McNdroid: A Longitudinal Multimodal Benchmark for Robust Drift Detection in Android Malware

• URL: http://arxiv.org/abs/2605.06894v1
• Date: Thu, 07 May 2026 19:53:24 GMT
• Title: McNdroid: A Longitudinal Multimodal Benchmark for Robust Drift Detection in Android Malware
• Abstract summary: McNdroid is the largest longitudinal multimodal Android malware benchmark for malware detection and drift analysis.<n>We evaluate standard ML and deep-learning detectors across increasing train--test time gaps.<n>We analyze modality-specific drift, malware-family evolution, and temporal changes in model explanations.
• Score: 24.533722488674943
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Machine learning (ML) in real-world systems must contend with concept drift, adversarial actors, and a spectrum of potential features with varying costs and benefits. Malware naturally exhibits all of these complexities, but for the same reason, it is challenging to curate and organize data to study these factors. We present McNdroid, to our knowledge the largest longitudinal multimodal Android malware benchmark for malware detection and drift analysis. McNdroid spans 2013--2025, excluding 2015, and represents each application with three aligned modalities--static features from manifests and smali code, dynamic behavioral features from sandbox execution, and graph-based features from function-call graphs. Using temporally separated splits, we evaluate standard ML and deep-learning detectors across increasing train--test time gaps. Results show clear temporal degradation, while multimodal fusion outperforms the best single modality across long-term temporal gaps. Cross-modal agreement also declines over time, suggesting that drift affects both individual feature spaces and the consistency among modalities. We further analyze modality-specific drift, malware-family evolution, and temporal changes in model explanations. We publicly release McNdroid, benchmark splits, and code to support reproducible research on temporal generalization and robust multimodal learning in security-critical, non-stationary settings.

Related papers

• Moirae: A Multimodal Agent Collaborative Framework for Dynamic Android Malware Detection [11.680850513898557]
  We present sysname, a collaborative framework for dynamic Android malware detection.<n>sysname collects multimodal runtime evidence and employs specialized agents to analyze complementary behavioral views.<n>Experiments on temporally and distributionally unseen datasets show that sysname achieves an accuracy of 90.06% without fine-tuning.
  arXiv  Detail & Related papers  (2026-08-28T07:03:38Z)
• AdaSurvMamba: Dynamic Fusion and Semantic Scanning for Multimodal Survival Analysis [57.942670844512016]
  We introduce AdaSurvMamba as a novel adaptive framework for multimodal survival analysis.<n>The framework features a Dual-Scale Importance-Aware Reconstruction (DSIR) module to dynamically modulate cross-modal interaction strength.<n>Experiments across five TCGA cohorts demonstrate consistent gains over existing methods.
  arXiv  Detail & Related papers  (2026-06-28T11:36:31Z)
• PIDNet: Progressive Implicit Decouple Network for Multimodal Action Quality Assessment [14.92667427129547]
  Action quality assessment (AQA) aims to automatically quantify the execution quality of human actions in videos and is valuable for applications such as competitive sports judging.<n>We propose a progressive implicit decoupling and fusion network (PIDNet) that integrates modality-specific information, cross-modal complementary cues, and global quality semantics for accurate assessment.<n>Experiments on the Rhythmic Gymnastics and Fis-V datasets show that PIDNet achieves highly competitive score correlation with favorable error control compared with existing unimodal and multimodal methods.
  arXiv  Detail & Related papers  (2026-05-09T13:33:16Z)
• Ada3Drift: Adaptive Training-Time Drifting for One-Step 3D Visuomotor Robotic Manipulation [53.750389076941396]
  Diffusion-based visuomotor policies capture multimodal action distributions through iterative denoising, but their high inference latency limits real-time robotic control.<n>We propose Ada3Drift, which learns a training-time drifting field that attracts predicted actions toward expert demonstration modes.<n>Ada3Drift achieves state-of-the-art performance while requiring $10times$ fewer function evaluations than diffusion-based alternatives.
  arXiv  Detail & Related papers  (2026-03-12T14:36:53Z)
• FusAD: Time-Frequency Fusion with Adaptive Denoising for General Time Series Analysis [92.23551599659186]
  Time series analysis plays a vital role in fields such as finance, healthcare, industry, and meteorology.<n>FusAD is a unified analysis framework designed for diverse time series tasks.
  arXiv  Detail & Related papers  (2025-12-16T04:34:27Z)
• DMLDroid: Deep Multimodal Fusion Framework for Android Malware Detection with Resilience to Code Obfuscation and Adversarial Perturbations [1.3792857294744785]
  We propose DMLDroid, an Android malware detection based on multimodal fusion.<n>We conduct exhaustive experiments independently on each feature, as well as in combination, using different fusion strategies.<n>Our findings highlight the benefits of multimodal fusion in improving both detection accuracy and robustness against evolving Android malware threats.
  arXiv  Detail & Related papers  (2025-09-14T09:32:27Z)
• Multi-modal Adaptive Estimation for Temporal Respiratory Disease Outbreak [8.861941883057098]
  MAESTRO is a novel, unified framework that integrates spectro-temporal modeling with multi-modal data fusion.<n> Evaluated on over 11 years of Hong Kong data, MAESTRO achieves a superior model fit with an R-square of 0.956.<n>The modular and reproducible pipeline is made publicly available to facilitate deployment and extension to other regions and pathogens.
  arXiv  Detail & Related papers  (2025-09-10T13:27:40Z)
• What You Have is What You Track: Adaptive and Robust Multimodal Tracking [72.92244578461869]
  We present the first comprehensive study on tracker performance with temporally incomplete multimodal data.<n>Our model achieves SOTA performance across 9 benchmarks, excelling in both conventional complete and missing modality settings.
  arXiv  Detail & Related papers  (2025-07-08T11:40:21Z)
• LAMDA: A Longitudinal Android Malware Benchmark for Concept Drift Analysis [5.895643771545453]
  LAMDA is the largest and most temporally diverse Android malware benchmark to date.<n>It reflects the natural distribution and evolution of real-world Android applications.<n>It enables in-depth research into temporal drift, generalization, explainability, and evolving detection challenges.
  arXiv  Detail & Related papers  (2025-05-24T06:36:39Z)
• MVICAD2: Multi-View Independent Component Analysis with Delays and Dilations [61.59658203704757]
  We propose Multi-View Independent Component Analysis with Delays and Dilations (MVICAD2), which allows sources to differ across subjects in both temporal delays and dilations.<n>We present a model with identifiable sources, derive an approximation of its likelihood in closed form, and use regularization and optimization techniques to enhance performance.
  arXiv  Detail & Related papers  (2025-01-13T15:47:02Z)
• Multiscale Sensor Fusion and Continuous Control with Neural CDEs [17.67182664077201]
  We present 'InFuser', a unified architecture that trains continuous time-policies with Neural Controlled Equations Differential (CDEs) InFuser evolves a single latent state representation over time by (In)tegrating and (Fus)ing multi-sensory observations. Experiments demonstrate that InFuser learns robust policies for dynamic tasks.
  arXiv  Detail & Related papers  (2022-03-16T16:06:03Z)
• Exploring Data Augmentation for Multi-Modality 3D Object Detection [82.9988604088494]
  It is counter-intuitive that multi-modality methods based on point cloud and images perform only marginally better or sometimes worse than approaches that solely use point cloud. We propose a pipeline, named transformation flow, to bridge the gap between single and multi-modality data augmentation with transformation reversing and replaying. Our method also wins the best PKL award in the 3rd nuScenes detection challenge.
  arXiv  Detail & Related papers  (2020-12-23T15:23:16Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.