Enhancing Android Malware Detection with Retrieval-Augmented Generation

TL;DR

This paper introduces a novel Android malware detection approach that combines static feature analysis with retrieval-augmented language models to generate functional descriptions, enhancing detection accuracy.

Contribution

It presents a new method integrating Retrieval-Augmented Generation with static analysis and transformer models for improved Android malware detection.

Findings

Enhanced detection accuracy over traditional static analysis methods

Effective grounding of LLM outputs using retrieval-augmented techniques

Successful integration of LLM-generated summaries with transformer-based classifiers

Abstract

The widespread use of Android applications has made them a prime target for cyberattacks, significantly increasing the risk of malware that threatens user privacy, security, and device functionality. Effective malware detection is thus critical, with static analysis, dynamic analysis, and Machine Learning being widely used approaches. In this work, we focus on a Machine Learning-based method utilizing static features. We first compiled a dataset of benign and malicious APKs and performed static analysis to extract features such as code structure, permissions, and manifest file content, without executing the apps. Instead of relying solely on raw static features, our system uses an LLM to generate high-level functional descriptions of APKs. To mitigate hallucinations, which are a known vulnerability of LLM, we integrated Retrieval-Augmented Generation (RAG), enabling the LLM to ground its output in relevant context. Using carefully designed prompts, we guide the LLM to produce coherent function summaries, which are then analyzed using a transformer-based model, improving detection accuracy over conventional feature-based methods for malware detection.