Pith. sign in

REVIEW 5 major objections 6 minor 1 cited by

Empirical Evaluation of Concept Drift in ML-Based Android Malware Detection

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Concept drift degrades every Android malware detector tested

desk verdict A broad, honest empirical map of Android malware concept drift, but the central claim is undercut by a training-size/year confound in the cross-year experiments. read the letter →

arxiv 2507.22772 v1 pith:3JJDNZJ7 submitted 2025-07-30 cs.CR cs.AIcs.LG

Ahmed Sabbah , Radi Jarrar , Samer Zein , David Mohaisen This is my paper
classification cs.CRcs.AIcs.LG
keywords conceptdriftAndroidmalwaredetectionmachinelearningtemporalevaluationcross-yeartrainingfamilyclassificationlargelanguagemodelsdatabalancing
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Machine learning is the standard tool for Android malware detection, and on randomly split data it looks near-perfect. This paper tries to establish that those numbers are misleading: malware changes over time, and 'concept drift' systematically degrades every detector it tests. Using two datasets, nine machine-learning and deep-learning models, and two large language models, across static, dynamic, hybrid, semantic, and image-based features, the authors train on old years and test on newer years. They find consistent accuracy and F1 drops in both binary and family-classification settings, with balancing algorithms and few-shot LLMs offering only partial relief. If the finding holds, real deployed detectors need continuous updating rather than one-time training.

What carries the argument

The carrying mechanism is the cross-year evaluation strategy: train a detector on all samples from one year and test it on each of the other twelve years, repeating this for every year in KronoDroid (2008–2020). Together with an incremental strategy (cumulatively adding training years) and a grouping strategy for family labels (2008–2012, 2013–2016, 2017–2020), this temporal split simulates real deployment, where a model trained on historical samples meets a stream of new, evolved malware. The paper uses this protocol to attribute observed performance drops to concept drift, and applies SMOTE-based balancing to separate class-imbalance effects from drift.

What would settle it

Retrain the same models on historical years after matching sample sizes across years—for instance, subsample the 2013–2016 data down to the few hundred samples available in 2008–2012, or augment the early years synthetically—and check whether the cross-year accuracy drops persist. If the drops shrink or vanish, the reported concept drift is largely a data-quantity artifact; if they remain, drift is confirmed as the cause.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is that concept drift consistently degrades detection performance across all models, independent of algorithm or feature type. Models trained on older Android malware samples underperform on newer samples, and the authors attribute this to distribution shift in the malware landscape rather than to algorithmic flaws. The paper reports that static features are the most drift-resistant, dynamic features more fragile, and semantic TF-IDF representations of API calls the most susceptible; that real-device data resists drift better than emulator data in binary classification; and that malware family (multi-class) classification suffers more from drift than binary detection. Data balancing with SMOTE improves reliability but does not remove drift and can even hurt on some feature types, while the two LLMs with few-shot prompting show promising but incomplete drift resilience.

Load-bearing premise

The load-bearing premise is that training on one year's samples faithfully represents that year's malware landscape; in the early KronoDroid years the sample counts are tiny, so part of the measured 'drift' could be an artifact of training on very little data.

Editorial extensions

If this is right

  • If the central claim holds, a detector trained once on an old corpus will systematically underperform on future samples, so sustained detection requires scheduled retraining or continuous updating.
  • Static features (permissions, intents) are a safer default for drift robustness, while dynamic and semantic features need drift-aware handling.
  • Balancing class sizes helps reliability but is not a cure; on some representations, it can even worsen drift, so its use must be feature-specific.
  • Malware family classification is substantially more drift-sensitive than binary detection, making family-labeling deployments especially demanding.
  • LLM-based few-shot detection is not a full solution but merits further study as a drift-mitigation component.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the early KronoDroid years (2008–2012) contain very few samples, so the especially poor results when training on those years likely conflate genuine drift with small-sample training; a fair comparison would retrain on comparable sample sizes across years.
  • Editorial inference: the near-perfect F1 scores of Exaone on emulator data across all years are suspicious and may reflect the model picking up the prompt's fixed 30-shot prior rather than evidence of drift immunity; testing with adversarial or reshuffled examples would clarify.
  • Editorial inference: since algorithm choice barely matters once features and temporal split are fixed, research effort is likely better spent on feature design, data collection environments, and update policies than on new classifier architectures.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper reports a large empirical study of concept drift in ML-based Android malware detection. Using the KronoDroid and Troid datasets, the authors evaluate seven machine-learning/deep-learning classifiers and two instruction-tuned LLMs across static, dynamic, hybrid, TF-IDF/API-call, and image-based features. Concept drift is simulated with three temporal strategies: cross-year training/testing, incremental (cumulative) training, and grouped-year training for malware-family classification. The main claim, stated in the abstract and conclusion, is that concept drift consistently degrades detector performance across all models, independent of algorithm or feature type, and that balancing partially mitigates but does not eliminate drift. The paper also reports that LLMs with few-shot prompts show promise but do not fully overcome drift.

