## 2 Previous Work
### RGB Representations  
RGB encoding transforms bytecode or feature vectors into three-channel images, enabling models to exploit spatial and color-based patterns. This allows transfer learning from large-scale visual datasets but increases computational cost.  
[PERSON] et al. (2020) [21] used ImageNet-pretrained CNNs fine-tuned on color malware images, reaching 98.82% accuracy on the Malimg dataset and 97.35% on the IoT-Android dataset.  
[PERSON] et al. (2022) [22] introduced a DEX-to-RGB conversion using six-digit hexadecimal encoding split into red, green, and blue segments. Classified with EfficientNet-B4, the model achieved 95.7% accuracy, outperforming 26 CNN baselines.  
In a related study, [PERSON] et al. (2022) [23] proposed a two-stage framework combining EfficientNetB0 feature extraction with a stacking ensemble of SVM, Random Forest, and Logistic Regression. The method achieved 100% binary, 92.9% five-class, and 88.6% four-class classification accuracy.  
[PERSON] et al. (2022) [24] combined RGB encoding with Explainable AI tools. Their Inception-v3-based model used Grad-CAM and t-SNE to visualize malware-relevant regions, achieving 98.5% accuracy in binary classification and 91% in multi-class tasks.  
[PERSON] and [PERSON] (2023) [25] introduced RT-Droid, a real-time Android malware detection system that converts AndroidManifest.xml features into RGB images. Using YOLOv5 and transfer learning, the model achieved 98.3% precision and 97.0% F-score, processing each app in just 0.019 s while requiring significantly less memory than grayscale-based approaches.  
[PERSON] et al. (2025) [26] transformed tabular Android malware data into RGB images through normalization and grid mapping, then classified them using VGG16, achieving 99.25% accuracy on CIC-AndMal2017.  
[PERSON] et al. (2025) [27] proposed a multimodal architecture fusing source code features with RGB-transformed binaries. Their method reached 98.28% accuracy and 98.66% F1-score by leveraging code semantics alongside visual patterns.  
[PERSON] et al. (2025) [28] explored dynamic feature representation using RGB-encoded network traffic images. Their hybrid CNN-ViT framework achieved 99.61% accuracy in multi-class classification, showcasing the potential of transformer architectures with RGB input.  
While prior work (see Table 1) demonstrates strong accuracy using either grayscale or RGB encodings, most approaches fall short in meeting three critical requirements simultaneously: real-time processing, interpretability, and generalizability under code obfuscation. Grayscale-based models tend to offer faster inference and lower memory usage but often suffer from limited feature richness. In contrast, RGB-based methods leverage richer representations--enabling higher classification performance--but typically involve deeper architectures and lack interpretability. Moreover, only a few studies incorporate explainability tools or fuse information from multiple APK components. Our proposed YoloMal-XAI framework directly addresses these gaps by integrating YOLO11 for real-time detection, RGB-based multi-channel encoding for enhanced feature expressiveness, and Explainable AI (XAI) mechanisms for model transparency. This combination enables an efficient, interpretable, and robust Android malware detection system suitable for deployment in dynamic and adversarial environments.