# Research: Android ML Malware Detectors Collapse Without Context-Stage Analysis (PRAXIS vs. Drebin, MalScan, MsDroid, MaskDroid, LAMD, ForeDroid)

> Researchers from Singapore Management University and Nankai University show that six widely used Android malware detectors — Drebin, MalScan, MsDroid, MaskDroid, LAMD, and ForeDroid — misclassify high-permission benign apps at over 50% (80% for the LLM-based LAMD) once context-aware judgment is removed, on a 270-app privileged-benign test set. Their proposed three-stage detector, PRAXIS (Hypothesize → Confirm → Judge), cuts the false-positive rate to 13.0% by adding an LLM-driven context stage that separates legitimate broad-permission behavior from malicious intent, illustrated with a Bank Mellat-impersonating banking-trojan case study.

- **Published:** 2026-07-29T00:00:00Z
- **Last reviewed:** 2026-07-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1753
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-praxis-context-stage-android-detector-tl-2026-1753.webp?v=7efc1199 (Threadlinqs threat intel: PRAXIS Cuts Android False Alarms: Analysis & Hunting (TL-2026-1753) — Low severity, 26 IOCs, 9 detection rules.)
- **ID:** TL-2026-1753
- **Severity:** LOW
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 26

## Description

A July 2026 paper, "From Signals to Behaviors: Evidence-Based Android Malware Detection" (Shiwen Song, Yiheng Xiong, Sen Chen, Xiaofei Xie; Singapore Management University and Nankai University; arXiv:2607.23272), argues that Android malware detection should be behavior-oriented rather than signal-oriented: recover an app's candidate malicious behaviors, confirm them with code evidence, and only then judge intent using app context. The authors benchmark their proposed three-stage detector, PRAXIS, against six/seven baselines representing the dominant paradigms in academic Android malware detection: Drebin (extracts static manifest/code features into a binary feature vector and trains an SVM classifier, NDSS 2014), MalScan (constructs function call graphs and represents each APK using centrality-based features of sensitive APIs, trains a k-nearest-neighbor classifier, ASE 2019), MsDroid (extracts sensitive-API call-subgraphs and trains a graph-neural-network classifier), MaskDroid (improves GNN robustness through masked graph representation learning plus contrastive learning, ASE 2024), LAMD (LLM-based detector that summarizes backward slices taken around sensitive APIs, IEEE S&P Workshops 2025), and ForeDroid (flags sensitive-API call chains that deviate from a benign reference distribution using a one-class SVM/OCSVM, ACM CCS 2025).

The central finding directly relevant to SOC detection-engineering confidence: on a purpose-built 270-app 'privileged-benign' test set (benign apps spanning 49 Google Play categories, each declaring at least nine dangerous permissions), most baseline detectors flag over half of these legitimate high-permission apps as malicious (Drebin 65.2% FPR, MsDroid 75.2% FPR), and the LLM-based LAMD detector alone misflags roughly 80% of them. An ablation of PRAXIS's own context-judgment stage reproduces this collapse directly: with the context/Judge stage removed, PRAXIS's malware-recall failure rate (false-negative rate) explodes from 11.7% to 95.3% on time-shifted evaluation data, because behavioral evidence alone — without an app-context judgment step — cannot separate a legitimately broad-permission app (or a genuinely malicious behavior hidden among benign-looking code) from an actual attack. Restoring the context stage as PRAXIS's third pipeline phase drives the full-pipeline privileged-benign false-positive rate down to 13.0% and lifts overall detection F1 to 87.4% (best of all baselines: Drebin 68.8%, MaskDroid 63.8%, MalScan 55.7%, LAMD 55.0%, ForeDroid 53.5%, MsDroid 52.6%), outperforming the prior baselines by 18.6-34.8 percentage points on the paper's fine-grained benchmarks. On the balanced time-shift set specifically, PRAXIS reaches 92.2% F1 (FNR 11.7%, FPR 3.3%) versus Drebin's 82.6% F1 (FNR 27.3%, FPR 3.3%) and MaskDroid's 74.1% F1 (FNR 31.3%, FPR 16.7%); on the diverse-family malware-only set, PRAXIS's FNR (20.9%) beats MaskDroid (22.7%) and LAMD (26.9%); on fine-grained behavior identification, PRAXIS scores 87.3% F1 versus ProMal's 30.8% and ForeDroid's 13.9%.