Significance. If the central measurement claims were fully supported, the paper would be a useful reference point for the malware-detection community: it combines two public datasets, nine model families, multiple feature types, and three temporal evaluation protocols, and it explicitly acknowledges limitations such as default hyperparameters and small Troid malware counts. The inclusion of LLM few-shot evaluation under temporal splits is timely, and the separate reporting of pre- and post-balancing results is a good practice. However, the paper's headline conclusion is broader than what the reported experiments can support, and several load-bearing methodological choices need to be reworked before the quantitative claims can be considered reliable.

major comments (5)
  1. [Section 5.4, Figs. 4-6] The cross-year strategy trains on one year and tests on all other years, pooling both future and past test years in the reported distributions. Concept drift is a directional temporal phenomenon, and the central claim that "models trained on older data perform poorly on newer samples" (Section 8) requires forward-only splits. As reported, a low accuracy for, say, a 2011-trained model averaged over 2012-2020 and 2008-2010 test years cannot be attributed to forward drift. The incremental strategy in Figs. 11-13, which is forward-only, actually shows accuracy generally increasing as training years accumulate, not consistent degradation; this tension should be addressed explicitly.
  2. [Section 5.4 and Fig. 1] Training year and training-set size are confounded in the cross-year strategy. KronoDroid's 2008 and 2009 splits contain on the order of 600-1,000 samples, while later years contain thousands or tens of thousands (Fig. 1). A model trained on such small per-year sets is expected to generalize poorly even without drift. SMOTE (Section 5.3) balances class priors but does not add real information about that year's malware distribution. The paper should either subsample later years to match early-year training sizes, or otherwise quantify how much of the early-year accuracy drop remains after controlling for sample size.
  3. [Section 5.4 (LLM-Based Evaluation), Figs. 7-8] The LLM evaluation uses only 10 test samples per year, which makes the reported F1 values extremely coarse (e.g., medians of 0.67, 0.83, or 1.00 on a 10-sample grid) and prevents meaningful comparison across years and models. The selection procedure for the 30 few-shot examples is not described, and the paper later refers to a 50/20 split without explaining how the qualitative conclusions change between the two configurations. No confidence intervals or significance tests are provided, so the claim that LLMs "show promise but do not fully mitigate drift" is not quantitatively supported.
  4. [Section 8 (Conclusion)] The conclusion that drift "consistently degrades performance across all models, independent of algorithm or feature type" is contradicted by the paper's own results. Section 6.2 (Takeaway 9) states that balancing API-call features on Troid exacerbates drift, and Fig. 9a,c shows pre-balancing accuracy that is essentially flat across training years (≈0.91-0.93). Section 6.5 summarizes static features as the most resistant and semantic features as the most susceptible, which is not "independent of feature type." The RQ1.3 answer in Section 6.5 also says balancing "effectively addresses class imbalance, improving the results," while Takeaway 9 reports the opposite for Troid API calls. The conclusions need to be qualified to reflect the observed heterogeneity.
  5. [Sections 6.1-6.4] No statistical significance tests are reported anywhere in the paper. Comparisons between models, feature types, balancing conditions, and training-year groups are made by visual inspection of box plots and median values, often with a single run per configuration. Given that the paper makes broad comparative claims (e.g., "real device data demonstrated greater resilience"), the authors should add appropriate tests such as paired Wilcoxon signed-rank tests across test years, or report confidence intervals and effect sizes.
minor comments (6)
  1. [Section 5.2] "Knorodroid" should be "KronoDroid."
  2. [Section 3] The text attributes the introduction of concept drift to "Schlemmer et al.," but the corresponding reference [17] is authored by Schlimmer and Granger; the spelling should be corrected.
  3. [Section 6.2 (Hybrid Features)] The sentence "The Troid dataset was used, as the Kronodroid dataset does not support the relevant features" appears in the middle of the KronoDroid hybrid-features discussion, where it is not applicable and appears to be a copy-paste error.
  4. [Section 5.4 (Token Usage Estimation)] The token estimate assumes 30 few-shot examples, but the later repetition described in the text and Fig. 8 uses a 50-train/20-test split; the relationship between the two configurations should be clarified.
  5. [Tables 3-4] The text in Section 6.1 states that RF achieves 0.977 accuracy with static features, while Table 3 lists 0.98; the numbers should be reconciled.
  6. [Fig. 7] For Exaone on emulator data, several panels report a median F1 of exactly 1.00 for every training year; with only 10 test samples per year, reporting exact correct-prediction counts or confidence intervals would be more informative.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the study is an empirical measurement whose conclusions rest on external datasets and standard classifiers, not on fitted inputs or self-referential definitions.

full rationale

The paper's central claim—that concept drift degrades Android malware detection performance across models—is supported by direct temporal train/test measurements on the external KronoDroid and Troid datasets. No model parameter is fitted to test-year labels, and the few-shot LLM prompts contain only training-year examples, so the reported accuracy and F1 drops are not predictions forced by construction. The only author-overlapping citation of note is the Troid dataset [16], but Troid is used as an independent public data artifact and the experiments on it are performed in this paper, so the citation is not load-bearing. Concept drift is defined in Section 3 in terms of probability-distribution changes, with performance degradation treated as an operational consequence rather than the definition of drift, so the conclusion is not self-definitional. The most serious limitation—early KronoDroid years contain very few samples, collinear with training year—is a threat to the internal validity of the drift attribution, but it is a confound rather than a circularity, and per the review rules it belongs under correctness risk rather than the circularity score.

