Separating Behavioral Effect from Predictive Value in Dynamic Android Malware Detection: An Empirical Decomposition Study
This empirical study demonstrates that while fusing Strace and DroidBox runtime features significantly improves predictive performance in dynamic Android malware detection, behavioral richness and predictive utility remain distinct properties, as execution duration and sequence ordering effects do not consistently translate into better discrimination.