Chain of Command: Context-Aware Android Malware Detection via Permission-to-API Call Chains and Graph Representation Learning

Android malware detection has become increasingly critical as mobile applications continue to proliferate. Traditional detection methods primarily rely on static analysis of permissions and API calls, but often fail to capture the complex behavioral patterns and contextual relationships inherent in malicious applications. To address this limitation, we introduce Chain of Command, a novel framework centered on the Permission-to-API Call Chain (PACC). A PACC represents a complete execution path from an application entry point to a sensitive API invocation, effectively preserving the contextual link between a required permission and its use. Our methodology comprises three stages: first, extracting PACCs through a backward analysis of the application’s call graph; second, performing semantic abstraction to map concrete method signatures to generalized behavioral categories; and third, constructing a compact behavior graph from these abstracted chains, which is then classified using a Graph Attention Network (GAT). Evaluation on a large-scale Android dataset demonstrates that our framework significantly outperforms state-of-the-art methods in both accuracy and robustness. Our findings underscore the efficacy of integrating contextual feature engineering, semantic abstraction, and graph representation learning for developing more reliable and interpretable malware detection systems.