model footprint (0.21 MB), which indicates competitive predictive performance. TreeExplainer was used with pooled Out-of-Fold (OOF) cross-validation predictions (N = 15,036) to obtain global and local SHAP explanations to enhance model transparency. The pooled FN subset (N_OOF-FN = 112) indicated no presence of SEND_SMS across all these samples and the feature patterns for SEND_SMS and READ_PHONE_STATE indicated a negative mean SHAP contribution, which is more likely to push the XGBoost output towards the benign class. In general, the model encompasses comparative predictive assessment, OOF explainability, and computational efficiency analysis in a mobile malware triage environment supported by a database.