Assumptions & free parameters 3 free parameters · 2 assumptions · 0 invented entities

The study is a measurement exercise; the main 'free' choices are evaluation hyperparameters (PCA dimension, few-shot count, test count) and the temporal split design. No new entities are introduced.

free parameters (3)
  • PCA components = 30
    Dimensionality reduction for LLM input features (static, dynamic, hybrid). Chosen without a sensitivity analysis; the number of components affects the information available to the LLM and thus the measured drift.
  • Few-shot examples = 30
    The number of in-context labeled examples included in each LLM prompt. Chosen by hand; no justification is given, and performance may depend heavily on this count.
  • Test samples per year = 10
    Each train-test year pair for the LLM evaluation uses only 10 test samples. This very small test set makes F1 estimates noisy and can inflate or deflate the apparent drift.
assumptions (2)
  • domain assumption Ground-truth labels in KronoDroid and Troid are reliable and consistent over time.
    The study relies on the correctness of malicious/benign and family labels as provided by these public datasets. If labeling is noisy, measured drift may be partially spurious.
  • domain assumption Training on one year and testing on another accurately simulates concept drift.
    The cross-year strategy assumes temporal generalization is the primary factor. Small sample sizes in early years may confound data quantity with concept drift.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Empirical Evaluation of Concept Drift in ML-Based Android Malware Detection." pith.science (2026). https://pith.science/paper/3JJDNZJ7

@misc{pith2026250722772,
  author       = {Pith},
  title        = {Pith review of: Empirical Evaluation of Concept Drift in ML-Based Android Malware Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3JJDNZJ7}},
  note         = {Machine review of arXiv:2507.22772}
}
read the original abstract

Despite outstanding results, machine learning-based Android malware detection models struggle with concept drift, where rapidly evolving malware characteristics degrade model effectiveness. This study examines the impact of concept drift on Android malware detection, evaluating two datasets and nine machine learning and deep learning algorithms, as well as Large Language Models (LLMs). Various feature types--static, dynamic, hybrid, semantic, and image-based--were considered. The results showed that concept drift is widespread and significantly affects model performance. Factors influencing the drift include feature types, data environments, and detection methods. Balancing algorithms helped with class imbalance but did not fully address concept drift, which primarily stems from the dynamic nature of the malware landscape. No strong link was found between the type of algorithm used and concept drift, the impact was relatively minor compared to other variables since hyperparameters were not fine-tuned, and the default algorithm configurations were used. While LLMs using few-shot learning demonstrated promising detection performance, they did not fully mitigate concept drift, highlighting the need for further investigation.

Figures

Figures reproduced from arXiv: 2507.22772 by the authors.

Figure 1
Figure 1. KronoDroid dataset distribution of both malware and benign samples across different years. [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Troid dataset distribution. Real Device Emulator Collection Data Source Numeric-Based Hexadecimal Dumps Detection Approach ① Preprocessing ② Features Space ④ Classification & Drift Strategies Grouping Strategy Ignoring Temporal Factor ③ Balancing Benign Malware ü Accuracy ü Precision ü Recall ü F1 Machine Learning Deep Learning Evaluation Classifiers API Call Sequences Image-Based Static (Permissions, Intent) Semant… view at source ↗
Figure 3
Figure 3. The overview of our approach operates in four [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (15 more)
Figure 4
Figure 4. Figure 4: Cross-year RF pre- and post-balancing results with static features using real and emulator data. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Cross-year pre- and post-balancing GRU accuracy with dynamic features from real/emulator data. (F1 in [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Cross-year pre- and post-balancing RNN accuracy with hybrid features from real/emulator data. (F1 in [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: LLaMA (L) and Exaone (E) results with Static (S), Dynamic (D), and Hybrid (H) features using real/emulator data. [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: Exaone results on emulator data using static, dynamic, and hybrid features (50 train, 20 test samples). [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 10
Figure 10. Figure 10: The detection performance for CNN with RGB and grayscale (GS), pre and post-balancing. (a) Pre-CNN-GS-Acc, [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]
Figure 11
Figure 11. Figure 11: RF accuracy pre- and post-balancing on real and emulator data with static features. (F1 in Appendix; [PITH_FULL_IMAGE:figures/full_fig_p011_11.png]
Figure 12
Figure 12. Figure 12: GRU’s accuracy pre- and post-balancing on real/emulator data and dynamic features. (F1 in Appendix; Fig. [PITH_FULL_IMAGE:figures/full_fig_p011_12.png]
Figure 13
Figure 13. Figure 13: RNN accuracy with incremental training, real/emulator data, and hybrid features. (F1 in Appendix; Fig. [PITH_FULL_IMAGE:figures/full_fig_p011_13.png]
Figure 14
Figure 14. Figure 14: Grouping strategy performance of RF pre- and post-balancing for real device (R) and emulator (E), and static (S), [PITH_FULL_IMAGE:figures/full_fig_p012_14.png]
Figure 15
Figure 15. Figure 15: Cross-year GRU pre- and post-balancing perfor [PITH_FULL_IMAGE:figures/full_fig_p016_15.png]
Figure 16
Figure 16. Figure 16: Cross-year RNN pre- and post-balancing F1 score [PITH_FULL_IMAGE:figures/full_fig_p017_16.png]
Figure 17
Figure 17. Figure 17: The performance of RF algorithm pre- and post [PITH_FULL_IMAGE:figures/full_fig_p017_17.png]
Figure 18
Figure 18. Figure 18: The performance of GRU algorithm pre- and post [PITH_FULL_IMAGE:figures/full_fig_p018_18.png]
Figure 19
Figure 19. Figure 19: RNN performance under incremental training with [PITH_FULL_IMAGE:figures/full_fig_p018_19.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Adversarial Vulnerability Under Temporal Concept Drift: A Longitudinal Study of Android Malware Detection

    cs.CR 2026-05 unverdicted novelty 4.0 of 10

    Longitudinal evaluation over yearly Android app slices shows temporal drift reduces adversarial robustness of malware detectors, with expanding-window retraining providing partial mitigation but not full recovery.

