MARD: A Multi-Agent Framework for Robust Android Malware Detection
MARD is a multi-agent framework that leverages Large Language Models to orchestrate on-demand deterministic analysis tools via a ReAct-based interaction mechanism, achieving robust, interpretable, and cost-effective Android malware detection with high accuracy and strong generalization against concept drift without requiring domain-specific fine-tuning.
Original authors:Xueying Zeng, Youquan Xian, Sihao Liu, Xudong Mou, Yanze Li, Lei Cui, Bo Li
Original authors: Xueying Zeng, Youquan Xian, Sihao Liu, Xudong Mou, Yanze Li, Lei Cui, Bo Li
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you are trying to catch a group of master forgers who are constantly changing their disguises to sneak into a secure building.
The Old Way (Traditional AI) For years, security guards (traditional AI models) tried to catch these forgers by looking at their shoes, hats, or the color of their coats (shallow features like specific code commands).
The Problem: The forgers quickly realized this. They started wearing different shoes or hats every day. The guards, trained on old photos, got confused. They either missed the forgers entirely or started arresting innocent people who just happened to be wearing red hats. This is called "concept drift"—the rules of the game keep changing, and the old guards can't keep up.
The New Way (MARD) The researchers behind this paper built a new system called MARD. Instead of hiring a guard who memorizes outfits, they built a detective agency that uses a super-smart AI brain (a Large Language Model) working alongside a team of specialized, high-tech tools.
Here is how MARD works, step-by-step:
1. The Detective Agency Structure
MARD isn't just one robot; it's a team of three specialized agents working together:
Agent 1: The Scout (Macro Screening)
What it does: Before looking at the messy details, the Scout quickly checks the suspect's ID card (the app's manifest). It asks: "Does this person say they are a calculator app, but they are asking for permission to read your text messages?"
The Analogy: If someone claims to be a librarian but is asking for a key to the bank vault, the Scout immediately flags them as suspicious. This filters out 99% of innocent apps instantly, saving time and money.
Agent 2: The Forensic Expert (Micro Investigation)
What it does: For the few suspicious apps flagged by the Scout, this agent doesn't just guess. It uses powerful, deterministic tools (like a microscope and a map) to trace exactly what the code is doing. It follows the "breadcrumbs" of data to see if the app is secretly sending your photos to a hacker.
The Analogy: Instead of asking the suspect, "Are you a spy?", the Forensic Expert actually walks through the building, opens the locked doors, and checks the surveillance logs. It builds an unbreakable chain of evidence.
Agent 3: The Judge (Verdict)
What it does: The Judge takes the Scout's initial suspicion and the Forensic Expert's hard evidence. It combines them to make a final decision: Guilty (Malware) or Not Guilty (Benign).
The Analogy: The Judge doesn't just say "Guilty." It writes a detailed report explaining exactly why, citing the specific evidence found. This makes the decision easy for humans to understand.
2. Why This is a Game-Changer
No More "Out of Date" Training: Traditional AI needs to be retrained every time the forgers change their clothes. MARD doesn't need to be retrained. Because it uses a super-smart AI brain that understands logic and intent (like a human detective), it can spot new types of forgeries it has never seen before. The paper tested this over five years, and MARD stayed sharp while other models got rusty.
The "Token" Problem Solved: Feeding a whole app's code (millions of lines) into a super-smart AI is like trying to read an entire library to find one typo. It costs too much money and takes too long.
MARD's Trick: The Scout first cuts the library down to just a few relevant pages. The Forensic Expert then only reads those specific pages. This keeps the cost incredibly low.
Cheap and Fast: The paper claims that analyzing a complex, suspicious app costs less than $0.10. That's cheaper than a cup of coffee. They achieved this by using a "heterogeneous strategy": using a cheaper, fast AI for the heavy lifting of scanning, and a more expensive, smarter AI only for the final, critical decision.
The Bottom Line
MARD is like upgrading from a security guard who memorizes faces to a detective team that understands human behavior.
It doesn't get confused when bad guys change their disguises.
It doesn't need to be retrained every week.
It provides a clear, logical explanation for why it caught a bad app.
And it does all of this for pennies.
The paper proves that this system works better than the current best methods, even on apps it has never seen before, without needing any special training data.
1. Problem Statement
The paper addresses critical limitations in current Android malware detection systems:
Concept Drift & Model Aging: Traditional Machine Learning (ML) and Deep Learning (DL) models rely on shallow statistical features (e.g., API calls, permissions). As the Android ecosystem and malware evolve, these feature distributions shift, causing models trained on historical data to suffer from severe performance degradation (concept drift).
Lack of Interpretability: Deep learning models often operate as "black boxes," failing to provide code-level evidence or logical reasoning for their decisions.
