Self-Supervised Learning for Android Malware Detection on a Time-Stamped Dataset

• URL: http://arxiv.org/abs/2604.23025v1
• Date: Fri, 24 Apr 2026 21:24:48 GMT
• Title: Self-Supervised Learning for Android Malware Detection on a Time-Stamped Dataset
• Abstract summary: We build a time-stamped dataset of benign and malicious Android apps and introduce a timestamp-verification procedure to ensure temporal accuracy.<n>We then propose a detection framework that uses self-supervised pre-training to learn obfuscation-resilient representations.<n>Under time-aware evaluation, the method attains 98% accuracy and 89% F1.
• Score: 0.8739101659113154
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Android malware detectors built with machine learning often suffer from temporal bias: models are trained and evaluated without respecting apps' actual release times, inflating accuracy and weakening real-world robustness. We address this by constructing a time-stamped dataset of benign and malicious Android apps and introducing a timestamp-verification procedure to ensure temporal accuracy. We then propose a detection framework that uses Bootstrap Your Own Latent (BYOL) for self-supervised pre-training to learn obfuscation-resilient representations, followed by supervised classification. Under time-aware evaluation, the method attains 98% accuracy and 89% F1. We further characterize malware behavior by analyzing true positives and false negatives using VirusTotal and the MITRE ATT&CK framework. To support reproducibility and further innovation, we release our dataset and source code.

Related papers

• REPLICANT: Learning Policies for Evading and Hardening Malware Detectors [48.41350618293826]
  Replicant is a deep reinforcement learning framework that learns the realistic task of evasion under a strict label-only black-box threat model.<n>We show Replicant is the strongest and most query-efficient approach achieving a mean attack success rate of 78.8%.<n>When used for adversarial training, Replicant also outperforms the state-of-the art by producing detectors with more generalizable detectors.
  arXiv  Detail & Related papers  (2026-08-28T16:29:17Z)
• ShielDroid: A Hybrid Approach Integrating Machine and Deep Learning for Android Malware Detection [0.07817813851272346]
  This study presents a real-time Android malware detection framework that analyzes application behavior to accurately identify and classify complex malware.<n>The proposed framework can enhance mobile device security by enabling timely detection of malicious applications and reducing the risk of cyberattacks.
  arXiv  Detail & Related papers  (2026-08-04T07:21:51Z)
• Label-efficient Training Updates for Malware Detection over Time [8.827428718141467]
  We propose a model-agnostic framework that evaluates an extensive set of active learning and semi-supervised learning techniques.<n>We show that these techniques, when combined, can reduce manual annotation costs by up to 90% across both domains.
  arXiv  Detail & Related papers  (2026-03-30T13:05:44Z)
• Detecting Object Tracking Failure via Sequential Hypothesis Testing [80.7891291021747]
  Real-time online object tracking in videos constitutes a core task in computer vision.<n>We propose interpreting object tracking as a sequential hypothesis test, wherein evidence for or against tracking failures is gradually accumulated over time.<n>We propose both supervised and unsupervised variants by leveraging either ground-truth or solely internal tracking information.
  arXiv  Detail & Related papers  (2026-02-13T14:57:15Z)
• Aurora: Are Android Malware Classifiers Reliable and Stable under Distribution Shift? [51.12297424766236]
  AURORA is a framework to evaluate malware classifiers based on their confidence quality and operational resilience.<n>AURORA is complemented by a set of metrics designed to go beyond point-in-time performance.<n>The fragility in SOTA frameworks across datasets of varying drift suggests the need for a return to the whiteboard.
  arXiv  Detail & Related papers  (2025-05-28T20:22:43Z)
• Revisiting Concept Drift in Windows Malware Detection: Adaptation to Real Drifted Malware with Minimal Samples [10.352741619176383]
  We propose a new technique for detecting and classifying drifted malware.<n>It learns drift-invariant features in malware control flow graphs by leveraging graph neural networks with adversarial domain adaptation.<n>Our approach significantly improves drifted malware detection on publicly available benchmarks and real-world malware databases reported daily by security companies.
  arXiv  Detail & Related papers  (2024-07-18T22:06:20Z)
• Android Malware Detection with Unbiased Confidence Guarantees [1.6432632226868131]
  We propose a machine learning dynamic analysis approach that provides provably valid confidence guarantees in each malware detection. The proposed approach is based on a novel machine learning framework, called Conformal Prediction, combined with a random forests classifier. We examine its performance on a large-scale dataset collected by installing 1866 malicious and 4816 benign applications on a real android device.
  arXiv  Detail & Related papers  (2023-12-17T11:07:31Z)
• Unleashing Mask: Explore the Intrinsic Out-of-Distribution Detection Capability [70.72426887518517]
  Out-of-distribution (OOD) detection is an indispensable aspect of secure AI when deploying machine learning models in real-world applications. We propose a novel method, Unleashing Mask, which aims to restore the OOD discriminative capabilities of the well-trained model with ID data. Our method utilizes a mask to figure out the memorized atypical samples, and then finetune the model or prune it with the introduced mask to forget them.
  arXiv  Detail & Related papers  (2023-06-06T14:23:34Z)
• DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness [58.23214712926585]
  We develop a certified defense, DRSM (De-Randomized Smoothed MalConv), by redesigning the de-randomized smoothing technique for the domain of malware detection. Specifically, we propose a window ablation scheme to provably limit the impact of adversarial bytes while maximally preserving local structures of the executables. We are the first to offer certified robustness in the realm of static detection of malware executables.
  arXiv  Detail & Related papers  (2023-03-20T17:25:22Z)
• Continuous Learning for Android Malware Detection [15.818435778629635]
  We propose a new hierarchical contrastive learning scheme, and a new sample selection technique to continuously train the Android malware classifier. Our approach reduces the false negative rate from 14% (for the best baseline) to 9%, while also reducing the false positive rate (from 0.86% to 0.48%).
  arXiv  Detail & Related papers  (2023-02-08T20:54:11Z)
• Temporal Robustness against Data Poisoning [69.01705108817785]
  Data poisoning considers cases when an adversary manipulates the behavior of machine learning algorithms through malicious training data. We propose a temporal threat model of data poisoning with two novel metrics, earliness and duration, which respectively measure how long an attack started in advance and how long an attack lasted.
  arXiv  Detail & Related papers  (2023-02-07T18:59:19Z)
• A two-steps approach to improve the performance of Android malware detectors [4.440024971751226]
  We propose GUIDED RETRAINING, a supervised representation learning-based method that boosts the performance of a malware detector. We validate our method on four state-of-the-art Android malware detection approaches using over 265k malware and benign apps. Our method is generic and designed to enhance the classification performance on a binary classification task.
  arXiv  Detail & Related papers  (2022-05-17T12:04:17Z)
• Being Single Has Benefits. Instance Poisoning to Deceive Malware Classifiers [47.828297621738265]
  We show how an attacker can launch a sophisticated and efficient poisoning attack targeting the dataset used to train a malware classifier. As opposed to other poisoning attacks in the malware detection domain, our attack does not focus on malware families but rather on specific malware instances that contain an implanted trigger. We propose a comprehensive detection approach that could serve as a future sophisticated defense against this newly discovered severe threat.
  arXiv  Detail & Related papers  (2020-10-30T15:27:44Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.