The ongoing evolution of the Android framework and malware renders traditional detection methods ineffective against advanced threats. To address this issue, we propose a novel Android malware detection method with API sequence intrinsic features (IFDroid), which can capture software behavior and effectively detect advanced iterations of malware. IFDroid first employs a quadruple decomposition of the API , identifying the subpackage, action, class, and object element before malware detection. This decomposition allows us to fully exploit the semantic information of APIs and form a quadruple semantic chain. Next, IFDroid extracts the call graph for each application and performs a depth-first search (DFS) on the API call graph to create a raw API call sequence. By querying and comparing these API sequences against the official Android API documentation, we filter out unofficial APIs, such as those provided by third parties or user-defined APIs. This process results in sanitized API call sequences, which offer robust contextual information about APIs and accurately represent the behavior of each application. To further capture software behavior, semantic information, and the relationships between API calls, IFDroid converts the API call sequence into a software behavior chain and a semantic chain. Finally, feature vectors are generated using embedding layers, and a multi-layer perceptron (MLP) classifier is employed for malware detection. IFDroid attains an accuracy of 0.954 and an F1-score of 0.960 using an extensive dataset developed over five years, significantly outperforming baseline models and demonstrating a notably slower aging speed. We also conduct ablation studies and concept drift experiments to validate the effectiveness of our model.
