DMLDroid: Deep Multimodal Fusion Framework for Android Malware Detection with Resilience to Code Obfuscation and Adversarial Perturbations

In recent years, Android malware detection has advanced rapidly with the adoption of learning-based techniques, which typically analyze app code as text, images, or graphs. Despite strong performance, these methods often struggle in real-world settings, especially when malware uses code obfuscation to hide its malicious behavior or exploits adversarial examples (AEs), which are intentionally modified inputs created to mislead detection systems. Deep multimodal learning has emerged as a promising solution, leveraging the strengths of multiple feature types to enhance robustness and generalization. Nevertheless, a systematic investigation of multimodal fusion for both accuracy and resilience remains underexplored. In this study, we propose DMLDroid, an Android malware detection based on multimodal fusion that leverages three different representations of malware features, including permissions \& intents (tabular-based), DEX file representations (image-based), and API calls (graph-derived sequence-based). We conduct exhaustive experiments independently on each feature, as well as in combination, using different intermediate fusion strategies. Among these, we propose a lightweight Dynamic Weighted Fusion (DWF) mechanism that assigns a single learnable weight per modality, enabling an interpretable and computationally efficient weighted integration of heterogeneous features. Experimental results on the CICMalDroid 2020 dataset demonstrate that the proposed multimodal framework achieves 97.98\% accuracy and 98.67\% F1-score on original malware detection, while sustaining over 98\% accuracy and 98\% F1-score under both obfuscation and adversarial attack scenarios. Furthermore, DWF reduces computational overhead compared to other intermediate fusion mechanisms. These results demonstrate that well-designed multimodal fusion substantially improves robustness against evasive Android malware while remaining practical for real-world deployment.