MalwareLens: Explainable Android Malware Detection

Android malware detection often ends with a simple classification label, leaving users with little insight into why a model reached that decision. MalwareLens addresses this interpretability gap by combining behavioral machine learning with explainable AI. MalwareLens uses 470 behavioral features from the CICMalDroid 2020 dataset and a HistGradientBoosting classifier to distinguish five categories: Adware, Banking malware, SMS malware, Riskware, and Benign. The final model achieved 96.72% accuracy and a 0.9607 macro F1 score on a locked test set. During dataset preparation, duplicate and conflicting feature vectors were identified and handled, followed by a group-aware stratified split to prevent feature-vector leakage between training and testing. The key feature of MalwareLens is explainability. For every prediction, the application provides class probabilities and SHAP-based feature contributions, showing which behavioral signals pushed the model toward or away from a class. These explanations are presented in the model's raw boosting-score space and are intended to explain the model's reasoning rather than serve as proof that an individual behavior is malicious. The project is deployed as a Streamlit web application and supports validated behavioral-feature CSV inputs and demo test cases. It also includes a CopperDroid-style JSON feature extractor for compatible structured behavioral reports. MalwareLens does not currently execute or directly analyze arbitrary APK files; it operates on extracted behavioral information.