FusionDroid: A Lightweight Multimodal Android Malware Detection Framework for Mobile Security

The rapid adoption of Android applications in mobile commerce has increased exposure to sophisticated malware capable of bypassing traditional security mechanisms through code obfuscation, dynamic code loading, and runtime-triggered malicious behaviors. Although static analysis offers efficient large-scale detection, it often fails to identify concealed runtime activities, while dynamic analysis provides richer behavioral evidence but suffers from limited execution coverage and high computational overhead. To address these complementary limitations, this paper proposes FusionDroid, a lightweight multimodal Android malware detection framework that integrates permission-based static features, permission co-occurrence graph representations, and engineered runtime behavioral features through probability-level ensemble fusion. The framework was evaluated using Android applications collected from the AndroZoo repository, comprising 24,055 valid applications for static analysis and a balanced paired benchmark of 1716 applications for multimodal evaluation. The experimental results show that complementary static and dynamic representations can improve Android malware detection, although the magnitude and nature of the improvement depend on class distribution and evaluation metric. The best-performing model, StackedFusion-LightGBM, achieved 93.31% accuracy, 96.86% precision, 89.53% recall, a 93.05% F1 score, 97.69% ROC–AUC, and 98.14% PR–AUC. A controlled five-fold evaluation on the common paired benchmark further showed an F1 score of 0.9175±0.0176 for the full Static+Graph+Dynamic configuration compared with 0.8781±0.0081 for the Static-only baseline. Paired statistical analysis further supported the improvement. These findings show that multimodal fusion can improve Android malware detection while preserving low-complexity manifest-derived representations. The results support FusionDroid as a staged, sandbox-assisted framework in which lightweight static analysis is complemented by runtime behavioral evidence when deeper inspection is required.