Reference graph

Works this paper leans on

70 extracted references · 46 canonical work pages · cited by 1 Pith paper

  1. [1]

    Mobile threat report for q1 2025 — securelist,

    A. Kivva, “Mobile threat report for q1 2025 — securelist,” 6 2025, [Online; accessed 2025-06-24]. [Online]. Available: https://securelist.com/ malware-report-q1-2025-mobile-statistics/116676/

    work page 2025

  2. [2]

    Banking data theft attacks on smartphones triple in 2024, kaspersky reports,

    Kaspersky, “Banking data theft attacks on smartphones triple in 2024, kaspersky reports,” 3 2025, [Online; accessed 2025-06-24]. [Online]. Available: https://www.kaspersky.com/about/press-releases/ banking-data-theft-attacks-on-smartphones-triple-in-2024-kaspersky-reports 14

    work page 2024

  3. [3]

    Detecting android malware leveraging text semantics of network flows,

    S. Wang, Q. Yan, Z. Chen, B. Yang, C. Zhao, and M. Conti, “Detecting android malware leveraging text semantics of network flows,” IEEE Trans. Inf. Forensics Secur. , vol. 13, no. 5, pp. 1096–1109, 2018. [Online]. Available: https://doi.org/10.1109/ TIFS.2017.2771228

    arXiv 2018

  4. [4]

    Droidcat: Effective android malware detection and categorization via app-level profiling,

    H. Cai, N. Meng, B. G. Ryder, and D. Yao, “Droidcat: Effective android malware detection and categorization via app-level profiling,” IEEE Trans. Inf. Forensics Secur. , vol. 14, no. 6, pp. 1455–1470, 2019. [Online]. Available: https://doi.org/10.1109/ TIFS.2018.2879302

    work page arXiv 2019

  5. [5]

    Permpair: Android malware detection using permission pairs,

    A. Arora, S. K. Peddoju, and M. Conti, “Permpair: Android malware detection using permission pairs,” IEEE Trans. Inf. Forensics Secur., vol. 15, pp. 1968–1982, 2020. [Online]. Available: https://doi.org/10.1109/TIFS.2019.2950134

    work page arXiv 1968

  6. [6]

    Recent advances in android mobile malware detection: A systematic literature review,

    A. Alzubaidi, “Recent advances in android mobile malware detection: A systematic literature review,” IEEE Access , vol. 9, pp. 146 318–146 349, 2021. [Online]. Available: https://doi.org/10. 1109/ACCESS.2021.3123187

    arXiv 2021

  7. [7]

    Limondroid: a system coupling three signature- based schemes for profiling android malware,

    F. Tchakount ´e, R. C. N. Ngassi, V . C. Kamla, and K. P . Udagepola, “Limondroid: a system coupling three signature- based schemes for profiling android malware,” Iran J. Comput. Sci., vol. 4, no. 2, pp. 95–114, 2021. [Online]. Available: https://doi.org/10.1007/s42044-020-00068-w

    work page doi:10.1007/s42044-020-00068-w 2021

  8. [8]

    A framework for detection of android malware using static features,

    M. Dhalaria and E. Gandotra, “A framework for detection of android malware using static features,” in INDICON. IEEE, 2020, pp. 1–7

    work page 2020

Show all 70 references
  1. [9]

    Robust deep learning early alarm prediction model based on the behavioural smell for android malware,

    E. Amer and S. H. A. El-Sappagh, “Robust deep learning early alarm prediction model based on the behavioural smell for android malware,” Comput. Secur. , vol. 116, p. 102670, 2022. [Online]. Available: https://doi.org/10.1016/j.cose.2022.102670

    2022

  2. [10]

    An early detection of android malware using system calls based machine learning model,

    X. Zhang, A. Mathur, L. Zhao, S. Rahmat, Q. Niyaz, A. Y. Javaid, and X. Yang, “An early detection of android malware using system calls based machine learning model,” in ARES. ACM, 2022, pp. 92:1–92:9. [Online]. Available: https://doi.org/10.1145/3538969.3544413

    2022

  3. [11]

    Continuous learning for android malware detection,

    Y. Chen, Z. Ding, and D. A. Wagner, “Continuous learning for android malware detection,” in USENIX, J. A. Calandrino and C. Troncoso, Eds. USENIX Association, 2023, pp. 1127–

    2023

  4. [12]

    A unifying view on dataset shift in classification,

    J. G. Moreno-Torres, T. Raeder, R. Ala ´ız-Rodr´ıguez, N. V . Chawla, and F. Herrera, “A unifying view on dataset shift in classification,” Pattern Recognit. , vol. 45, no. 1, pp. 521–530, 2012. [Online]. Available: https://doi.org/10.1016/j.patcog.2011.06.019

