{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T17:58:38Z","timestamp":1781287118388,"version":"3.54.1"},"reference-count":49,"publisher":"Public Library of Science (PLoS)","issue":"6","license":[{"start":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T00:00:00Z","timestamp":1781222400000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"PhD Scholarship Programme of Vingroup Innovation Foundation (VINIF), VinUniversity","award":["VINIF.2025.TS66"],"award-info":[{"award-number":["VINIF.2025.TS66"]}]},{"name":"PhD Scholarship Programme of Vingroup Innovation Foundation (VINIF), VinUniversity","award":["VINIF.2025.TS66"],"award-info":[{"award-number":["VINIF.2025.TS66"]}]}],"content-domain":{"domain":["www.plosone.org"],"crossmark-restriction":false},"short-container-title":["PLoS One"],"abstract":"<jats:p>\n                    Android malware detection remains a critical challenge due to the rapid increase in malware variants and the growing sophistication of obfuscation techniques. To address these issues, this paper introduces HybFusion, a holistic Android malware detection framework that integrates advanced feature fusion with ensemble learning to enhance detection effectiveness and reduce false positives. HybFusion combines two complementary feature types to overcome the limitations of existing methods in capturing a comprehensive representation of malware behaviors and semantics: (1) behavioral features extracted from the function call graph and embedded using the Graph Isomorphism Network, and (2) semantic permission features obtained from the\n                    <jats:italic>AndroidManifest.xml<\/jats:italic>\n                    file by applying a normalization process to convert permission identifiers into a permission sequence, which is then embedded using a lightweight pre-trained Transformer-based language model. This strategy enables better leveraging of semantic relationships among permissions while maintaining low computational cost. In addition, HybFusion adopts a stacking-based ensemble learning strategy that leverages the strengths of multiple classifiers to further improve detection robustness. Extensive experimental results demonstrate that HybFusion outperforms existing approaches across all evaluation metrics, achieving a recall of 99.24% and an F1-score of 99.27%.\n                  <\/jats:p>","DOI":"10.1371\/journal.pone.0349589","type":"journal-article","created":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T17:30:32Z","timestamp":1781285432000},"page":"e0349589","update-policy":"https:\/\/doi.org\/10.1371\/journal.pone.corrections_policy","source":"Crossref","is-referenced-by-count":0,"title":["HybFusion: A holistic Android malware detection framework with advanced feature fusion and ensemble learning"],"prefix":"10.1371","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-2256-3396","authenticated-orcid":true,"given":"Vu","family":"Minh Manh","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Cho","family":"Do Xuan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nguyen Thi Khanh","family":"Van","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"340","published-online":{"date-parts":[[2026,6,12]]},"reference":[{"key":"pone.0349589.ref001","unstructured":"Mobile Operating System Market Share Worldwide. https:\/\/gs.statcounter.com\/os-market-share\/mobile\/worldwide Accessed 2025 June 22."},{"key":"pone.0349589.ref002","unstructured":"The mobile threat landscape in 2024. https:\/\/securelist.com\/mobile-threat-report-2024\/115494\/ Accessed 2025 June 22."},{"key":"pone.0349589.ref003","unstructured":"Gen Q3\/2024 Threat Report. https:\/\/www.gendigital.com\/blog\/insights\/reports\/threat-report-q3-2024 Accessed 2025 June 22."