Explainable android malware detection and malicious code localization using graph attention

Summary

XAIDroid, a framework from the authors, uses graph neural networks and graph attention mechanisms (GAM and GATv2) over API call graphs to localize malicious code in Android malware at class and method levels. The authors report recall of 97.27% and F1-score of 95.30% at class level, and 96.02% recall with 92.68% F1-score at method level, evaluated on synthetic and real-world malware datasets.