    2012 doi

  5. [13]

    TESSERACT: eliminating experimental bias in malware classification across space and time,

    F. Pendlebury, F. Pierazzi, R. Jordaney, J. Kinder, and L. Cavallaro, “TESSERACT: eliminating experimental bias in malware classification across space and time,” in Proceedings of the USENIX Security Symposium , 2019, pp. 729–

    2019

  6. [14]

    Transcending TRANSCEND: revisiting malware classification in the presence of concept drift,

    F. Barbero, F. Pendlebury, F. Pierazzi, and L. Cavallaro, “Transcending TRANSCEND: revisiting malware classification in the presence of concept drift,” in SP. IEEE, 2022, pp. 805–823. [Online]. Available: https://doi.org/10.1109/SP46214. 2022.9833659

    2022

  7. [15]

    Kronodroid: Time-based hybrid-featured dataset for effective android malware detection and characterization,

    A. Guerra-Manzanares, H. Bahsi, and S. N ˜omm, “Kronodroid: Time-based hybrid-featured dataset for effective android malware detection and characterization,” Comput. Secur. , vol. 110, p. 102399, 2021. [Online]. Available: https://doi.org/10.1016/j.cose. 2021.102399

    2021

  8. [16]

    Troid: Temporal and cross-sectional android dataset and its applications,

    A. AlKinoon, A. Alghamd, A. Alghuried, and D. Mohaisen, “Troid: Temporal and cross-sectional android dataset and its applications,” 2024, iEEE DataPort, https://doi.org/10.21227/ 95my-tf46

    2024

  9. [17]

    Incremental learning from noisy data,

    J. C. Schlimmer and R. H. Granger, “Incremental learning from noisy data,” Mach. Learn., vol. 1, no. 3, pp. 317–354, 1986. [Online]. Available: https://doi.org/10.1023/A:1022810614389

    1986 doi

  10. [18]

    Concept drift adaptation methods under the deep learning framework: A literature review,

    Q. Xiang, L. Zi, X. Cong, and Y. Wang, “Concept drift adaptation methods under the deep learning framework: A literature review,” Applied Sciences, vol. 13, no. 11, p. 6515, 2023

    2023

  11. [19]

    E. B. Karbab, M. Debbabi, A. Derhab, and D. Mouheb, Android Malware Detection using Machine Learning: Data-Driven Fingerprinting and Threat Intelligence . Springer, 2021. [Online]. Available: https://doi.org/10.1007/978-3-030-74664-3

    2021 doi

  12. [20]

    Android malware detection techniques in traditional and cloud computing platforms: A state-of-the-art survey,

    A. Vishnoi, P . Mishra, C. Negi, and S. K. Peddoju, “Android malware detection techniques in traditional and cloud computing platforms: A state-of-the-art survey,” Int. J. Cloud Appl. Comput., vol. 11, no. 4, pp. 113–135, 2021. [Online]. Available: https://doi.org/10.4018/IJCA...

    2021 doi

  13. [21]

    A systematic overview of android malware detection,

    M. Li, Z. Fang, J. Wang, L. Cheng, Q. Zeng, T. Yang, Y. Wu, and J. Geng, “A systematic overview of android malware detection,” Appl. Artif. Intell. , vol. 36, no. 1, 2022. [Online]. Available: https://doi.org/10.1080/08839514.2021.2007327

    2022

  14. [22]

    Adaptive android mal- ware signature detection,

    S. Ngamwitroj and B. Limthanmaphon, “Adaptive android mal- ware signature detection,” in ICCET, 2018, pp. 22–25

    2018

  15. [23]

    Permission based malware detection in android devices,

    S. Ilham, A. Ghadi, and A. B. Abdelhakim, “Permission based malware detection in android devices,” in SCA. ACM, 2018, pp. 83:1–83:6. [Online]. Available: https://doi.org/10.1145/3286606. 3286860

    2018 doi

  16. [24]

    Android malware detection based on composition ratio of permission pairs,

    H. Kato, T. Sasaki, and I. Sasase, “Android malware detection based on composition ratio of permission pairs,” IEEE Access, vol. 9, pp. 130 006–130 019, 2021. [Online]. Available: https://doi.org/10.1109/ACCESS.2021.3113711

    2021

  17. [25]

    Malware detection: A framework for reverse engineered android applications through machine learning algorithms,

    B. Urooj, M. A. Shah, C. Maple, M. K. Abbasi, and S. Riasat, “Malware detection: A framework for reverse engineered android applications through machine learning algorithms,” IEEE Access , vol. 10, pp. 89 031–89 050, 2022. [Online]. Available: https://doi.org/10.1109/ACCESS.20...