PRAXIS's pipeline has three explicit stages: (1) Hypothesize — extract manifest permissions/components, sensitive API calls and implicit intents via the Soot static-analysis framework, and native-library function names via Ghidra, then prompt an LLM (DeepSeek-V4-Pro for reasoning, DeepSeek-V4-Flash for corpus summarization) to generate candidate malicious-behavior hypotheses; (2) Confirm — casts each hypothesis as an entry, a source, and an effect, retrieves candidate functions for each role, and keeps only the triples whose entry/source/effect chains actually reach one another across call chains, inter-component transitions, and shared fields (grounding the hypothesis in code evidence rather than surface signal); (3) Judge — contextualizes confirmed behaviors using triggering conditions (background vs. user-initiated execution) and overall app purpose/UI-text alignment to decide whether behavior is malicious or legitimate. Evaluation used a training corpus of 30,000 apps (10,000/year, 2021-2023) and a validation corpus of 7,500 apps (2,500/year, 2021-2023), sourced from AndroZoo/MalwareBazaar/GPMalware, plus three held-out test sets totaling 1,033 apps: a time-shift set (100 malware + 100 benign per year, 2024-2026, for concept-drift testing), a diverse-family set (163 malware samples spanning 163 distinct families, 2015-2026), and the 270-app privileged-benign set. GPMalware's malware corpus is organized into 8 payload categories that the paper further decomposes into 50 fine-grained behavior types (not individually enumerated in the available source material) used to score behavior-identification F1.

The paper's sole detailed malware case study is a banking trojan that impersonates Iran's Bank Mellat: the app labels itself 'Hamrah Bank' ('Mobile Bank' in Persian) and renders a Flutter-based fake login screen (card number, password, password-recovery flow) with no real Bank Mellat backend connection or transaction logic. Its manifest declares exactly three permissions — RECEIVE_SMS, READ_SMS, INTERNET — and registers an exported broadcast receiver (component `io.flutter.plugins.Receiver`) on `android.provider.Telephony.SMS_RECEIVED` with intent-filter priority 999 to intercept incoming SMS (e.g., banking OTPs/2FA codes) ahead of the user's default SMS app. It parses the intercepted PDU data via `SmsMessage.createFromPdu`, extracts the message body and sender via `getMessageBody`/`getOriginatingAddress`, additionally fingerprints the device by reading the Android ID through `Settings$Secure.getString`, and bundles this data into a payload exfiltrated through a Kotlin coroutine/lambda terminating in an `HttpURLConnection` write to a remote endpoint. The SMS-interception logic runs as a long-running background service without user awareness (silent collection), and the paper references app-uninstallation behavior driven through the Android Intent mechanism with action `ACTION_DELETE`, consistent with an indicator-removal / self-uninstall step in the same entry-source-effect behavior model. On evasion, the paper notes generically (without evaluating an adversarial attack against PRAXIS itself) that "a malicious app can drop conspicuous permissions, obfuscate its APIs, and mimic a benign one ... but it cannot drop the harmful behavior itself" — the design rationale for behavior-oriented rather than signal-oriented detection. No CVE, malware-family name, sample hash, or C2 domain/IP is disclosed in the available source material — this is illustrative research/methodology reporting, not an active-campaign advisory, and no exploit or PoC is being distributed.

Relevance to detection engineering: this paper is a direct, evidence-based warning against trusting single-signal (manifest/permission/call-graph/LLM) Android malware verdicts for automated blocking, especially against high-permission legitimate apps (banking, MDM, accessibility, communication apps commonly carry 9+ dangerous permissions). Threat hunters and mobile app-vetting pipelines relying on Drebin-, MalScan-, MsDroid-, MaskDroid-, LAMD-, or ForeDroid-style tooling should expect elevated false-positive rates on high-permission benign software unless a context-aware judgment stage (human or automated) is added, and should treat this benchmark as a tuning reference for detection-confidence thresholds. The Bank Mellat case study's concrete API-level behaviors (exported SMS_RECEIVED receiver at priority 999, PDU parsing, Android ID fingerprinting, HttpURLConnection exfiltration, ACTION_DELETE self-removal) are directly usable as hunting signatures for SOC teams building or tuning Android malware/behavioral-analysis detections.

