10th WorldS4 2026

Authors - Ali Fenjan, Mohammed Almulla, Jalil Md Desa
Abstract - Android malware detection datasets are commonly designed for classification accuracy, while their ability to support explainability, forensic interpretation, and analyst-driven security reasoning remains limited. This paper presents APU-Android, an explainable static–behaviour feature dataset for An-droid malware forensics and security analytics. The dataset contains 4,594 APK records; after duplicate removal, 4,281 cleaned records were used in the strict evaluation. APU-Android represents each APK using nine interpretable features: requested permissions, API calls, file size, encryption usage, obfuscation level, network requests, suspicious keywords, network-risk flag, and Behaviour Score. Unlike opaque high-dimensional representations, each feature is mapped to a security-relevant meaning, allowing model decisions to be interpreted in terms of privilege abuse, API capability, concealment, communication risk, suspicious string evidence, and behavioural risk. The evaluation excluded du-plicated normalized columns, applied group-aware splitting using App_Name, and benchmarked five machine-learning classifiers. Under group-aware evaluation, Extra Trees achieved 98.72% accuracy, 99.38% precision, 98.37% recall, 98.87% F1-score, and 99.84% ROC-AUC using only the nine original explain-able features. Ablation analysis further examined the role of Behaviour Score and Obfuscation Level, while SHAP analysis showed that Network_Requests, API_Calls, and Permissions_Requested were the most influential prediction features. The results demonstrate that APU-Android is not only classification-ready, but also explanation-ready and forensic-ready for Android malware security analytics.