Pith. sign in

REVIEW 4 major objections 5 minor 71 references

Understanding Concept Drift with Deprecated Permissions in Android Malware Detection

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Removing deprecated and restricted Android permissions leaves malware detection accuracy nearly unchanged, sometimes improves it, and makes concept drift easier to detect in year-to-year evaluations.

desk verdict Good question, solid year-to-year evaluation, but the KS-based drift detection is statistically invalid, so the headline claim about enhanced drift detection doesn't hold. read the letter →

arxiv 2507.22231 v1 pith:IPVLP7HL submitted 2025-07-29 cs.CR cs.LG

Ahmed Sabbah , Radi Jarrar , Samer Zein , David Mohaisen This is my paper
classification cs.CRcs.LG
keywords Androidmalwaredetectionpermission-basedfeaturesconceptdriftdeprecatedpermissionsrestrictedKolmogorov-Smirnovtestmachinelearningdeep
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the steady deprecation and restriction of Android permissions is a neglected source of concept drift in permission-based malware detection. Using 166 permission features from more than 70,000 malware and benign apps spanning 2008 to 2020, it trains Random Forest, CNN, and RNN models and evaluates them under three strategies: ignoring time, training on one year and testing on later years, and excluding deprecated, restricted, or not-for-use-by-third-party permissions. The central finding is that dropping these stale permission categories costs little accuracy—and in the CNN case slightly improves it—while making the year-to-year drift signal stronger under a Kolmogorov-Smirnov test. If correct, detection pipelines can prune obsolete permission features without sacrificing performance and can use the cleaner feature space to monitor when models are going stale.

What carries the argument

The central machinery is the year-to-year evaluation protocol combined with the Kolmogorov-Smirnov (KS) test. The paper maps each of 166 permissions to a metadata category (deprecated, restricted, or not-for-use-by-third-party) using the Android API level at which the permission was deprecated or restricted, then compares model accuracy and F1-score distributions across training years pairwise with a two-sample KS test. The KS test is a non-parametric comparison of two empirical cumulative distributions; a p-value below 0.05 marks a statistically significant distributional shift, i.e., concept drift. The exclusion strategy removes permission categories one at a time and re-runs the same protocol, which is what isolates the effect of stale features on both accuracy and drift visibility.

What would settle it

Recompute year-to-year drift with a multivariate feature-distribution statistic, such as maximum mean discrepancy, on the actual permission vectors with and without deprecated permissions; if exclusion does not increase detected drift, or if on a post-2021 dataset models trained without deprecated permissions lose more than a marginal amount of accuracy, the paper's central claim is contradicted.

Watch

Extended reading notes

Core claim

The discovery the authors report is that Android permissions remain highly effective features for malware detection, and that the systematic removal of deprecated, restricted, and not-for-use-by-third-party permissions has only a marginal effect on model accuracy. In the year-to-year setup—training on one year and testing on every later year—excluding these categories did not degrade Random Forest performance noticeably, slightly improved CNN accuracy in some configurations, and increased the number of statistically significant Kolmogorov-Smirnov comparisons, which the authors interpret as enhanced concept-drift detection. Balancing the dataset further improved accuracy and reduced low-accuracy instances while making drift more visible. The conclusion is that obsolete permissions are not load-bearing for classification accuracy, but their presence obscures the drift signal; removing them clarifies the temporal degradation that retraining schedules should address.

Load-bearing premise

The results depend on treating a Kolmogorov-Smirnov test applied to 13 accuracy values per year as a valid measure of concept drift, and on the chosen 0.50-0.94 accuracy band defining what counts as drift.

