## 3 Methodology
### YOLO11-Based Classification  
YOLO11 is a state-of-the-art deep learning model designed for high-speed image classification and object detection [32]. It introduces several architectural enhancements, including the C3K2 block, Spatial Pyramid Pooling-Fast (SPPF), and Cross-Stage Partial with Spatial Attention (C2 PSA), which collectively improve feature extraction, computational efficiency, and classification accuracy [33]. We adapt YOLO11, originally designed for object classification, to analyze Android malware by leveraging its ability to detect patterns in structured data, thereby enabling accurate classification of malicious behavior. Previous studies have demonstrated the effectiveness of YOLO architectures in malware detection using image-based approaches. For instance, RT-Droid [25] employed YOLOv5 for real-time Android malware detection by converting APK features into RGB images. Similarly, an IoT-focused framework [34] utilized YOLOv7 to extract key features from malware images, achieving high classification accuracy. YOLO11 introduces multiple classification models, each designed to balance speed and accuracy. The available variants--YOLO11n, YOLO11s, YOLO11m, YOLO11l, and YOLO11x--differ in model complexity, parameter count, and computational efficiency. Smaller models, such as YOLO11n and YOLO11s, achieve faster inference speeds with lower computational requirements, making them suitable for real-time applications and deployment on resource-constrained systems. YOLO11m serves as a mid-range variant, offering a balance between computational cost and classification accuracy. In contrast, larger variants, including YOLO11l and YOLO11x, provide higher classification accuracy at the cost of increased inference time and computational demand, enabling them to capture more complex patterns in malware images. These differences are documented in the official YOLO11 benchmark results [35]. Table 3 summarizes the key differences among YOLO11 variants, including their accuracy, parameter count, computational complexity (FLOPs), and expected inference times. The YOLO11 architecture comprises three main components--Backbone, Neck, and Head--each playing a pivotal role in feature extraction, fusion, and classification, as illustrated in Figure 1b. The Backbone is responsible for extracting hierarchical features from RGB malware representations and forms the foundation of the model. It employsConvolution-BatchNorm-SiLU (CBS) layers throughout to stabilize features and incorporate non-linearity using the SiLU activation function. In addition, the Backbone utilizes C3K2 blocks, which efficiently replace large kernels with two smaller convolutions, thereby reducing computational overhead without sacrificing feature quality. To further enhance multi-scale representation learning, a Spatial Pyramid Pooling-Fast (SPPF) module aggregates features across different spatial resolutions, and a Cross-Stage Partial with Spatial Attention (C2 PSA) layer at the final stage boosts spatial attention, refining the extracted features before passing them to the next stage. The Neck integrates and fuses features extracted at various scales to improve the detection of intricate malware patterns. It accomplishes this by upsampling features and merging spatial and channel-wise information, thus enriching the multi-scale feature representations. The integration process is further refined using additional C3K2 blocks, and the continued application of CBS layers helps generalize the features, ensuring that the subsequent classification stage receives robust inputs. Finally, the Head processes the refined features from the Neck to generate the final malware classification. This stage further refines the feature maps using CBS layers and then employs Conv2D layers to map these processed features to specific malware categories.