Abstract:To address the limitations in Android malware detection caused by the large scale of function call graphs and insufficient collaborative modeling of structural features and behavioral semantics, this study proposes a detection method based on multi-feature fusion. A pruning strategy is designed based on the context of sensitive APIs, where leaf nodes and weak semantic edges are filtered to optimize the function call graph. A weighted triplet generation mechanism based on node local clustering degree is designed, which transforms triplet frequency statistics into a measure of local coupling strength to enhance the representation of malicious structures. A gating fusion unit is introduced to dynamically adjust the fusion weights of structural features and semantic vectors, alleviating semantic loss caused by inconsistent distributions of heterogeneous features. Finally, a classifier based on a graph attention network is employed to capture the critical call relationships in software behavior for malware classification. Experimental results demonstrate that the proposed method effectively improves detection efficiency and highlights the features of malicious behavior. The proposed method outperforms other comparable approaches in terms of detection accuracy, robustness, and generalization ability.