Editorial extensions

If this is right

  • Permission-based Android malware detection can drop deprecated and restricted permission features with little or no loss in accuracy, freeing feature-selection effort for other signals.
  • Concept drift in malware detection is driven not only by malware evolution but also by platform-level permission changes; dropping stale features makes year-to-year drift more detectable.
  • Dataset balancing should precede drift analysis, since imbalance masks drift and balancing increases the number of statistically significant year-to-year differences.
  • Training on older permission data and testing on newer data shows substantial accuracy degradation, so permission-based models need periodic retraining even when the classifier itself is unchanged.
  • Restricted permissions are more informative than deprecated ones: excluding restricted permissions caused the largest accuracy drops, indicating they carry signal that should be retained.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's drift measure applies the KS test to 13 yearly accuracy values per comparison, a small sample; an editorial extension is to check whether a multivariate drift statistic on the raw permission vectors, such as maximum mean discrepancy, reproduces the finding that exclusion sharpens drift.
  • Because the dataset ends in 2020, the paper's conclusions about deprecation may transfer to Android 14- and 15-era permissions only if the metadata mapping is updated; testing on post-2021 apps would show whether the marginal-impact result survives newer API changes.
  • The CNN accuracy improvement after excluding deprecated permissions hints that deep models may overfit to sparse, obsolete features; an implicit consequence is that feature pruning could act as a regularizer for other deep detectors.
  • The headline that exclusion improves drift detection may partly depend on the operationalization of drift as accuracy within a 0.50-0.94 band; re-running with a distributional distance on predictions would separate signal from threshold choice.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper investigates how deprecated and restricted Android permissions affect machine-learning malware detection and concept drift. Using the KronoDroid dataset with 166 permission features and RF/CNN/RNN models, the authors compare a non-temporal baseline with a year-to-year evaluation in which models are trained on data from one year and tested on subsequent years. They report that excluding deprecated or not-for-use-by-third-party permissions has marginal performance impact, sometimes improving CNN accuracy, and claim that exclusion enhances concept-drift detection via heatmap thresholds and Kolmogorov-Smirnov tests. Dataset balancing is reported to improve accuracy and increase the sensitivity of drift detection.

Significance. If the drift-enhancement claim were sound, the practical implication would be valuable: stale permission features could be dropped without meaningful accuracy loss, and drift visibility could be improved in production malware detectors. The paper's dataset construction and the effort to map permission deprecation/restriction metadata to API levels are substantial assets, and the paper addresses a genuinely under-explored aspect of Android malware detection. However, the central concept-drift measurement is methodologically invalid: the KS test is applied to tiny, non-i.i.d. vectors of accuracy values, and the drift threshold is derived from the very baseline it is meant to assess. The accuracy-impact claim is plausible but is presented without statistical support. For these reasons the paper's main novel contribution is not currently supported.

