XRFAS: A Lightweight, Efficient Framework for Android Malware Detection

The escalating threat of Android malware necessitates efficient, high-recall detection systems suitable for resource-constrained environments. We present XRFAS (eXtreme Risk-Feature Adaptive Sampling), a novel framework that enhances XGBoost through mutual information-based risk weighting, principal component analysis, feature interactions, and adaptive sampling. Evaluated on a real-world Android permission dataset, XRFAS achieves exceptional performance—99.12% accuracy, 99.21% recall, and 99.94% ROC AUC— surpassing state-of-the-art baselines (CatBoost, LightGBM, XGBoost, HGB, Drebin, MaMaDroid, Droid-Sec) by 1.32–1.60 points in accuracy and 1.81–2.05 points in recall. With a total runtime of 19.29 seconds, XRFAS delivers near-perfect malware detection and robust class separation. By prioritizing the detection of malware instances critical for security, XRFAS offers a scalable, lightweight solution suitable for real-time edge deployment. This paper presents the methodology, experimental setup, and comparative analysis that establish XRFAS as a cutting-edge advancement in mobile security.