{"id":"https://openalex.org/W7158090142","doi":"https://doi.org/10.48550/arxiv.2604.25264","title":"MARD: A Multi-Agent Framework for Robust Android Malware Detection","display_name":"MARD: A Multi-Agent Framework for Robust Android Malware Detection","publication_year":2026,"publication_date":"2026-04-28","ids":{"openalex":"https://openalex.org/W7158090142","doi":"https://doi.org/10.48550/arxiv.2604.25264"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.25264","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.25264","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.25264","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5134825416","display_name":"Xueying Zeng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zeng, Xueying","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102835789","display_name":"Youquan Xian","orcid":"https://orcid.org/0009-0007-2704-7094"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xian, Youquan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134840229","display_name":"Sihao Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Sihao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134828093","display_name":"Xudong Mou","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mou, Xudong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102014346","display_name":"Yanze Li","orcid":"https://orcid.org/0000-0003-4647-4482"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Yanze","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134849683","display_name":"Lei Cui","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cui, Lei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5134843724","display_name":"Bo Li","orcid":"https://orcid.org/0000-0002-7341-1092"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Bo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9700000286102295,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9700000286102295,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":0.009999999776482582,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.002099999925121665,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/interpretability","display_name":"Interpretability","score":0.8111000061035156},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.4927999973297119},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.48420000076293945},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.44339999556541443},{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.42989999055862427},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.41280001401901245}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8159000277519226},{"id":"https://openalex.org/C2781067378","wikidata":"https://www.wikidata.org/wiki/Q17027399","display_name":"Interpretability","level":2,"score":0.8111000061035156},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5874000191688538},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.4927999973297119},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.48420000076293945},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.44339999556541443},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.42989999055862427},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.41280001401901245},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4032999873161316},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.3260999917984009},{"id":"https://openalex.org/C147497476","wikidata":"https://www.wikidata.org/wiki/Q54872","display_name":"RDF","level":3,"score":0.3100999891757965},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.3089999854564667},{"id":"https://openalex.org/C132010649","wikidata":"https://www.wikidata.org/wiki/Q189222","display_name":"Intuition","level":2,"score":0.2630999982357025},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.257099986076355},{"id":"https://openalex.org/C2129575","wikidata":"https://www.wikidata.org/wiki/Q54837","display_name":"Semantic Web","level":2,"score":0.25099998712539673}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.25264","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.25264","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.25264","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.25264","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.8162091374397278,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"With":[0],"the":[1,57,86,89,110,114,127,143],"rapid":[2],"evolution":[3],"of":[4,29,62,92,146,151,171],"Android":[5,79],"applications,":[6],"traditional":[7,95],"machine":[8],"learning-based":[9],"detection":[10],"models":[11],"suffer":[12],"from":[13],"concept":[14,185],"drift.":[15],"Additionally,":[16],"they":[17],"are":[18],"constrained":[19],"by":[20],"shallow":[21],"features,":[22],"lacking":[23],"deep":[24,58,149],"semantic":[25,38,90],"understanding":[26,91],"and":[27,94,187],"interpretability":[28],"decisions.":[30],"Although":[31],"Large":[32],"Language":[33],"Models":[34],"(LLMs)":[35],"demonstrate":[36,160],"remarkable":[37],"reasoning":[39,60],"capabilities,":[40],"directly":[41],"processing":[42],"massive":[43],"raw":[44],"code":[45],"incurs":[46],"prohibitive":[47],"token":[48],"overhead.":[49],"Moreover,":[50],"this":[51],"approach":[52],"fails":[53],"to":[54,112,156,196],"fully":[55],"unleash":[56],"logical":[59],"potential":[61],"LLMs":[63,93],"within":[64],"complex":[65,154],"contexts.":[66],"To":[67],"address":[68],"these":[69],"limitations,":[70],"we":[71,140],"propose":[72],"MARD,":[73],"a":[74,132,148,152],"multi-agent":[75,122],"framework":[76,83],"for":[77,137],"robust":[78],"malware":[80],"detection.":[81],"This":[82],"effectively":[84],"bridges":[85],"gap":[87],"between":[88],"static":[96],"analysis.":[97],"It":[98,173],"treats":[99],"underlying":[100],"deterministic":[101],"analysis":[102,150],"engines":[103],"as":[104],"on-demand":[105],"execution":[106],"tools,":[107],"while":[108],"utilizing":[109],"LLM":[111],"orchestrate":[113],"entire":[115],"decision-making":[116],"process.":[117],"By":[118],"designing":[119],"an":[120,168],"autonomous":[121],"interaction":[123],"mechanism":[124],"based":[125],"on":[126],"ReAct":[128],"paradigm,":[129],"MARD":[130,166],"constructs":[131],"highly":[133],"interpretable":[134],"evidentiary":[135],"chain":[136],"conviction.":[138],"Furthermore,":[139],"radically":[141],"reduce":[142],"total":[144],"cost":[145],"conducting":[147],"single":[153],"APK":[155],"under":[157],"$0.10.":[158],"Evaluations":[159],"that,":[161],"without":[162],"any":[163],"domain-specific":[164],"fine-tuning,":[165],"achieves":[167],"F1":[169],"score":[170],"93.46%.":[172],"not":[174],"only":[175],"outperforms":[176],"continual":[177],"learning":[178],"baselines":[179],"but":[180],"also":[181],"exhibits":[182],"robustness":[183],"against":[184],"drift":[186],"strong":[188],"cross-domain":[189],"generalization":[190],"capabilities":[191],"in":[192],"evaluations":[193],"spanning":[194],"up":[195],"five":[197],"years.":[198]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-04-30T00:00:00"}