major comments (4)
  1. [§4.2.2, Fig. 8, Table 5] The KS test is applied to at most 12 per-test-year accuracy/F1 values for each training year. This does not test the stated null hypothesis of 'no significant difference in the accuracy and F1 score distributions between the two years being compared.' The observations are not i.i.d.: they are deterministic accuracies on different test years, and the same test-year values contribute to multiple training-year vectors, creating dependence. With n≈12 the p-values are coarsely quantized to a few discrete values (visible in Fig. 8 as values such as 0.008, 0.031, 0.100, 0.536), giving the test almost no resolving power. Moreover, a significant KS result comparing the accuracy profiles of two training years does not establish concept drift in P_t(X,Y) over test time. The p-value counts in Table 5 and the paper's claim that excluding permissions 'enhances concept drift detection' are therefore unsupported.
  2. [§4.2.1, Table 4, §3.5] The drift operationalization is circular. The paper defines drift as 'accuracy between 0.50 and 0.94,' where 0.94 is the average baseline accuracy from Table 3, computed with a random 80/20 split that ignores the temporal structure and uses all years in training. Consequently, cells in the year-to-year heatmap are labeled as 'drift' precisely because temporal generalization falls below a non-temporal baseline. The drift counts in Table 4 (red cells) are partly a re-description of the gap between the two evaluation designs rather than an independent measurement of concept drift. The conclusion that excluding deprecated/restricted permissions reduces or increases drift is thus not a finding about distributional change but about a threshold constructed from the baseline.
  3. [§4.1, Table 3] The central accuracy-impact claim that excluding deprecated and restricted permissions has only 'marginal' effect is based on point estimates from a single experimental run, with no confidence intervals, standard deviations, or significance tests. For example, RF-All versus RF-ED differs by 0.005 on the real dataset and 0.002 on the emulator, and CNN-All versus CNN-ED differs by 0.003. With deep learning models, random initialization and data shuffling can produce nontrivial run-to-run variance, so these small differences may be within noise. The paper should report variance across repeated runs or otherwise establish that the observed differences are stable.
  4. [§4.2.2, Table 5] The significance counts in Table 5 do not account for multiple testing. Each heatmap involves dozens of pairwise comparisons (up to 78 for a 13x13 grid), and using a per-comparison threshold of p≤0.05 guarantees a substantial number of false positives by chance. Without a multiple-comparison correction or a global test, the reported increases in significant p-values after balancing or exclusion are not interpretable as enhanced drift detection. In addition, Fig. 8 appears to label both axes as 'Train Year,' which obscures whether the comparison is between training years, test years, or a combination; the paper should clarify the exact comparison structure.
minor comments (5)
  1. [References] Reference [1] is mislabeled: the entry is titled 'Manifest.permission — android developers' but points to a Counterpoint Research market-share URL, and several references use '—' as the author placeholder; these should be corrected.
  2. [§3.1] The sentence 'In this work, this test was applied to a simulated dataset for concept drift detection [32]' appears to contradict the actual experiments, which use the KronoDroid dataset; please clarify the role of the simulated dataset or remove the statement.
  3. [§4.3] The research questions are labeled RQ-1/2/3 but the answers are labeled AQ-1/2/3; use consistent labels for clarity.
  4. [Fig. 8 caption] The heatmap axis labels are confusing: the x-axis and y-axis both read 'Train Year,' and the caption does not explain the pairwise comparison structure; please revise the figure and caption.
  5. [Fig. 2 caption] The caption 'Android 14 and 15 (2023 and 2024) were removed due to the lack of space' is informal and should be rephrased as a proper editorial note or the figure should be adjusted.

Circularity Check

1 steps flagged · score 4.0 of 10

Partial circularity: the red-cell 'drift' criterion is defined as accuracy below the all-permission baseline (0.94), so the claim that excluding permissions enhances drift detection is partly a restatement of accuracy drops; the KS-test prong and the Table 3 accuracy comparisons are independent.

  1. self definitional [Section 4.2.1 ('Performance of Models Without KS Test'), criterion ①; Table 4 caption]
    "Based on accuracy and F1 score for all models that ignored the temporal factor, we calculated their averages for both accuracy and F1 score with all permissions, as presented in Tables 3 and considered as baseline. Any value greater than 0.50 and less than 0.94 is considered to exhibit drift in the testing year and is highlighted in red on the heatmap figures."

    The red 'drift' cells are defined as accuracy/F1 below the all-permission baseline (0.94), and Table 4's caption confirms: 'Red indicates the count of testing years with decreased accuracy.' When an exclusion variant such as RF-ER drops from 0.954 to 0.933 (Table 3), its cells cross the threshold and are counted as drift. The paper then uses these red counts to conclude that excluding deprecated/restricted permissions 'increased concept drift' and 'enhanced the detection of drift patterns' (AQ-3). That conclusion is entailed by the chosen definition: any accuracy below the baseline is labeled drift, so a feature removal that lowers accuracy mechanically raises the red count. The count measures deviation from the paper's own baseline, not an independent change in P_t(X,Y).

