Android Malware Scanners Are Flagging Legitimate Apps and Missing Threats Without Context

Android malware scanners are increasingly misaligning with real-world risk by over-flagging legitimate, high-permission applications while quietly missing sophisticated threats that hide behind ordinary-looking code patterns.

This growing detection gap stems from a heavy industry reliance on surface-level static signals rather than behavior and execution context, producing noisy detections that erode trust among users and security analysts alike.

Traditional Android malware detectors judge applications by static signals such as requested permissions, sensitive API calls, and call-graph features. However, these signals only approximate what an app actually does.

Feature-rich benign software, such as backup managers, parental control systems, or security utilities, routinely request broad permissions and are flagged simply because their feature profile looks statistically “unusual” compared to training data.

Conversely, evolving malware families re-implement logic around unmonitored APIs or drop conspicuous permissions to blend into the benign majority.

Learning-based detectors amplify this problem when concept drift sets in: models trained on historical malware distributions fail to generalize as new families evolve.

Even newer Large Language Model (LLM) tools that slice around sensitive APIs still inspect isolated call chains rather than complete attack lifecycles, missing how seemingly benign actions compose into actual abuse.

Android Malware Scanners Are Flagging Legitimate Apps

The fundamental issue is that maliciousness is not an inherent property of raw signals, but of actions evaluated in context: what an app does, when it acts, and whether those actions align with user expectations.

For instance, an SMS-sending operation is legitimate when triggered by a user inside a messaging application, but malicious when a banking impersonator silently intercepts one-time passwords (OTPs) and forwards them to an external server.

Similarly, background file uploads are standard for cloud storage tools, yet become spyware when performed by an app whose advertised role does not involve file synchronization.

Existing scanning engines rarely account for this operational nuance. They seldom distinguish between user-triggered UI flows and background broadcast receivers, nor do they map code execution back to an app’s advertised functionality.

As a result, privileged-but-legitimate software is penalized for its capabilities, while multi-stage android malware threats that distribute malicious logic across services and native libraries slip under heuristic thresholds.

To solve this detection dilemma, researchers introduced PRAXIS, a behavior-oriented and context-aware analysis framework designed to eliminate false positives while capturing stealthy threats.

As detailed in the published PRAXIS study by Singapore Management University researchers, the framework structures detection into a three-stage pipeline rather than relying on raw signal classification:

The Three-Stage Analysis Pipeline:

1. Hypothesize: Extracts heterogeneous static signals (manifest permissions, components, intent actions, API call sites, and native function names) and uses an LLM to generate high-level attack-intent hypotheses from an adversary’s perspective.
2. Confirm: Searches the application for concrete entry → source → effect execution chains (trigger → data access → impact), grounding behaviors via program analysis and discarding unverified hypotheses.
3. Judge: Evaluates each confirmed behavior across two contextual axes user awareness of the trigger and alignment with the app’s advertised functional role reasoning about how individual actions compose into a coherent attack.

By evaluating behaviors against the app’s visible user interface, PRAXIS reliably detects deceptive actions, such as hidden data exfiltration masked by fake login forms or banking malware overlays operating in the background.

When evaluated against Android samples collected between 2024 and 2026, PRAXIS demonstrated significant operational improvements over existing detection models:

On “privileged-benign” applications requesting numerous dangerous permissions, PRAXIS reduced false positives down to 13.0%, a reduction of 41.1 to 67.0 percentage points relative to legacy scanners.

Simultaneously, it recovered fine-grained malicious behaviors with an F1 score of 87.3%, outperforming prior behavior-level systems by 56.5 to 73.4 percentage points.

This paradigm shift carries key implications for mobile security architecture:

• For Mobile Defenders: Effective detection must transition from signal-centric classification to behavior-centric, context-aware analysis to maintain resilience against feature drift and evasion.
• For Security Vendors: Automated scanners must stop treating permission lists and isolated API calls as definitive proof of malicious intent, focusing instead on reconstructing complete code-anchored attack flows.
• For Enterprise Tooling: LLMs achieve optimal accuracy not as black-box classifiers, but as intelligent orchestrators sitting atop traditional program analysis to deliver auditable, explainable detection verdicts.

By grounding analysis in verifiable evidence and functional context, frameworks like PRAXIS demonstrate how mobile security can accurately separate legitimate high-privilege applications from stealthy malware.