Moirae: A Multimodal Agent Collaborative Framework for Dynamic Android Malware Detection

2026-08-28

AI Summary

针对安卓恶意软件检测中的概念漂移问题，提出Moirae框架，通过动态收集多模态运行时证据并利用专门代理分析行为视图来解决。

Abstract

The Android ecosystem faces persistent and rapidly evolving malware threats. Existing machine learning detectors are vulnerable to concept drift because they rely on implementation-specific features whose distributions change over time. Large language models (LLMs) offer strong semantic understanding and zero-shot reasoning, but current LLM-based detectors typically depend on code-centric or single-dimensional evidence, making them susceptible to obfuscation and limiting comprehensive behavior analysis. We present {\sysname}, a multimodal agent collaborative framework for dynamic Android malware detection. {\sysname} dynamically collects multimodal runtime evidence and employs ReAct-based specialized agents to analyze complementary behavioral views. The detection process begins by identifying visual deception cues, modeling UI state transitions, and integrating runtime API behaviors to fuse multi-dimensional evidence across user-visible interfaces and hidden backend operations. Experiments on temporally and distributionally unseen datasets show that {\sysname} achieves an accuracy of 90.06\% without fine-tuning, outperforming state-of-the-art baselines and demonstrating strong zero-shot generalization against Android malware concept drift.

Problem

• Android Malware
• Concept Drift
• Machine Learning Detectors
• Large Language Models
• Behavioral Analysis

Innovation

• multimodal agent collaborative framework
• dynamic Android malware detection
• ReAct-based specialized agents
• zero-shot generalization