    2022

  18. [26]

    An android malware detection approach based on static feature analysis using machine learning algorithms,

    A. S. Shatnawi, Q. Yassen, and A. A. Yateem, “An android malware detection approach based on static feature analysis using machine learning algorithms,” in Procedia Computer Science, Volume 201 (ANT) , 2022, pp. 653–658. [Online]. Available: https://doi.org/10.1016/j.procs.2022.03.086

    2022 doi

  19. [27]

    Multi- view deep learning for zero-day android malware detection,

    S. Millar, N. McLaughlin, J. M. del Rinc ´on, and P . Miller, “Multi- view deep learning for zero-day android malware detection,” J. Inf. Secur. Appl. , vol. 58, p. 102718, 2021. [Online]. Available: https://doi.org/10.1016/j.jisa.2020.102718

    2021

  20. [28]

    N- gram, semantic-based neural network for mobile malware network traffic detection,

    H. Bai, G. Liu, W. Liu, Y. Quan, and S. Huang, “N- gram, semantic-based neural network for mobile malware network traffic detection,” Secur. Commun. Networks , vol. 2021, pp. 5 599 556:1–5 599 556:17, 2021. [Online]. Available: https://doi.org/10.1155/2021/5599556

    2021 doi

  21. [29]

    An efficient android malware detection system based on method-level behavioral semantic analysis,

    H. Zhang, S. Luo, Y. Zhang, and L. Pan, “An efficient android malware detection system based on method-level behavioral semantic analysis,” IEEE Access , vol. 7, pp. 69 246–69 256,

  22. [30]

    A malware detection approach using autoencoder in deep learning,

    X. Xing, X. Jin, H. Elahi, H. Jiang, and G. Wang, “A malware detection approach using autoencoder in deep learning,” IEEE Access, vol. 10, pp. 25 696–25 706, 2022. [Online]. Available: https://doi.org/10.1109/ACCESS.2022.3155695

    2022

  23. [31]

    Android malware detection based on image-based features and machine learning techniques,

    H. M. ¨Unver and K. Bakour, “Android malware detection based on image-based features and machine learning techniques,” SN Applied Sciences, vol. 2, no. 7, pp. 1–15, 2020

    2020

  24. [32]

    MCNN-LSTM: combining CNN and LSTM to classify multi-class text in imbalanced news data,

    K. M. Hasib, S. Azam, A. Karim, A. A. Marouf, F. M. J. M. Shamrat, S. Montaha, K. C. Yeo, M. Jonkman, R. Alhajj, and J. G. Rokne, “MCNN-LSTM: combining CNN and LSTM to classify multi-class text in imbalanced news data,” IEEE Access, vol. 11, pp. 93 048–93 063, 2023. [Online]. ...

    2023

  25. [33]

    Malbert: Using transformers for cybersecurity and malicious software detection,

    A. Rahali and M. A. Akhloufi, “Malbert: Using transformers for cybersecurity and malicious software detection,” CoRR, vol. abs/2103.03806, 2021. [Online]. Available: https://arxiv.org/abs/ 2103.03806

    2021 arXiv

  26. [34]

    Android malware detection through a pre-trained model for code understanding,

    E. Garc ´ıa-Soto, A. Mart ´ın, J. Huertas-Tato, and D. Camacho, “Android malware detection through a pre-trained model for code understanding,” in Proceedings of the International Conference on Ubiquitous Computing and Ambient Intelligence (UCAmI), 2022, pp. 1055–1060. [Online...

    2022 doi

  27. [35]

    Multimodal fusion for android malware detection based on large pre-trained models,

    X. Li, L. Liu, Y. Liu, Y. Zhao, P . Zhang, and H. Liu, “Multimodal fusion for android malware detection based on large pre-trained models,” IEEE Trans. Software Eng. , vol. 51, no. 5, pp. 1569–1590, 2025. [Online]. Available: https://doi.org/10.1109/TSE.2025.3557577

    2025

  28. [36]

    Unsupervised anomaly-based malware detection using hardware features,

    A. Tang, S. Sethumadhavan, and S. J. Stolfo, “Unsupervised anomaly-based malware detection using hardware features,” in Proceedings of the 17th International Symposium on Research in Attacks, Intrusions and Defenses (RAID), 2014, pp. 109–129. [Online]. Available: https://doi.o...

    2014 doi

  29. [37]

    A contemporary survey of large language model assisted program analysis,

    J. Wang, T. Ni, W. Lee, and Q. Zhao, “A contemporary survey of large language model assisted program analysis,” CoRR, vol. abs/2502.18474, 2025. [Online]. Available: https: //doi.org/10.48550/arXiv.2502.18474 15

    2025 doi arXiv

  30. [38]

    Exploring llms for malware detection: Review, framework design, and countermeasure approaches,

    J. N. Al-Karaki, M. A. Khan, and M. Omar, “Exploring llms for malware detection: Review, framework design, and countermeasure approaches,” CoRR, vol. abs/2409.07587, 2024. [Online]. Available: https://doi.org/10.48550/arXiv.2409.07587

    2024 doi arXiv

  31. [39]

    From large to mammoth: A comparative evaluation of large language models in vulnerability detection,

    J. Lin and D. Mohaisen, “From large to mammoth: A comparative evaluation of large language models in vulnerability detection,” in Proceedings of the 32nd Annual Network and Distributed System Security Symposium (NDSS), 2025

    2025

  32. [40]

    A novel permission-based android malware detection system using feature selection based on linear regression,

    D. ¨O. Sahin, O. E. Kural, S. Akleylek, and E. Kilic ¸, “A novel permission-based android malware detection system using feature selection based on linear regression,” Neural Comput. Appl., vol. 35, no. 7, pp. 4903–4918, 2023. [Online]. Available: https://doi.org/10.1007/s0052...

