Journal of Digital Information Management Yi Liu, Md Gapar Md Johar, Jacquline Tham 23 1 2025 https://doi.org/10.6025/jdim/2025/23/1/11-25 https://www.dline.info/fpaper/jdim/v23i1/jdimv23i1_2.pdf With the popularity of smartphones and mobile applications, the threat of Android malware is increasingly serious. The analysis and behaviour modelling of Android malware features is studied to realize the efficient and accurate detection of Android malware, and an Android malware detection method combining mean aggregator and long-term and short-term memory is proposed. The results show that the improved system detection time is relatively stable regardless of the number of samples. The average detection time of the im- proved and unimproved systems is 0.274 s and 0.336 s, respectively, and the improved detection efficiency of the improved system is more prominent. The highest improvement rate of the enhanced system reached 18.2%. Compared with other models, the average absolute error and root mean square error were the smallest, with 3.84 and 6.26, respectively, indicating that the detection performance of the improved model is the best. With permission features and third-party library features, the accuracy of the enhanced model was 98.89% and 92.65%, and the recall rate was 99.24% and 99.09%, respectively. The improved model detection perfor- mance is good, and the robustness and stability are enhanced. Applied to actual Android devices, it can im- prove the security and privacy protection level of user data. This method ensures enhanced efficiency and stability and provides a certain reference direction for Android malware detection.