## 3 Methodology  
This section presents the YoloMal-XAI framework, a novel approach for Android malware classification that introduces three core innovations. First, we propose a multi-channel RGB encoding strategy that maps the DEX, XML, and ARSC components of an APK to the red, green, and blue channels, respectively, preserving structural semantics while enhancing resilience against obfuscation. Second, we adapt YOLO11--a high-speed convolutional architecture--for both binary and multi-class malware image classification. Third, we incorporate a suite of Explainable AI (XAI) methods, including Grad-CAM, Grad-CAM++, Eigen-CAM, and HiRes-CAM, enabling interpretable predictions through visual and quantitative explanation metrics.  
A high-level workflow of the complete pipeline--including APK feature extraction, RGB image construction, YOLO11-based classification, and XAI interpretation--is shown in Figure 1.  
This section is organized as follows. Section 3.1 provides a general overview of the framework. Section 3.2 describes the data preprocessing and RGB image construction. Section 3.3 explains the YOLO11-based malware classification architecture. Section 3.4 discusses the integration of Explainable AI techniques and interpretability evaluation.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Ref.** & **Approach** & **Features** & **Dataset** & **Accuracy (\%)** \\ \hline
[15] & 1D-CNN & Bytecode & AndroZoo & 97.00 \\
[17] & TuneDroid (Bayesian CNN tuning) & Grayscale DEX images & Custom (6000 apps) & 99.44 (val), 98.00 (test) \\
[18] & DTDroid (Deep DL model) & Grayscale runtime network behavior & Custom & 95.14 \\
[19] & 6 CNN Ensemble + Bayesian Fusion & Grayscale DEX images & CICMalDroid2020 & 99.30 \\  & ResNet50 + multi-component grayscale fusion & DEX, Manifest.xml, Resources.arsc & CICMalDroid2020 & 98.83 (acc), 99.27 (prec), 99.15 (rec) \\
[21] & IMCFN (ImageNet-based CNN) & Color malware images & Malimg, IoT-Android & 98.82 (Malimg), 97.35 (IoT) \\
[22] & EfficientNetB4 & DEX bytecode RGB & R2-D2 & 95.70 \\  & EfficientNetB0 + SVM/RF/LogReg & RGB malware images from DEX files & Custom (7312 apps) & 100 (binary), 92.9 (5-class), 88.6 (4-class) \\
[24] & Inception-v3 + Grad-CAM & DEX bytecode RGB & R2-D2, MalNet & 98.5 (binary), 91.0 (multi) \\
[25] & YOLOv5 (RT-Droid) & AndroidManifest.xml (QR-like RGB) & Drebin, Genome, Arslan & 98.3 (prec), 97.0 (F1) \\
[26] & VGG16, VGG19 & Network traffic & CIC-AndMal2017 & 99.25 \\
[27] & Multi-modal fusion with self-attention & Sensitive API, Binary Code & VirusShare, Google Play & 98.28 \\
[28] & Hybrid CNN-ViT (2 × CNN + 2 × ViT) & Network traffic RGB & CIC-AndMal2017 & 99.61 \\
**Ours** & **YOLO11x-cls, YOLO11n-cls** & **DEX, Manifest.xml, Resources.arsc** & **CICMalDroid2020** & **99.87 (binary), 99.56 (multi)** \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison of Android malware detection approaches.  
Figure 1: YOLO11-based malware detection with XAI architecture. This figure includes: (**a**) feature extraction from APK files and their transformation into RGB images, (**b**) malware classification using YOLO11, and (**c**) Explainable AI interpretability insights.