    2023 doi

  33. [41]

    Malware detection in android based on dynamic analysis,

    T. Bhatia and R. Kaushal, “Malware detection in android based on dynamic analysis,” in Proceedings of the 2017 International Conference on Cyber Security and Protection of Digital Services (Cyber Security) , 2017, pp. 1–6. [Online]. Available: https://doi.org/10.1109/CyberSecP...

    2017

  34. [42]

    Dynamic android malware analysis with de-identification of personal identifiable informa- tion,

    C.-C. Hu, T.-H. Jeng, and Y.-M. Chen, “Dynamic android malware analysis with de-identification of personal identifiable informa- tion,” in ICCBD, 2020, pp. 30–36

    2020

  35. [43]

    Dynamic permissions based android malware detection using machine learning techniques,

    A. Mahindru and P . Singh, “Dynamic permissions based android malware detection using machine learning techniques,” in Proceedings of the 10th Innovations in Software Engineering Conference (ISEC) , 2017, pp. 202–210. [Online]. Available: http://dl.acm.org/citation.cfm?id=3021485

    2017

  36. [44]

    Dynamic mobile malware detection through system call-based image representation,

    R. Casolare, C. D. Dominicis, G. Iadarola, F. Martinelli, F. Mercaldo, and A. Santone, “Dynamic mobile malware detection through system call-based image representation,” Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications, vol. 12, no. 1, pp....

    2021 doi

  37. [45]

    Dynamic android malware category classification us- ing semi-supervised deep learning,

    S. Mahdavifar, A. F. A. Kadir, R. Fatemi, D. Alhadidi, and A. A. Ghorbani, “Dynamic android malware category classification us- ing semi-supervised deep learning,” in Proceedings of the IEEE Con- ference, 2020, pp. 515–522. [Online]. Available: https://doi.org/10. 1109/DASC-PI...

    2020

  38. [46]

    Dynamic detection of mobile malware using smartphone data and machine learning,

    J. Panman de Wit, D. Bucur, and J. van der Ham, “Dynamic detection of mobile malware using smartphone data and machine learning,” Digital Threats: Research and Practice (DTRAP) , vol. 3, no. 2, pp. 1–24, 2022

    2022

  39. [47]

    You are what the permissions told me! android malware detection based on hybrid tactics,

    H. Wang, W. Zhang, and H. He, “You are what the permissions told me! android malware detection based on hybrid tactics,” J. Inf. Secur. Appl. , vol. 66, p. 103159, 2022. [Online]. Available: https://doi.org/10.1016/j.jisa.2022.103159

    2022

  40. [48]

    Detection and preven- tion of android malware thru permission analysis,

    S. K. Tidke, P . P . Karde, and V . Thakare, “Detection and preven- tion of android malware thru permission analysis,” in ICCUBEA. IEEE, 2018, pp. 1–6

    2018

  41. [49]

    Hybrid sequence-based android malware detection using natural language processing,

    N. Zhang, J. Xue, Y. Ma, R. Zhang, T. Liang, and Y. Tan, “Hybrid sequence-based android malware detection using natural language processing,” Int. J. Intell. Syst. , vol. 36, no. 10, pp. 5770– 5784, 2021. [Online]. Available: https://doi.org/10.1002/int.22529

    2021 doi

  42. [50]

    Signature based malicious behavior detection in android,

    V . Sihag, A. Swami, M. Vardhan, and P . Singh, “Signature based malicious behavior detection in android,” in Proceedings of COMS2, Communications in Computer and Information Science , 2020, pp. 251–262. [Online]. Available: https://doi.org/10.1007/ 978-981-15-6648-6 20

    2020

  43. [51]

    A novel dynamic android malware detection system with ensemble learning,

    P . Feng, J. Ma, C. Sun, X. Xu, and Y. Ma, “A novel dynamic android malware detection system with ensemble learning,” IEEE Access , vol. 6, pp. 30 996–31 011, 2018. [Online]. Available: https://doi.org/10.1109/ACCESS.2018.2844349

    2018

  44. [52]

    Andro-dumpsys: Anti-malware system based on the similarity of malware creator and malware centric information,

    J. Jang, H. Kang, J. Woo, A. Mohaisen, and H. K. Kim, “Andro-dumpsys: Anti-malware system based on the similarity of malware creator and malware centric information,” Comput. Secur., vol. 58, pp. 125–138, 2016. [Online]. Available: https: //doi.org/10.1016/j.cose.2015.12.005

    2016 doi

  45. [53]

    A survey on concept drift adaptation,

    J. Gama, I. Zliobaite, A. Bifet, M. Pechenizkiy, and A. Bouchachia, “A survey on concept drift adaptation,” ACM Comput. Surv. , vol. 46, no. 4, pp. 44:1–44:37, 2014. [Online]. Available: https://doi.org/10.1145/2523813

    2014 doi

  46. [54]

    The concept drift problem in android malware detection and its solution,

    D. Hu, Z. Ma, X. Zhang, P . Li, D. Ye, and B. Ling, “The concept drift problem in android malware detection and its solution,” Secur. Commun. Networks , vol. 2017, pp. 4 956 386:1–4 956 386:13,

    2017

  47. [55]

    Is it overkill? analyzing feature-space concept drift in malware detectors,

    Z. Chen, Z. Zhang, Z. Kan, L. Yang, J. Cortellazzi, F. Pendlebury, F. Pierazzi, L. Cavallaro, and G. Wang, “Is it overkill? analyzing feature-space concept drift in malware detectors,” in Proceedings of the IEEE Symposium on Security and Privacy Workshops (SPW) , 2023, pp. 21–...