full rationale

The central accuracy finding is self-contained: excluding deprecated, restricted, and not-for-use-by-third-party permissions and comparing accuracy/F1 on the Kronodroid data (Table 3) does not fit any parameter to the claimed outcome, and the observation that CNN accuracy improves with exclusion is an ordinary empirical comparison. The KS-test prong in §4.2.2 is also not circular, although applying a two-sample KS test to 12-point accuracy vectors raises statistical validity concerns that are correctness issues, not circularity. The one identifiable circularity is the threshold-based 'drift' criterion in §4.2.1: 'drift' is operationalized as accuracy below the all-permission baseline (0.94), so the red-cell counts in Table 4 are, by construction, counts of accuracy drops relative to the paper's own baseline. Using those counts to support the claim that exclusion 'enhanced the detection of concept drift' partially reduces to the definition rather than to an independent measurement of distribution shift. The paper does contain a self-citation ([63], with co-author Mohaisen), but it appears only in Related Work and is not load-bearing. Overall, the performance-impact claim is independent, while the drift-enhancement claim has a moderately self-referential component.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new entities. It relies on the Kronodroid dataset, external Android metadata, and an ad hoc drift operationalization. The main free parameters are the drift thresholds and the KS significance level, which are chosen by hand rather than derived from external benchmarks.

free parameters (4)
  • drift_upper_threshold = 0.94
    Any year-to-year accuracy between 0.50 and 0.94 is counted as 'drift'. The value 0.94 is taken from the baseline model accuracy, making the drift definition dependent on the paper's own results.
  • drift_lower_threshold = 0.50
    Values below 0.50 are labeled as poor performance rather than drift. This split is chosen by the authors without a stated external justification.
  • ks_significance_level = 0.05
    Standard significance threshold used for the KS test, but applied here to accuracy distributions of size 13, where the test has very low power and many ties.
  • dl_hyperparameters = epochs=15, batch_size=15, validation_split=0.10, dropout=0.2, learning_rate=0.001
    Deep learning hyperparameters are chosen rather than fitted or tuned. They affect the reported accuracy but are not the focus of the scientific claim.
assumptions (4)
  • domain assumption The two-sample KS test is valid and meaningful when applied to vectors of 13 model accuracy values.
    The KS test assumes independent random samples from continuous distributions. Model accuracy values across related test years are correlated, and 13 points per group is too small for reliable inference. This assumption is invoked in Section 3.1 and Section 4.2.2.
  • domain assumption Kronodroid labels and year assignments are correct and reflect real-world temporal periods.
    The entire year-to-year analysis depends on the dataset's year labels. This is stated in Section 3.2 through the dataset description.
  • domain assumption The Android permission metadata collected from the official website correctly maps each permission to its deprecation or restriction API level.
    The authors manually built the D/R/N categories from external Android documentation. If this mapping is wrong, the exclusion analysis is invalid. This is described in Section 3.3.
  • ad hoc to paper Any accuracy value between 0.50 and 0.94 indicates concept drift.
    This criterion is introduced in Section 4.2.1 and is not justified by any external theory or benchmark. It defines the main 'drift count' outcome.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Understanding Concept Drift with Deprecated Permissions in Android Malware Detection." pith.science (2026). https://pith.science/paper/IPVLP7HL

@misc{pith2026250722231,
  author       = {Pith},
  title        = {Pith review of: Understanding Concept Drift with Deprecated Permissions in Android Malware Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IPVLP7HL}},
  note         = {Machine review of arXiv:2507.22231}
}
read the original abstract

Permission analysis is a widely used method for Android malware detection. It involves examining the permissions requested by an application to access sensitive data or perform potentially malicious actions. In recent years, various machine learning (ML) algorithms have been applied to Android malware detection using permission-based features and feature selection techniques, often achieving high accuracy. However, these studies have largely overlooked important factors such as protection levels and the deprecation or restriction of permissions due to updates in the Android OS -- factors that can contribute to concept drift. In this study, we investigate the impact of deprecated and restricted permissions on the performance of machine learning models. A large dataset containing 166 permissions was used, encompassing more than 70,000 malware and benign applications. Various machine learning and deep learning algorithms were employed as classifiers, along with different concept drift detection strategies. The results suggest that Android permissions are highly effective features for malware detection, with the exclusion of deprecated and restricted permissions having only a marginal impact on model performance. In some cases, such as with CNN, accuracy improved. Excluding these permissions also enhanced the detection of concept drift using a year-to-year analysis strategy. Dataset balancing further improved model performance, reduced low-accuracy instances, and enhanced concept drift detection via the Kolmogorov-Smirnov test.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

