Android malware detection remains challenging as traditional approaches struggle to capture complex behavioral relationships between variants. This paper presents HeteroMalGAT, a heterogeneous graph attention network that transforms malware detection into a graph learning problem. We construct a behavioral knowledge graph with 11,598 malware samples and 139 system call nodes, connected through sample-to-syscall usage patterns, reverse relationships, and sample similarity connections. Our framework employs multi-head attention mechanisms for cross-modal representation learning between malware samples and system behaviors. Evaluated on CIC-MalDroid 2020 across five malware families, HeteroMalGAT achieves 93.49% accuracy and 99.44% AUC, outperforming six baseline algorithms while maintaining real-time inference speeds. Ablation studies confirm that heterogeneous graph structure and attention mechanisms are crucial for capturing discriminative behavioral patterns. Our results demonstrate that knowledge graph representations effectively encode semantic relationships in malware behaviors, providing a promising direction for advanced detection systems.