Android malware detection improves by adapting to evolving threats
HYDRA: Proactive Android Malware Drift Adaptation via Hierarchical Graph Contrastive Learning
Cryptography and SecurityMachine Learning
Summary
Android malware changes over time, which makes it hard for security programs to keep detecting it correctly. The authors created HYDRA, a method that learns how to recognize malware behavior even as it changes by looking at different levels of app behavior details. HYDRA uses a new learning technique to compare old known malware with new, unlabeled apps to spot similarities without needing lots of manual labeling. This way, it can keep detecting malware more accurately and with fewer mistakes.
What this means in practice
- •For mobile security teams: Maintain malware detection accuracy over time without needing many new manual labels by using hierarchical behavior modeling and cross-domain learning.
- •For cybersecurity software developers: Build Android malware detection tools that proactively adapt to evolving threats with stable, non-adversarial training techniques.
Authors
Han Chen, Hanchen Wang, Hongmei Chen, Lu Qin, Wenjie Zhang, Ying Zhang
Abstract
Concept drift, driven by the rapid evolution of Android malware, severely degrades the performance of machine learning detectors. Current adaptation strategies are often reactive, responding only after performance has dropped and imposing a significant manual annotation burden, or they are proactive but rely on unstable adversarial training and incomplete, single-level graph representations. To overcome these limitations, we propose HYDRA (Hybrid Drift Adaptation), a proactive adaptation framework that learns drift-invariant representations from hierarchically structured data. HYDRA first models applications using a hybrid graph structure, combining fine-grained Control Flow Graphs (CFGs) and coarse-grained Function Call Graphs (FCGs) to capture comprehensive behavioral patterns. It then introduces a novel cross-domain contrastive learning objective that aligns historical (source) and new (target) data distributions. By generating pseudo-labels for unlabeled target samples, our method pulls representations of semantically similar applications together, regardless of their domain, within a single, stable optimization process. This approach unifies feature learning and domain alignment, eliminating the need for complex adversarial objectives. Extensive experiments on large-scale, time-ordered malware datasets demonstrate that HYDRA achieves substantially lower False Negative and False Positive Rates than state-of-the-art baselines while requiring up to 87.5% fewer labeled samples. Our work thus offers a robust and efficient solution to combat concept drift in security applications.