71 extracted references · 45 canonical work pages

  1. [1]

    Manifest.permission — android developers,

    —, “Manifest.permission — android developers,” https://www.counterpointresearch.com/insights/ global-smartphone-os-market-share, 2025

    work page 2025

  2. [2]

    Permissions on android android developers,

    ——, “Permissions on android android developers,” https: //developer.android.com/guide/topics/permissions/overview, 2025

    work page 2025

  3. [3]

    A comprehensive review on permissions-based android malware detection,

    Y. Sharma and A. Arora, “A comprehensive review on permissions-based android malware detection,”Int. J. Inf. Sec., vol. 23, no. 3, pp. 1877–1912, 2024. [Online]. Available: https://doi.org/10.1007/s10207-024-00822-2

    work page doi:10.1007/s10207-024-00822-2 1912

  4. [4]

    An evaluation of the google chrome extension security architecture,

    N. Carlini, A. P . Felt, and D. Wagner, “An evaluation of the google chrome extension security architecture,” inUSENIX Security Sym- posium, 2012, pp. 97–111

    work page 2012

  5. [5]

    Understanding the bad development practices of android custom permissions in the wild,

    X. Zhang, Z. Yu, X. Li, C. Zhang, C. Sun, N. Zhang, and R. H. Deng, “Understanding the bad development practices of android custom permissions in the wild,”IEEE Transactions on Dependable and Secure Computing, pp. 1–17, 2025

    work page 2025

  6. [6]

    Permission based malware detection in android devices,

    S. Ilham, A. Ghadi, and A. B. Abdelhakim, “Permission based malware detection in android devices,” inSCA. ACM, 2018, pp. 83:1–83:6. [Online]. Available: https://doi.org/10.1145/3286606. 3286860

    doi:10.1145/3286606 2018

  7. [7]

    Android malware detection based on composition ratio of permission pairs,

    H. Kato, T. Sasaki, and I. Sasase, “Android malware detection based on composition ratio of permission pairs,”IEEE Access, vol. 9, pp. 130 006–130 019, 2021. [Online]. Available: https://doi.org/10.1109/ACCESS.2021.3113711 12

    arXiv 2021

  8. [8]

    A bayesian probability model for android malware detection,

    S. R. T. Mat, M. F. A. Razak, M. N. M. Kahar, J. M. Arif, and A. Firdaus, “A bayesian probability model for android malware detection,”ICT Express, 2022

    work page 2022

Show all 71 references
  1. [9]

    A novel permission-based android malware detection system using feature selection based on linear regression,

    D. ¨O. Sahin, O. E. Kural, S. Akleylek, and E. Kilic ¸, “A novel permission-based android malware detection system using feature selection based on linear regression,”Neural Comput. Appl., vol. 35, no. 7, pp. 4903–4918, 2023. [Online]. Available: https://doi.org/10.1007/s00521...

    2023 doi

  2. [10]

    An android malware detection approach based on static feature analysis using machine learning algorithms,

    A. S. Shatnawi, Q. Yassen, and A. A. Yateem, “An android malware detection approach based on static feature analysis using machine learning algorithms,” inANT, vol. 201, 2022, pp. 653–658. [Online]. Available: https://doi.org/10.1016/j.procs.2022.03.086

    2022 doi

  3. [11]

    Multi- view deep learning for zero-day android malware detection,

    S. Millar, N. McLaughlin, J. M. del Rinc ´on, and P . Miller, “Multi- view deep learning for zero-day android malware detection,” J. Inf. Secur. Appl., vol. 58, p. 102718, 2021. [Online]. Available: https://doi.org/10.1016/j.jisa.2020.102718

