Android Malware Scanners Misclassify Legitimate Apps Amid Detection Failures

Recent research reveals that Android malware scanners are misclassifying legitimate applications as threats while failing to detect actual malware. Six prominent scanners, including Drebin and MalScan, flagged over half of benign apps from a diverse set of 49 Google Play categories. The reliance on static signals instead of behavioral context is leading to increased false positives and missed threats. A specific LLM-based detector, LAMD, performed the worst in this evaluation. This misalignment erodes user trust and highlights the need for improved detection methodologies. The situation raises concerns about the effectiveness of current malware detection strategies in real-world scenarios.

Key Points: • Over half of benign apps flagged as malware by leading Android scanners. • Static signal reliance leads to false positives and missed threats. • LLM-based detector LAMD was the worst performer in the evaluation.