## MITRE ATT&CK

- T1660 Phishing
- T1476 Deliver Malicious App via Other Means
- T1444 Masquerade as Legitimate Application
- T1575 Native API
- T1406 Obfuscated Files or Information
- T1630 Indicator Removal on Host
- T1624 Event Triggered Execution
- T1541 Foreground Persistence
- T1417 Input Capture
- T1636.004 SMS Messages
- T1426 System Information Discovery
- T1636 Protected User Data
- T1533 Data from Local System
- T1437 Application Layer Protocol
- T1646 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SMS PDU Parse Chained with Android-ID Fingerprint Read (SPL)** (`TL-2026-1753-SPL-002`)

Detects an Android app invoking SMS PDU-parsing APIs (SmsMessage.createFromPdu / getMessageBody / getOriginatingAddress) within 30 seconds of reading the device's Android ID via Settings$Secure.getString. This fused capture-then-fingerprint sequence matches the PRAXIS Bank Mellat case study's post-exploitation behavior — the app captures the OTP/SMS content and a device identifier back-to-back before bundling them for exfiltration, alongside a fake 'Hamrah Bank' login screen harvesting card/password input.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1412, T1417, T1426, T1636, T1533
- **Data sources:** Mobile Threat Defense (MTD) runtime API-invocation telemetry (Zimperium zIPS, Lookout MES), Android application sandbox/EDR behavioral logs forwarded to SIEM, Mobile app reputation/allowlist lookup (known_banking_app)
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=mobile_threat_defense sourcetype="mtd:runtime_behavior_events"
| search api_call IN ("SmsMessage.createFromPdu", "SmsMessage.getMessageBody", "SmsMessage.getOriginatingAddress")
| rename _time as sms_time
| join type=inner device_id, app_package [
    search index=mobile_threat_defense sourcetype="mtd:runtime_behavior_events" api_call="Settings$Secure.getString" setting_key="android_id"
    | rename _time as fp_time
    | fields device_id app_package fp_time
  ]
| where fp_time>=sms_time AND (fp_time-sms_time)<=30
| lookup mobile_app_reputation app_package OUTPUT known_banking_app
| where isnull(known_banking_app) OR known_banking_app=0
| table sms_time, fp_time, device_id, app_package, api_call, sms_body_preview
| sort -sms_time
```

### Microsoft KQL

```kql
let SmsApiCalls = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "AndroidApiInvocation"
| extend ApiCall = tostring(parse_json(AdditionalFields).apiCall)
| where ApiCall in ("SmsMessage.createFromPdu", "SmsMessage.getMessageBody", "SmsMessage.getOriginatingAddress")
| project DeviceId, FileName, SmsTime = Timestamp;
let FingerprintCalls = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "AndroidApiInvocation"
| extend ApiCall = tostring(parse_json(AdditionalFields).apiCall), SettingKey = tostring(parse_json(AdditionalFields).settingKey)
| where ApiCall == "Settings$Secure.getString" and SettingKey == "android_id"
| project DeviceId, FileName, FpTime = Timestamp;
SmsApiCalls
| join kind=inner (FingerprintCalls) on DeviceId, FileName
| where FpTime >= SmsTime and datetime_diff('second', FpTime, SmsTime) <= 30
| join kind=inner (DeviceInfo | where DeviceType == "Android") on DeviceId
| project DeviceId, DeviceName, FileName, SmsTime, FpTime
```

### Sigma

