隨著 Android 作業系統持續主導行動裝置市場，Android 惡意程式已成為資訊安全領域的重要威脅。現有偵測方法多以靜態分析為主，透過擷取權限、應用程式介面（Application Programming Interface， API） 呼叫、執行碼等特徵進行判別，然而攻擊者廣泛採用反射（Reflection）混淆技術等混淆技術，使反編譯後的靜態特徵會產生劇烈變動，進而顯著降低偵測模型的效能與穩定性。為改善此缺點，現有方法多以序列或圖結構擷取敏感 API 周邊之呼叫結構作為特徵，但節點特徵仍多建立於 API 類別與方法名稱、操作碼與權限等資訊。 本研究提出 Droid-LLaMA，將反編譯所得之程式碼輸入 Code LLaMA 以產生程式碼語意嵌入（Embedding）作為語意特徵，並搭配圖同構網路（Graph Isomorphism Network， GIN），結合指令碼、權限與程式碼等不同類別的特徵。本研究也引入對比學習機制，以 NT-Xent（Normalized Temperature-scaled Cross Entropy） 損失將同一 Android 應用程式套件（Android Application Package， APK）之原始與混淆版本作為正樣本對，引導模型學習對Reflection混淆操作具不變性之語意表示，強化模型在混淆情境下的偵測穩健性。透過結合程式碼語意特徵、指令及權限特徵的融合模型進行混淆情境下的惡意程式偵測任務，本研究以 AndroZoo 與 Drebin 建構實驗資料集，並使用 Obfuscapk 工具對所有樣本施加反射混淆，於國家高速網路與計算中心（National Center for High-performance Computing， NCHC） H100 圖形處理器（Graphics Processing Unit， GPU）環境下進行對比學習訓練，並於Nvidia GeForce RTX 4080 16G配置的設備上進行融合模型訓練。實驗分別於未混淆與混淆測試集上進行驗證，實驗結果顯示本研究所提出之 Droid-LLaMA 可以在Reflection 之混淆測試集上達到 92.72% F1-score，優於現有基準方法（如 MsDroid）約 4%。;As Android dominates the mobile market， Android malware has become a significant threat to information security. Existing detection methods mainly rely on static features such as permissions， API calls， and bytecode information. However， attackers widely employ obfuscation techniques such as reflection-based invocation， which drastically alter these features and degrade detection performance and stability. Although some methods extract call structures around sensitive APIs using sequence- or graph-based representations， their node features still rely on obfuscation-prone attributes such as API names， opcodes， and permissions. This study proposes Droid-LLaMA， which feeds decompiled code into Code LLaMA to generate semantic code embeddings and combines them with structural features learned by a Graph Isomorphism Network (GIN)， integrating semantic and structural program representations. In addition， a contrastive learning mechanism based on the Normalized Temperature-scaled Cross Entropy (NT-Xent) loss treats the original and obfuscated versions of the same Android Application Package (APK) as a positive pair， guiding the model to learn obfuscation-invariant semantic representations and enhancing robustness under obfuscation. The dataset is constructed from AndroZoo and Drebin， with reflection-based obfuscation applied to all samples using Obfuscapk. Contrastive learning is conducted on an H100 GPU at the National Center for High-performance Computing (NCHC)， while the fusion model is trained on an NVIDIA GeForce RTX 4080 (16 GB). Experiments on clean and obfuscated test sets show that Droid-LLaMA achieves a 92.72% F1-score on the obfuscated test set， outperforming baselines such as MsDroid by approximately 4 percentage points.
