# Towards Explainable Quantum Machine Learning for Mobile Malware Detection and Classification +
###### Abstract  
Through the years, the market for mobile devices has been rapidly increasing, and as a result of this trend, mobile malware has become sophisticated. Researchers are focused on the design and development of malware detection systems to strengthen the security and integrity of sensitive and private information. In this context, deep learning is exploited, also in cybersecurity, showing the ability to build models aimed at detecting whether an application is Trusted or malicious. Recently, with the introduction of quantum computing, we have been witnessing the introduction of quantum algorithms in Machine Learning. In this paper, we provide a comparison between five state-of-the-art Convolutional Neural Network models (i.e., AlexNet, MobileNet, EfficientNet, VGG16, and VGG19), one network developed by the authors (called Standard-CNN), and two quantum models (i.e., a hybrid quantum model and a fully quantum neural network) to classify malware. In addition to the classification, we provide explainability behind the model predictions, by adopting the Gradient-weighted Class Activation Mapping to highlight the areas of the image obtained from the application symptomatic of a certain prediction, to the convolutional and to the quantum models obtaining the best performances in Android malware detection. Real-world experiments were performed on a dataset composed of 8446 Android malicious and legitimate applications, obtaining interesting results. malware; quantum; deep learning; security; Android Article  
Towards Explainable Quantum Machine Learning for Mobile Malware Detection and Classification  
[PERSON], [PERSON], [PERSON], [PERSON]. malware analysts [3]. As demonstrated by Kaspersky, every year, there is a proliferation of malicious payloads devoted to exfiltrating data from Android-powered devices. In particular, the experts found more than 880,000 malicious installation packages only in the second quartile of 2021 ([[https://securelist.com/it-threat-evolution-q2-2021-mobile-statistics/103636/](https://securelist.com/it-threat-evolution-q2-2021-mobile-statistics/103636/)]([https://securelist.com/it-threat-evolution-q2-2021-mobile-statistics/103636/](https://securelist.com/it-threat-evolution-q2-2021-mobile-statistics/103636/)) (accessed on 16 November 2022)). One of the trends in 2021 has been the introduction of malicious code into third-party advertising modules, which developers of various useful apps often insert to monetize their work. For example, in the spring of 2021, malicious code writers used a malicious advertising SDK to infect APKpure ([[https://m.apkpure.com/](https://m.apkpure.com/)]([https://m.apkpure.com/](https://m.apkpure.com/))(accessed on 16 November 2022)), a popular alternative Android app store well known to Android users. A similar story happened with the popular FMWhatsApp WhatsApp mod ([[https://sxprojects.net/fmwhatsapp-fouad-whatsapp/](https://sxprojects.net/fmwhatsapp-fouad-whatsapp/)]([https://sxprojects.net/fmwhatsapp-fouad-whatsapp/](https://sxprojects.net/fmwhatsapp-fouad-whatsapp/)) (accessed on 16 November 2022)): one of the app versions hosted the Triada Trojan within an advertising SDK. This Trojan malware is famous for being very difficult to remove from an infected device. Furthermore, Triada is a malware known for its ability to silently download several additional malicious apps to the victim's device [4]. Malware can also sneak into official app stores. To pass all checks and reach users, malicious code writers employ, for example, loading malicious code into an approved program under the guise of an update [5]. In fact, in 2021, analysts found loaders for various Trojans in applications on Google Play, which included the Joker and Facestealer malware.