As the Internet of Things (IoT) rapidly develops, the mobile application environment has become increasingly complex, and the threat posed by malicious Android applications continues to grow. Platform system updates and the continuous evolution of malicious applications cause concept drift in detection models, significantly degrading their performance on new samples, while existing methods lack intuitive interpretability. To address these issues, this study proposes a malicious application detection method based on sensitive API context graphs. The method constructs local context subgraphs centered on sensitive APIs, characterizes stable behavioral patterns from three dimensions: upper-level calling scenarios, multi-path convergence, and core behaviors, and uses graph neural networks for representation learning. Gated attention-based multiple instance learning is used to aggregate application-level features, attention mechanisms are combined to locate key subgraphs, and large language models are introduced to generate natural language explanations. Experiments are conducted on a dataset of 42227 samples using the SacDroid system implemented based on this method. The average F1 score in same-year testing reaches 97.88%, and cross-year testing performance outperforms comparative methods. Interpretability experimental results show that large language models can perform independent discrimination based only on key subgraphs, achieving an accuracy of 89.6% and a recognition rate of 91.2% for malicious samples. The experimental results verify the effectiveness of the proposed method in terms of detection performance and interpretability.