FEAMDA: Fusion-based Explainable Android Malware Detection Agent with LLM Support

<b>FEAMDA: Fusion-based Explainable Android Malware Detection Agent with LLM Support</b> is a unified malware detection framework designed to enhance detection accuracy and interpretability by leveraging multi-modal static features and large language model (LLM)-driven reasoning.Unlike traditional detection systems that treat static code representations independently or rely on opaque deep learning models, <b>FEAMDA</b> introduces a novel <b>cross-modal fusion strategy</b>. It combines:<b>Low-level grayscale images</b> derived from DEX bytecode, which capture structural patterns (e.g., entropy, packing, code density);<b>High-level behavioral features</b> such as API call sequences and permissions, which encode the app's semantic intent.To bridge the semantic gap between these heterogeneous features, <b>FEAMDA</b> employs a <b>feature textualization approach</b>, transforming both modalities into structured natural language prompts. These prompts are processed by an LLM (e.g., DeepSeek or GPT-4o), which performs both classification and explainable reasoning.Empirical results on benchmark datasets (Drebin, AMD) demonstrate that <b>FEAMDA</b> achieves:<b>State-of-the-art detection accuracy</b> (up to 95.4%);<b>High interpretability</b> through natural language explanations (AOR &gt; 4.3);<b>Strong robustness</b> under various obfuscation techniques including symbol renaming, DEX packing, and code encryption.<b>FEAMDA</b> represents a shift from traditional black-box malware detection toward <b>LLM-augmented, semantically transparent</b> analysis agents, offering practical implications for next-generation mobile threat defense.