    2021

  4. [12]

    Comprehensive android malware detection based on federated learning architecture,

    W. Fang, J. He, W. Li, X. Lan, Y. Chen, T. Li, J. Huang, and L. Zhang, “Comprehensive android malware detection based on federated learning architecture,”IEEE Trans. Inf. Forensics Secur., vol. 18, pp. 3977–3990, 2023. [Online]. Available: https://doi.org/10.1109/TIFS.2023.3287395

    2023

  5. [13]

    Learning from streaming data with concept drift and imbalance: an overview,

    T. R. Hoens, R. Polikar, and N. V . Chawla, “Learning from streaming data with concept drift and imbalance: an overview,” Prog. Artif. Intell., vol. 1, no. 1, pp. 89–101, 2012. [Online]. Available: https://doi.org/10.1007/s13748-011-0008-0

    2012 doi

  6. [14]

    Learning in nonstationary environments: A survey,

    G. Ditzler, M. Roveri, C. Alippi, and R. Polikar, “Learning in nonstationary environments: A survey,”IEEE Comput. Intell. Mag., vol. 10, no. 4, pp. 12–25, 2015. [Online]. Available: https://doi.org/10.1109/MCI.2015.2471196

    2015

  7. [15]

    Characterizing concept drift,

    G. I. Webb, R. Hyde, H. Cao, H. Nguyen, and F. Petitjean, “Characterizing concept drift,”Data Min. Knowl. Discov., vol. 30, no. 4, pp. 964–994, 2016. [Online]. Available: https: //doi.org/10.1007/s10618-015-0448-4

    2016 doi

  8. [16]

    Ensemble learning for data stream analysis: A survey,

    B. Krawczyk, L. L. Minku, J. Gama, J. Stefanowski, and M. Wozniak, “Ensemble learning for data stream analysis: A survey,”Inf. Fusion, vol. 37, pp. 132–156, 2017. [Online]. Available: https://doi.org/10.1016/j.inffus.2017.02.004

    2017 doi

  9. [17]

    From concept drift to model degradation: An overview on performance-aware drift detectors,

    F. Bayram, B. S. Ahmed, and A. Kassler, “From concept drift to model degradation: An overview on performance-aware drift detectors,”Knowl. Based Syst., vol. 245, p. 108632, 2022. [Online]. Available: https://doi.org/10.1016/j.knosys.2022.108632

    2022

  10. [18]

    The concept drift problem in android malware detection and its solution,

    D. Hu, Z. Ma, X. Zhang, P . Li, D. Ye, and B. Ling, “The concept drift problem in android malware detection and its solution,” Secur. Commun. Networks, vol. 2017, pp. 4 956 386:1–4 956 386:13,

    2017

  11. [19]

    Efficient concept drift handling for batch android malware detection models,

    B. Molina-Coronado, U. Mori, A. Mendiburu, and J. Miguel- Alonso, “Efficient concept drift handling for batch android malware detection models,”Pervasive Mob. Comput., vol. 96, p. 101849, 2023. [Online]. Available: https://doi.org/10.1016/j.pmcj. 2023.101849

    2023

  12. [20]

    MORPH: towards automated concept drift adaptation for malware detection,

    M. T. Alam, R. Fieblinger, A. Mahara, and N. Rastogi, “MORPH: towards automated concept drift adaptation for malware detection,”CoRR, vol. abs/2401.12790, 2024. [Online]. Available: https://doi.org/10.48550/arXiv.2401.12790

    2024 doi arXiv

  13. [21]

    Drift forensics of malware classifiers,

    T. Chow, Z. Kan, L. Linhardt, L. Cavallaro, D. Arp, and F. Pierazzi, “Drift forensics of malware classifiers,” inAISec. ACM, 2023, pp. 197–207. [Online]. Available: https://doi.org/10.1145/3605764.3623918

    2023

  14. [22]

    Securing android app markets via modeling and predicting malware spread between markets,

