AI-Driven Rule-Based Feature Scoring for Explainable and Adversarially Robust Android Malware Detection

The rapidly evolving Android malware that employs obfuscation and adversarial techniques has become a critical challenge for cybersecurity detection systems. This study introduces RFS-MD, short for Rule-based Feature Scoring for Malware Detection, a framework that builds explainability and adversarial defense into the detection pipeline by deriving feature importance scores directly from classification association rules. Experiments across several machine learning (ML) and deep learning (DL) classifiers on a balanced static feature dataset demonstrate that scored features improved recall across all six evaluated classifiers under cross-validation, with statistically significant accuracy and recall gains confirmed in four of the six. Under-tuned hyperparameter configurations, scored features consistently outperformed non-scored features across all classifiers. Furthermore, RFS-MD enhanced model robustness against adversarial attacks, reducing attack success rates and maintaining positive recall gains over baseline models. A rule-based explainability approach (RXAI) is introduced to generate transparent and human-readable model explanations; fidelity analysis confirms that RXAI captures interacting malicious feature patterns aligned with classifier decisions. Overall, the findings show that rule-based feature scoring offers a single, unified way to tackle accuracy, robustness, and explainability in Android malware detection simultaneously, contributing to trustworthy AI-driven cybersecurity solutions.