},{"key":"pone.0349589.ref004","first-page":"163","article-title":"Droid Analytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware.","author":"M Zheng","year":"2013","journal-title":"2013 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications"},{"key":"pone.0349589.ref005","first-page":"152","article-title":"AndroSimilar: robust statistical feature signature for Android malware detection.","author":"P Faruki","year":"2013","journal-title":"Proceedings of the 6th International Conference on Security of Information and Networks, Aksaray Turkey"},{"key":"pone.0349589.ref006","doi-asserted-by":"crossref","first-page":"301","DOI":"10.1016\/j.neucom.2020.10.054","article-title":"Learning features from enhanced function call graphs for Android malware detection","volume":"423","author":"M Cai","year":"2021","journal-title":"Neurocomputing"},{"key":"pone.0349589.ref007","doi-asserted-by":"crossref","first-page":"102513","DOI":"10.1016\/j.cose.2021.102513","article-title":"S3Feature: A static sensitive subgraph-based feature for android malware detection","volume":"112","author":"F Ou","year":"2022","journal-title":"Computers & Security"},{"issue":"5","key":"pone.0349589.ref008","doi-asserted-by":"crossref","first-page":"1115","DOI":"10.1007\/s10207-023-00679-x","article-title":"SFCGDroid: android malware detection based on sensitive function call graph","volume":"22","author":"S Shi","year":"2023","journal-title":"Int J Inf Secur"},{"key":"pone.0349589.ref009","doi-asserted-by":"crossref","first-page":"121125","DOI":"10.1016\/j.eswa.2023.121125","article-title":"SeGDroid: An Android malware detection method based on sensitive function call graph learning","volume":"235","author":"Z Liu","year":"2024","journal-title":"Expert Systems with Applications"},{"issue":"3","key":"pone.0349589.ref010","doi-asserted-by":"crossref","first-page":"4371","DOI":"10.32604\/cmc.2024.058168","article-title":"A Novel Approach for Android Malware Detection Based on Intelligent Computing","volume":"81","author":"MV Minh","year":"2024","journal-title":"CMC"},{"key":"pone.0349589.ref011","doi-asserted-by":"crossref","first-page":"103807","DOI":"10.1016\/j.cose.2024.103807","article-title":"GSEDroid: GNN-based Android malware detection framework using lightweight semantic embedding","volume":"140","author":"J Gu","year":"2024","journal-title":"Computers & Security"},{"issue":"7","key":"pone.0349589.ref012","doi-asserted-by":"crossref","first-page":"3216","DOI":"10.1109\/TII.2017.2789219","article-title":"Significant permission identification for machine-learning-based android malware detection","volume":"14","author":"J Li","year":"2018","journal-title":"IEEE Trans Ind Inf"},{"key":"pone.0349589.ref013","first-page":"86","article-title":"DroidAPIMiner: Mining API-Level Features for Robust Malware Detection in Android.","author":"Y Aafer","year":"2013","journal-title":"Security and Privacy in Communication Networks. Cham: Springer International Publishing"},{"key":"pone.0349589.ref014","first-page":"81","article-title":"DexRay: A Simple, yet Effective Deep Learning Approach to Android Malware Detection Based on Image Representation of Bytecode","author":"N Daoudi","year":"2021","journal-title":"Communications in Computer and Information Science. Springer International Publishing"},{"issue":"3","key":"pone.0349589.ref015","doi-asserted-by":"crossref","first-page":"183","DOI":"10.1108\/IJWIS-03-2024-0095","article-title":"A static method for detecting android malware based on directed API call","volume":"21","author":"M Vu Minh","year":"2025","journal-title":"IJWIS"},{"issue":"4","key":"pone.0349589.ref016","doi-asserted-by":"crossref","first-page":"3979","DOI":"10.1007\/s11042-017-5104-0","article-title":"Android malware detection based on system call sequences and LSTM","volume":"78","author":"X Xiao","year":"2019","journal-title":"Multimed Tools Appl"},{"key":"pone.0349589.ref017","doi-asserted-by":"crossref","first-page":"162","DOI":"10.1109\/ISEA-ISAP49340.2020.235015","article-title":"Graph Convolutional Networks for Android Malware Detection with System Call Graphs.","author":"TS John","year":"2020","journal-title":"2020 Third ISEA Conference on Security and Privacy (ISEA-ISAP), Guwahati, India"},{"key":"pone.0349589.ref018","doi-asserted-by":"crossref","first-page":"15","DOI":"10.1016\/j.jnca.2018.12.014","article-title":"A mobile malware detection method using behavior features in network traffic","volume":"133","author":"S Wang","year":"2019","journal-title":"Journal of Network and Computer Applications"},{"key":"pone.0349589.ref019","doi-asserted-by":"crossref","first-page":"102483","DOI":"10.1016\/j.jisa.2020.102483","article-title":"A TAN based hybrid model for android malware detection","volume":"54","author":"R Surendran","year":"2020","journal-title":"Journal of Information Security and