10th WorldS4 2026

Authors - Bharg Trivedi, Chaitaili Chandankhede
Abstract - There is a continuous change in Android malware because it is obfuscated, polymorphic, and structural. Such changing methods diminish the performance of conventional signature-based detection methods. In an effort to defeat this challenge, the present paper provides a model that uses CNN and GNN models. It is an integration of spatial byteplot representations and structural call graph representations to successfully identify Android malware. Our study was based on a dataset of 1,159 real Android applications, and the used extraction technique was based on the static features. The CNN element of the structure Recognized robust spatial attributes of the grayscale images of the byteplot data with a ResNet-50 network. Meanwhile, the GNN component of the structure used a GraphSAGE network to derive structural representations of automatically generated function call graphs. The fused representations are combined into a 2304 dimensional feature vector. It is also optimized by making use of different methods such as Mutual Information. In this study, an Extreme Gradient Boosting Classifier on the fused representations to achieve successful Android malware detection. The assessment indicates that the framework attains a classification accuracy of more than 99% with businesses across the cross-validation holding the same accuracy.