    2023

  48. [56]

    Corrigendum to concept drift and cross-device behavior: Challenges and implications for effective android malware detection computers & security, volume 120, 102757,

    A. Guerra-Manzanares, M. Luckner, and H. Bahsi, “Corrigendum to concept drift and cross-device behavior: Challenges and implications for effective android malware detection computers & security, volume 120, 102757,” Comput. Secur. , vol. 124, p. 102998, 2023. [Online]. Availab...

    2023

  49. [57]

    On the relativity of time: Implications and challenges of data drift on long-term effective android malware detection,

    A. Guerra-Manzanares and H. Bahsi, “On the relativity of time: Implications and challenges of data drift on long-term effective android malware detection,” Comput. Secur., vol. 122, p. 102835, 2022. [Online]. Available: https://doi.org/10.1016/j.cose. 2022.102835

    2022

  50. [58]

    Drift forensics of malware classifiers,

    T. Chow, Z. Kan, L. Linhardt, L. Cavallaro, D. Arp, and F. Pierazzi, “Drift forensics of malware classifiers,” in Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec) , 2023, pp. 197–207. [Online]. Available: https://doi.org/10.1145/3605764.3623918

    2023

  51. [59]

    Burning the adversarial bridges: Robust windows malware detection against binary-level mutations,

    A. Abusnaina, Y. Wang, S. S. Arora, K. Wang, M. Christodorescu, and D. Mohaisen, “Burning the adversarial bridges: Robust windows malware detection against binary-level mutations,” CoRR, vol. abs/2310.03285, 2023. [Online]. Available: https: //doi.org/10.48550/arXiv.2310.03285

    2023 doi arXiv

  52. [60]

    Systematically evaluating the robustness of ml-based iot malware detection systems,

    A. Abusnaina, A. Anwar, S. Alshamrani, A. Alabduljabbar, R. Jang, D. Nyang, and D. Mohaisen, “Systematically evaluating the robustness of ml-based iot malware detection systems,” in Proceedings of the 25th International Symposium on Research in Attacks, Intrusions and Defenses...

    2022

  53. [61]

    Fast & furious: On the modelling of malware detection as an evolving data stream,

    F. Ceschin, M. Botacin, H. M. Gomes, F. A. Pinage, L. S. Oliveira, and A. Gr ´egio, “Fast & furious: On the modelling of malware detection as an evolving data stream,” Expert Syst. Appl. , vol. 212, p. 118590, 2023. [Online]. Available: https://doi.org/10.1016/j.eswa.2022.118590

    2023

  54. [62]

    LAMD: context-driven android malware detection and classification with llms,

    X. Qian, X. Zheng, Y. He, S. Yang, and L. Cavallaro, “LAMD: context-driven android malware detection and classification with llms,” CoRR, vol. abs/2502.13055, 2025. [Online]. Available: https://doi.org/10.48550/arXiv.2502.13055

    2025 doi arXiv

  55. [63]

    Together ai – the ai acceleration cloud - fast inference, fine-tuning & training,

    Together, “Together ai – the ai acceleration cloud - fast inference, fine-tuning & training,” [Online; accessed 2025-06-23]. [Online]. Available: https://www.together.ai/

    2025

  56. [64]

    An lstm-based malware detection using transfer learning,

    Z. Fu, Y. Ding, and M. Godfrey, “An lstm-based malware detection using transfer learning,” Journal of Cybersecurity, vol. 3, no. 1, p. 11, 2021

    2021

  57. [65]

    An effectiveness analysis of transfer learning for the concept drift problem in malware detection,

    D. E. Garc ´ıa, N. DeCastro-Garc ´ıa, and ´A. L. M. Casta ˜neda, “An effectiveness analysis of transfer learning for the concept drift problem in malware detection,” Expert Syst. Appl. , vol. 212, p. 118724, 2023. [Online]. Available: https://doi.org/10.1016/j.eswa. 2022.118724

    2023

  58. [66]

    MORPH: towards automated concept drift adaptation for malware detection,

    M. T. Alam, R. Fieblinger, A. Mahara, and N. Rastogi, “MORPH: towards automated concept drift adaptation for malware detection,” CoRR, vol. abs/2401.12790, 2024. [Online]. Available: https://doi.org/10.48550/arXiv.2401.12790 Ahmed Sabbah received a Bachelor’s degree in compute...

    2018 doi arXiv

  59. [746]

    Available: https://www.usenix.org/conference/ usenixsecurity19/presentation/pendlebury

    [Online]. Available: https://www.usenix.org/conference/ usenixsecurity19/presentation/pendlebury

  60. [1144]

    Available: https://www.usenix.org/conference/ usenixsecurity23/presentation/chen-yizheng

    [Online]. Available: https://www.usenix.org/conference/ usenixsecurity23/presentation/chen-yizheng

  61. [2017]

    Available: https://doi.org/10.1155/2017/4956386

    [Online]. Available: https://doi.org/10.1155/2017/4956386

    2017 doi

  62. [2019]

    Available: https://doi.org/10.1109/ACCESS.2019

    [Online]. Available: https://doi.org/10.1109/ACCESS.2019. 2919796

    2019 doi

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.