    G. Meng, M. Patrick, Y. Xue, Y. Liu, and J. Zhang, “Securing android app markets via modeling and predicting malware spread between markets,”IEEE Trans. Inf. Forensics Secur., vol. 14, no. 7, pp. 1944–1959, 2019. [Online]. Available: https://doi.org/10.1109/TIFS.2018.2889924

    1944

  15. [23]

    A survey of mobile malware in the wild,

    A. P . Felt, M. Finifter, E. Chin, S. Hanna, and D. A. Wagner, “A survey of mobile malware in the wild,” in SPSM. ACM, 2011, pp. 3–14. [Online]. Available: https: //doi.org/10.1145/2046614.2046618

    2011

  16. [24]

    Hybrid intelligent android malware detection using evolving support vector machine based on genetic algorithm and particle swarm optimization,

    W. Ali, “Hybrid intelligent android malware detection using evolving support vector machine based on genetic algorithm and particle swarm optimization,”IJCSNS, vol. 19, no. 9, p. 15, 2019

    2019

  17. [25]

    Android malware detection techniques in traditional and cloud computing platforms: A state-of-the-art survey,

    A. Vishnoi, P . Mishra, C. Negi, and S. K. Peddoju, “Android malware detection techniques in traditional and cloud computing platforms: A state-of-the-art survey,”Int. J. Cloud Appl. Comput., vol. 11, no. 4, pp. 113–135, 2021. [Online]. Available: https://doi.org/10.4018/IJCAC...

    2021 doi

  18. [26]

    Mules and permission laundering in android: Dissecting custom permissions in the wild,

    J. Gamba, ´A. Feal, E. Bl ´azquez, V . Bandara, A. Razaghpanah, J. Tapiador, and N. Vallina-Rodriguez, “Mules and permission laundering in android: Dissecting custom permissions in the wild,”IEEE Trans. Dependable Secur. Comput., vol. 21, no. 4, pp. 1801–1816, 2024. [Online]. ...

    2024

  19. [27]

    Incremental learning from noisy data,

    J. C. Schlimmer and R. H. Granger, “Incremental learning from noisy data,”Mach. Learn., vol. 1, no. 3, pp. 317–354, 1986. [Online]. Available: https://doi.org/10.1023/A:1022810614389

    1986 doi

  20. [28]

    Concept drift adaptation methods under the deep learning framework: A literature review,

    Q. Xiang, L. Zi, X. Cong, and Y. Wang, “Concept drift adaptation methods under the deep learning framework: A literature review,” Applied Sciences, vol. 13, no. 11, p. 6515, 2023

    2023

  21. [29]

    Activitymanager — api reference — android developers,

    —, “Activitymanager — api reference — android developers,” https://developer.android.com/reference/android/app/ActivityManager, 3 2025

    2025

  22. [30]

    Privacy changes in android 10 — android developers,

    ——, “Privacy changes in android 10 — android developers,” https://developer.android.com/about/versions/10/privacy/changes, 03 2025

    2025

  23. [31]

    A survey on concept drift adaptation,

    J. Gama, I. Zliobaite, A. Bifet, M. Pechenizkiy, and A. Bouchachia, “A survey on concept drift adaptation,”ACM Comput. Surv., vol. 46, no. 4, pp. 44:1–44:37, 2014. [Online]. Available: https://doi.org/10.1145/2523813

    2014 doi

  24. [32]

    Concept drift detection based on kolmogorov–smirnov test,

    Z. Wang and W. Wang, “Concept drift detection based on kolmogorov–smirnov test,” inArtificial Intelligence in China. Sin- gapore: Springer Singapore, 2020, pp. 273–280

    2020

  25. [33]

    Kronodroid: Time-based hybrid-featured dataset for effective android malware detection and characterization,

