XAI-Guided Graph-Based Feature Engineering and Heterogeneous Ensemble Learning for Android Malware Detection

Android malware continues to evolve in sophistication, creating a need for accurate, efficient, and interpretable detection mechanisms. This paper proposes a novel Android malware detection framework that integrates graph-based software engineering analysis, explainable artificial intelligence (XAI), and heterogeneous ensemble learning. The framework decompiles Android applications, constructs call graphs and control flow graphs, and extracts structural, functional, and behavioral software engineering metrics that are transformed into statistical feature representations. To improve feature quality and reduce dimensionality, LIME and SHAP are engineered into a threshold-based feature relevance mechanism, reducing the original 89 features to 65 and 61 features, respectively. A new heterogeneous ensemble classifier, RF–LNN–GRU, is then introduced to combine the complementary strengths of random forest, lightweight neural networks, and gated recurrent units through asymmetric probabilistic voting. Experiments conducted on 10,365 Android applications demonstrate that the proposed framework consistently outperforms conventional machine learning and ensemble baselines, achieving a detection rate of 98.98%, an F1-score of 96.2%, and an AUC of 98.1% while maintaining an inference latency below 0.4 ms per sample. These results demonstrate that the proposed combination of graph-derived software engineering metrics, XAI-guided feature engineering, and heterogeneous ensemble learning provides an effective and computationally efficient solution for Android malware detection.