Applications"},{"key":"pone.0349589.ref020","first-page":"377","article-title":"StormDroid: A Streaminglized Machine Learning-Based System for Detecting Android Malware.","author":"S Chen","year":"2016","journal-title":"Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security, Xi\u2019an China"},{"key":"pone.0349589.ref021","doi-asserted-by":"crossref","first-page":"102696","DOI":"10.1016\/j.jisa.2020.102696","article-title":"NATICUSdroid: A malware detection framework for Android using native and custom permissions","volume":"58","author":"A Mathur","year":"2021","journal-title":"Journal of Information Security and Applications"},{"key":"pone.0349589.ref022","doi-asserted-by":"crossref","first-page":"107138","DOI":"10.1016\/j.comnet.2020.107138","article-title":"IMCFN: Image-based malware classification using fine-tuned convolutional neural network architecture","volume":"171","author":"D Vasan","year":"2020","journal-title":"Computer Networks"},{"key":"pone.0349589.ref023","doi-asserted-by":"crossref","first-page":"121","DOI":"10.1016\/j.cose.2016.11.007","article-title":"AndroDialysis: Analysis of Android Intent Effectiveness in Malware Detection","volume":"65","author":"A Feizollah","year":"2017","journal-title":"Computers & Security"},{"key":"pone.0349589.ref024","first-page":"139","article-title":"MalScan: Fast Market-Wide Mobile Malware Scanning by Social-Network Centrality Analysis.","author":"Y Wu","year":"2019","journal-title":"2019 34th IEEE\/ACM International Conference on Automated Software Engineering (ASE)"},{"key":"pone.0349589.ref025","first-page":"279","article-title":"Android malware detection using function call graph with graph convolutional networks.","author":"V V K","year":"2021","journal-title":"2021 2nd International Conference on Secure Cyber Computing and Communications (ICSCCC), Jalandhar, India"},{"key":"pone.0349589.ref026","doi-asserted-by":"crossref","first-page":"9216","DOI":"10.1109\/TIFS.2024.3468891","article-title":"Sensitive Behavioral Chain-Focused Android Malware Detection Fused With AST Semantics","volume":"19","author":"J Gong","year":"2024","journal-title":"IEEE TransInformForensic Secur"},{"issue":"7","key":"pone.0349589.ref027","doi-asserted-by":"crossref","first-page":"4903","DOI":"10.1007\/s00521-021-05875-1","article-title":"A novel permission-based Android malware detection system using feature selection based on linear regression","volume":"35","author":"D\u00d6 \u015eahin","year":"2021","journal-title":"Neural Comput & Applic"},{"issue":"02","key":"pone.0349589.ref028","doi-asserted-by":"crossref","first-page":"245","DOI":"10.1142\/S0218194019500116","article-title":"Permission-based Android Malware Detection System Using Feature Selection with Genetic Algorithm","volume":"29","author":"O Yildiz","year":"2019","journal-title":"Int J Soft Eng Knowl Eng"},{"key":"pone.0349589.ref029","doi-asserted-by":"crossref","first-page":"118705","DOI":"10.1016\/j.eswa.2022.118705","article-title":"Android malware detection based on multi-head squeeze-and-excitation residual network","volume":"212","author":"H Zhu","year":"2023","journal-title":"Expert Systems with Applications"},{"key":"pone.0349589.ref030","doi-asserted-by":"crossref","first-page":"3226","DOI":"10.1109\/SMC52423.2021.9659287","article-title":"MalBERT: Malware Detection using Bidirectional Encoder Representations from Transformers.","author":"A Rahali","year":"2021","journal-title":"2021 IEEE International Conference on Systems, Man, and Cybernetics (SMC)"},{"key":"pone.0349589.ref031","first-page":"420","article-title":"DetectBERT: Towards Full App-Level Representation Learning to Detect Android Malware.","author":"T Sun","year":"2024","journal-title":"Proceedings of the 18th ACM\/IEEE International Symposium on Empirical Software Engineering and Measurement"},{"key":"pone.0349589.ref032","author":"M Chaieb","year":"2024"},{"issue":"6","key":"pone.0349589.ref033","doi-asserted-by":"crossref","first-page":"1455","DOI":"10.1109\/TIFS.2018.2879302","article-title":"DroidCat: Effective Android Malware Detection and Categorization via App-Level Profiling","volume":"14","author":"H Cai","year":"2019","journal-title":"IEEE TransInformForensic Secur"},{"key":"pone.0349589.ref034","first-page":"485","article-title":"Android Malware Detection