A Stacked Ensemble Framework for Android Malware Detection Using Semantic Permission Aggregation and Explainable AI

Android is a popular target for malware attacks due to its rapid proliferation, which emphasizes the need for efficient and understandable detection methods. A novel ensemble‐based framework that combines semantic feature engineering (SFE) and explainable artificial intelligence (XAI) is presented in this paper. It addresses the generalizability and transparency issues with current models. The purpose of combining low‐level Android permissions into high‐level semantic categories is to improve interpretability and reduce feature dimensionality, making the model easier to understand. Grid search optimization is used to assess a stacked ensemble classifier that consists of k‐nearest neighbors (KNN), random forest (RF), gradient boosting (GB), and support vector machine (SVM) models with a logistic regression (LR) as a meta‐learner on the TUANDROMD dataset. The model demonstrates strong class separation and generalization with a high test accuracy of 97.54%, with an F1‐score of 0.9847 and a ROC‐AUC of 0.9929. For explainability, permutation feature importance (PFI), partial dependence plots (PDPs), and a global surrogate decision tree (GSDT) are used. Results show that network and location permissions are the most important features. This study offers a robust and interpretable solution for Android malware detection. Its combination of SFE, ensemble learning (EL), and XAI makes it suitable for real‐world cybersecurity applications, especially on mobile devices.