LLM Limitations: While Large Language Models (LLMs) possess strong semantic reasoning capabilities, directly feeding massive, obfuscated raw code (APKs) into them is infeasible due to context window limits and prohibitive token costs. Furthermore, simply using LLMs as feature extractors fails to leverage their deep logical reasoning potential.
2. Methodology: The MARD Framework
MARD proposes a Multi-Agent Framework that bridges the gap between deterministic static analysis and LLM-based semantic reasoning. It operates without domain-specific fine-tuning (zero-shot). The architecture consists of three distinct tiers and a heterogeneous model strategy:
A. Deterministic Static Representation (Data Foundation)
Before LLM interaction, the system uses traditional tools (Apktool, Soot, FlowDroid) to perform dimensionality reduction:
Reverse Engineering: Extracts AndroidManifest.xml and converts Dalvik bytecode into Jimple Intermediate Representation (IR), a strongly typed, human-readable format.
Graph Construction: Builds a global Call Graph (CG) and an API inverted index to map suspicious signatures to specific code locations.
Noise Reduction: Filters out third-party library calls, focusing only on system APIs.
B. Multi-Agent Interaction Mechanism (ReAct Paradigm)
The framework employs three autonomous agents that collaborate to execute a "Macro-to-Micro" analysis:
Role: Acts as the forensic hub, dynamically invoking underlying static analysis tools as "tools" via the ReAct (Reason + Act) loop.
Actions:
Trigger Path Search: Traces backward from suspicious APIs to entry points (e.g., user click vs. background boot).
Data-Flow Analysis: Uses FlowDroid for forward taint analysis to track data from sources (APIs) to sinks (network/storage).
Program Slicing: Extracts minimal, relevant code snippets (evidence vectors) while eliminating dead code.
Outcome: Generates a structured, topologically constrained evidence vector containing definitive control-flow and data-flow logic.
Tier 3: Verdict Agent (Global Adjudication)
Role: Synthesizes macro-level warnings and micro-level forensic evidence.
Action: Performs high-order logical deduction to map isolated behaviors to specific malware families.
Outcome: Outputs a final classification (Benign/Malicious), threat category, confidence score, and a human-readable evidentiary chain.
C. Heterogeneous Model Strategy
To optimize costs, MARD uses different LLMs for different tasks:
Tier 1 & 2: Utilizes cost-effective, code-specialized models (e.g., Qwen3-Coder) for heavy token consumption tasks like code parsing and slicing.
Tier 3: Utilizes powerful reasoning models (e.g., Gemini-3-Pro, GPT-5) for final adjudication, as they only process highly condensed evidence vectors.
3. Key Contributions
Novel Architecture: First framework to deeply integrate LLMs with deterministic static analysis engines (Soot/FlowDroid) in a multi-agent workflow, enabling zero-shot detection without retraining.
ReAct-Based Forensics: Introduces an autonomous agent mechanism that dynamically plans and executes deep program slicing and taint analysis, creating an interpretable evidentiary chain.
Cost Efficiency: Radically reduces the cost of deep APK analysis to under $0.10 per app by using dimensionality reduction and heterogeneous model routing.
Robustness: Demonstrates immunity to concept drift and strong cross-domain generalization without domain-specific fine-tuning.
4. Experimental Results
The framework was evaluated on datasets spanning 2011–2021 (AndroZoo, CICMalDroid 2020, CIC-AndMal2017) against state-of-the-art baselines (MaMaDroid, DroidEvolver, CL-Malware).
Performance: MARD achieved an F1-score of 93.46% on CICMalDroid 2020 and 87.01% on AndroZoo, outperforming all baselines.
Temporal Generalization: In a 5-year longitudinal test (2017–2021), traditional models suffered catastrophic performance drops (e.g., DroidEvolver's recall fell to 8% by 2021). MARD maintained a stable F1-score above 84% throughout the period, proving resilience against concept drift.
Cross-Domain Generalization: When tested on unseen datasets (CIC-AndMal2017) without retraining, MARD maintained 91.14% accuracy, whereas data-driven baselines dropped significantly (e.g., CL-Malware dropped to 74.45%).
Ablation Study: Removing the micro-level forensics module caused precision to drop by over 10%, confirming the necessity of deterministic tool-based evidence.
Cost Analysis: The total cost per APK was 0.0675–0.0825 (input) + 0.004–0.011 (output), totaling < $0.10.
5. Significance
MARD represents a paradigm shift in malware detection:
From Statistical Fitting to Logical Reasoning: It moves away from fitting statistical patterns (which age quickly) to reasoning about code intent and logic (which remains invariant).
Interpretability: It solves the "black box" problem by generating a verifiable chain of evidence (control-flow and data-flow) for every decision, crucial for security analysts.
Scalability: By proving that deep semantic analysis can be performed for under $0.10, MARD makes advanced, LLM-driven security analysis economically viable for industrial-scale deployment.
Future-Proofing: Its zero-shot nature means it can detect novel, zero-day malware families immediately upon release without waiting for model retraining.