Based on Network Traffic Using Decision Tree Algorithm","author":"A Zulkifli","year":"2018","journal-title":"Advances in Intelligent Systems and Computing"},{"key":"pone.0349589.ref035","doi-asserted-by":"crossref","first-page":"71","DOI":"10.1109\/ICWR51868.2021.9443025","article-title":"Android Malware Detection and Classification Based on Network Traffic Using Deep Learning.","author":"M Gohari","year":"2021","journal-title":"2021 7th International Conference on Web Research (ICWR)"},{"key":"pone.0349589.ref036","doi-asserted-by":"crossref","first-page":"4321","DOI":"10.1109\/ACCESS.2018.2792941","article-title":"SAMADroid: A Novel 3-Level Hybrid Malware Detection Model for Android Operating System","volume":"6","author":"S Arshad","year":"2018","journal-title":"IEEE Access"},{"key":"pone.0349589.ref037","first-page":"154","article-title":"Ensemble-learning-based android malware detection using hybrid features.","author":"Z Li","year":"2024","journal-title":"2024 the 8th International Conference on Innovation in Artificial Intelligence"},{"issue":"3","key":"pone.0349589.ref038","doi-asserted-by":"crossref","first-page":"1879","DOI":"10.1007\/s11277-024-11366-y","article-title":"Hybrid deep learning approach based on LSTM and CNN for malware detection","volume":"136","author":"P Thakur","year":"2024","journal-title":"Wireless Pers Commun"},{"key":"pone.0349589.ref039","unstructured":"Python. Androguard. https:\/\/github.com\/androguard\/androguard Accessed 2025 June 22."},{"key":"pone.0349589.ref040","article-title":"Networks","author":"M Newman","year":"2010","journal-title":"Oxford University Press"},{"key":"pone.0349589.ref041","author":"K Xu","year":"2018"},{"key":"pone.0349589.ref042","unstructured":"sentence-transformers\/all-MiniLM-L6-v2. https:\/\/huggingface.co\/sentence-transformers\/all-MiniLM-L6-v2 Accessed 2025 June 22."},{"key":"pone.0349589.ref043","author":"W Wang","year":"2020"},{"issue":"3","key":"pone.0349589.ref044","doi-asserted-by":"crossref","first-page":"255","DOI":"10.1023\/B:MACH.0000015881.36452.6e","article-title":"Is Combining Classifiers with Stacking Better than Selecting the Best One?","volume":"54","author":"S D\u017eeroski","year":"2004","journal-title":"Machine Learning"},{"key":"pone.0349589.ref045","unstructured":"VirusShare.com. https:\/\/virusshare.com\/ Accessed 2025 June 22."},{"key":"pone.0349589.ref046","doi-asserted-by":"crossref","first-page":"468","DOI":"10.1145\/2901739.2903508","article-title":"AndroZoo: collecting millions of Android apps for the research community.","author":"K Allix","year":"2016","journal-title":"Proceedings of the 13th International Conference on Mining Software Repositories, Austin Texas"},{"key":"pone.0349589.ref047","article-title":"Drebin: Effective and Explainable Detection of Android Malware in Your Pocket.","author":"D Arp","year":"2014","journal-title":"Proceedings 2014 Network and Distributed System Security Symposium, San Diego, CA"},{"issue":"2","key":"pone.0349589.ref048","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3313391","article-title":"MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models (Extended Version)","volume":"22","author":"L Onwuzurike","year":"2019","journal-title":"ACM Transactions on Privacy and Security"},{"key":"pone.0349589.ref049","doi-asserted-by":"crossref","first-page":"100403","DOI":"10.1016\/j.softx.2020.100403","article-title":"Obfuscapk: An open-source black-box obfuscation tool for Android apps","volume":"11","author":"S Aonzo","year":"2020","journal-title":"SoftwareX"}],"container-title":["PLOS One"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0349589","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T17:30:44Z","timestamp":1781285444000},"score":1,"resource":{"primary":{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0349589"}},"subtitle":[],"editor":[{"given":"Arvind","family":"Mahindru","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"editor"}]}],"short-title":[],"issued":{"date-parts":[[2026,6,12]]},"references-count":49,"journal-issue":{"issue":"6","published-online":{"date-parts":[[2026,6,12]]}},"URL":"https:\/\/doi.org\/10.1371\/journal.pone.0349589","relation":{},"ISSN":["1932-6203"],"issn-type":[{"value":"1932-6203","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,12]]}}}