Android Malware Scanners Fail to Detect Threats, Flag Legitimate Apps

Key Takeaways

• Current Android malware scanners frequently misidentify legitimate, high-permission applications as threats while failing to detect sophisticated malware.
• This detection gap stems from an over-reliance on static code analysis rather than dynamic behavioral and contextual evaluation.
• Researchers from Singapore Management University introduced PRAXIS, a new framework that significantly reduces false positives and improves malware detection by analyzing an app’s actual behavior in context.
• PRAXIS demonstrated an F1 score of 87.4% and a privileged-benign false positive rate of 13.0%, substantially outperforming traditional and LLM-based scanners.

Android Malware Scanners Struggle with Evolving Threats and Legitimate Apps

Modern Android malware detection systems are increasingly failing to keep pace with the evolving threat landscape. These scanners often misclassify legitimate applications that require extensive permissions as malicious, while simultaneously overlooking advanced threats designed to mimic benign software. This persistent gap in detection capabilities is largely attributable to the industry’s continued dependence on superficial static indicators rather than a comprehensive understanding of an application’s behavior and execution context.

Traditional Android malware detectors primarily assess applications based on static signals such as requested permissions, calls to sensitive APIs, and call-graph characteristics. However, these indicators offer only an approximation of an app’s true functionality. Legitimate, feature-rich software like backup utilities, parental control applications, or security tools frequently request broad permissions. Such applications are then erroneously flagged simply because their operational profile deviates statistically from the data used to train these detection models.

Conversely, sophisticated malware families are adapting by re-implementing their malicious logic using less monitored APIs or by strategically dropping conspicuous permission requests to blend in with benign applications. This issue is compounded in learning-based detectors when “concept drift” occurs. Models trained on historical malware distributions struggle to generalize effectively as new malware families emerge and evolve their evasion tactics. Even newer tools leveraging Large Language Models (LLMs), which examine sensitive API call chains, often analyze isolated code snippets rather than complete attack lifecycles, thus missing how seemingly innocuous actions can combine to form a genuine exploit.

The Problem: Maliciousness is Contextual

The core challenge lies in the nature of maliciousness itself. It is not an inherent property of raw code signals but rather emerges from actions evaluated within a specific context: what an application does, when it performs these actions, and whether those actions align with user expectations. For example, sending an SMS message is a legitimate function within a messaging application when initiated by a user. However, the same operation becomes malicious if a banking impersonator silently intercepts and forwards one-time passwords (OTPs) to an external server.

Similarly, background file uploads are standard for cloud storage services. Yet, if performed by an application whose advertised purpose does not include file synchronization, such uploads become indicative of spyware. Existing scanning engines rarely account for these crucial operational nuances. They seldom differentiate between user-triggered UI flows and background broadcast receivers, nor do they map code execution back to an app’s publicly advertised functionality. Consequently, legitimate but privileged software is penalized for its capabilities, while multi-stage Android malware, which distributes malicious logic across various services and native libraries, evades detection by slipping under heuristic thresholds.

Introducing PRAXIS: A Behavior-Oriented Solution

To address this critical detection dilemma, researchers from Singapore Management University introduced PRAXIS, a novel behavior-oriented and context-aware analysis framework. This framework aims to significantly reduce false positives while effectively capturing stealthy threats. As detailed in the published PRAXIS study demonstrated significant operational improvements, the framework structures its detection process into a sophisticated three-stage pipeline, moving beyond mere raw signal classification.

The Three-Stage Analysis Pipeline:

1. Hypothesize: This stage extracts diverse static signals, including manifest permissions, components, intent actions, API call sites, and native function names. An LLM then leverages these signals to generate high-level hypotheses about potential attack intents from an adversary’s perspective.
2. Confirm: PRAXIS then searches the application for concrete entry → source → effect execution chains (trigger → data access → impact). This process grounds hypothesized behaviors through rigorous program analysis, discarding any hypotheses that cannot be empirically verified.
3. Judge: Finally, each confirmed behavior is evaluated across two critical contextual axes: user awareness of the trigger and alignment with the app’s advertised functional role. This stage reasons about how individual actions compose into a coherent and verifiable attack.

By assessing behaviors against an app’s visible user interface, PRAXIS can reliably detect deceptive actions. This includes hidden data exfiltration masked by fake login forms or the clandestine operations of banking malware overlays running in the background.

When tested against Android samples collected between 2024 and 2026, PRAXIS demonstrated substantial operational improvements over existing detection models:

For “privileged-benign” applications that legitimately request numerous dangerous permissions, PRAXIS reduced false positives to an impressive 13.0%. This represents a reduction of 41.1 to 67.0 percentage points compared to legacy scanners. Simultaneously, it accurately identified fine-grained malicious behaviors with an F1 score of 87.3%, significantly outperforming previous behavior-level systems by 56.5 to 73.4 percentage points.

This paradigm shift in detection methodology carries significant implications for the future of mobile security architecture:

• For Mobile Defenders: Effective threat detection must evolve from signal-centric classification to behavior-centric, context-aware analysis to maintain resilience against feature drift and advanced evasion techniques.
• For Security Vendors: Automated scanners must cease treating permission lists and isolated API calls as definitive evidence of malicious intent. Instead, the focus should shift to reconstructing complete, code-anchored attack flows.
• For Enterprise Tooling: LLMs achieve optimal accuracy not as opaque black-box classifiers, but as intelligent orchestrators. They should sit atop traditional program analysis to deliver auditable and explainable detection verdicts.

By grounding analysis in verifiable evidence and functional context, frameworks like PRAXIS illustrate how mobile security can accurately differentiate between legitimate high-privilege applications and stealthy, sophisticated malware.

What You Should Do

• For Users: Be cautious about granting excessive permissions to apps, especially those whose advertised functions don’t align with the requested access. Consider using reputable app stores and checking app reviews for suspicious behavior reports.
• For Developers: Design applications with the principle of least privilege, requesting only necessary permissions. Clearly document the purpose of sensitive permissions and functionalities to avoid false positives from advanced scanners.
• For Security Teams: Evaluate mobile security solutions that incorporate behavioral and contextual analysis beyond static signature matching. Prioritize tools that provide explainable detection verdicts rather than opaque classifications.
• For Vendors: Invest in research and development for next-generation mobile threat detection frameworks that analyze real-world application behavior and context, moving beyond superficial static indicators.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.