```yaml
title: Android App Chains SMS PDU Parsing with Android-ID Fingerprint Collection
id: 8f1a1c02-9b7e-4f2a-8f1c-tl17530a02
status: experimental
description: Detects an Android app invoking SMS PDU-parsing APIs (SmsMessage.createFromPdu / getMessageBody / getOriginatingAddress) within 30 seconds of reading the device Android ID via Settings$Secure.getString, matching the PRAXIS Bank Mellat case study's fused SMS-capture-plus-device-fingerprint behavior used to build an exfiltration payload.
references:
    - https://arxiv.org/abs/2607.23272
author: Threadlinqs Team
date: 2026/07/29
tags:
    - attack.credential-access
    - attack.t1412
    - attack.t1417
    - attack.discovery
    - attack.t1426
    - attack.collection
    - attack.t1636
    - attack.t1533
logsource:
    category: application
    product: android
    service: mtd_telemetry
detection:
    selection_sms_parse:
        ApiCall:
            - 'SmsMessage.createFromPdu'
            - 'SmsMessage.getMessageBody'
            - 'SmsMessage.getOriginatingAddress'
    selection_fingerprint:
        ApiCall: 'Settings$Secure.getString'
        SettingKey: 'android_id'
    timeframe: 30s
    condition: selection_sms_parse and selection_fingerprint
falsepositives:
    - Legitimate banking/2FA autofill apps or carrier SMS-verification SDKs that read the Android ID for device-binding fraud checks in the same session as SMS OTP autofill
level: high
```

**Known false positives:**

- Legitimate banking or 2FA-autofill apps that intentionally read SMS OTP content and the device Android ID in the same session for device-binding fraud prevention — tune with the mobile_app_reputation / known_banking_app lookup

**Tuning notes:** Populate the mobile_app_reputation lookup (known_banking_app) with vetted, store-verified banking/2FA app package names to suppress expected fused SMS+fingerprint behavior; widen or narrow the 30-second correlation window based on observed benign-app API call spacing in the environment.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Android App Install — Minimal SMS/Internet Permissions with Priority-999 SMS Receiver (KQL) (locked: unlock with TL Creds)
- SMS PDU Parse Chained with Android-ID Fingerprint Read (KQL) (locked: unlock with TL Creds)
- SMS/Device-ID Exfil POST Followed by ACTION_DELETE Self-Uninstall (KQL) (locked: unlock with TL Creds)
- Android App Install — Minimal SMS/Internet Permissions with Priority-999 SMS Receiver (Sigma) (locked: unlock with TL Creds)
- SMS PDU Parse Chained with Android-ID Fingerprint Read (Sigma) (locked: unlock with TL Creds)
- SMS/Device-ID Exfil POST Followed by ACTION_DELETE Self-Uninstall (Sigma) (locked: unlock with TL Creds)
- Android App Install — Minimal SMS/Internet Permissions with Priority-999 SMS Receiver (SPL) (locked: unlock with TL Creds)
- SMS/Device-ID Exfil POST Followed by ACTION_DELETE Self-Uninstall (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Android malware detection collapses when the context stage comes out](https://www.helpnetsecurity.com/2026/07/29/android-malware-detection-research/)
- [From Signals to Behaviors: Evidence-Based Android Malware Detection (PRAXIS)](https://arxiv.org/abs/2607.23272)
- [From Signals to Behaviors: Evidence-Based Android Malware Detection (PDF)](https://arxiv.org/pdf/2607.23272)
- [From Signals to Behaviors: Evidence-Based Android Malware Detection (HTML)](https://arxiv.org/html/2607.23272)
- [LAMD: Context-driven Android Malware Detection and Classification with LLMs](https://arxiv.org/abs/2502.13055)
- [MASKDROID: Robust Android Malware Detection with Masked Graph Representations](https://arxiv.org/abs/2409.19594)
- [ForeDroid: Scenario-Aware Analysis for Android Malware Detection and Explanation (ACM CCS 2025)](https://dl.acm.org/doi/10.1145/3719027.3765207)
- [MalScan: Fast Market-Wide Mobile Malware Scanning by Social-Network Centrality Analysis (ASE 2019)](https://wu-yueming.github.io/Files/ASE2019_MalScan.pdf)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1753