    A. Guerra-Manzanares, H. Bahsi, and S. N ˜omm, “Kronodroid: Time-based hybrid-featured dataset for effective android malware detection and characterization,”Comput. Secur., vol. 110, p. 102399, 2021. [Online]. Available: https://doi.org/10.1016/j.cose. 2021.102399

    2021

  26. [34]

    Manifest.permission — android developers,

    —, “Manifest.permission — android developers,” https:// developer.android.com/reference/android/Manifest.permission, 2025

    2025

  27. [35]

    Small changes, big changes: An updated view on the android permission system,

    Y. Zhauniarovich and O. Gadyatskaya, “Small changes, big changes: An updated view on the android permission system,” in RAID, vol. 9854. Springer, 2016, pp. 346–367. [Online]. Available: https://doi.org/10.1007/978-3-319-45719-2 16

    2016 doi

  28. [36]

    Permission evolution in the android ecosystem,

    X. Wei, L. Gomez, I. Neamtiu, and M. Faloutsos, “Permission evolution in the android ecosystem,” inACSAC. ACM, 2012, pp. 31–40. [Online]. Available: https://doi.org/10.1145/2420950. 2420956

    2012 doi

  29. [37]

    Pscout: analyzing the android permission specification,

    K. W. Y. Au, Y. F. Zhou, Z. Huang, and D. Lie, “Pscout: analyzing the android permission specification,” inCCS. ACM, 2012, pp. 217–228. [Online]. Available: https://doi.org/10.1145/2382196. 2382222

    2012 doi

  30. [38]

    Resolving the predicament of android custom permissions,

    G. S. Tuncay, S. Demetriou, K. Ganju, and C. A. Gunter, “Resolving the predicament of android custom permissions,” inNDSS. The Internet Society, 2018. [Online]. Avail- able: https://www.ndss-symposium.org/wp-content/uploads/ 2018/02/ndss2018 08-4 Tuncay paper.pdf

    2018

  31. [39]

    Modeling and enhancing android’s permission system,

    E. Fragkaki, L. Bauer, L. Jia, and D. Swasey, “Modeling and enhancing android’s permission system,” inESORICS, vol. 7459. Springer, 2012, pp. 1–18. [Online]. Available: https://doi.org/10.1007/978-3-642-33167-1 1

    2012 doi

  32. [40]

    Droidcap: OS support for capability-based permissions in android,

    A. Dawoud and S. Bugiel, “Droidcap: OS support for capability-based permissions in android,” inNDSS. The Internet Society, 2019. [Online]. Available: https://www.ndss-symposium.org/ndss-paper/ droidcap-os-support-for-capability-based-permissions-in-android/

    2019

  33. [41]

    Finding the missing piece: Permission specification analysis for android NDK,

    H. Zhou, H. Wang, S. Wu, X. Luo, Y. Zhou, T. Chen, and T. Wang, “Finding the missing piece: Permission specification analysis for android NDK,” inASE. IEEE, 2021, pp. 505–516. [Online]. Available: https://doi.org/10.1109/ASE51524.2021.9678843

    2021

  34. [42]

    Android custom permissions demystified: A comprehensive security evaluation,

    R. Li, W. Diao, Z. Li, S. Yang, S. Li, and S. Guo, “Android custom permissions demystified: A comprehensive security evaluation,” IEEE Trans. Software Eng., vol. 48, no. 11, pp. 4465–4484, 2022. [Online]. Available: https://doi.org/10.1109/TSE.2021.3119980

    2022

  35. [43]

    A tale of four gates - privilege escalation and permission bypasses on android through app components,

    A. Aldoseri, D. F. Oswald, and R. Chiper, “A tale of four gates - privilege escalation and permission bypasses on android through app components,” inESORICS, vol. 13555. Springer, 2022, pp. 233–251. [Online]. Available: https://doi.org/10.1007/978-3-031-17146-8 12

    2022 doi

  36. [44]

    50 ways to leak your data: An explo- ration of apps’ circumvention of the android permissions system,

    J. Reardon, ´A. Feal, P . Wijesekera, A. E. B. On, N. Vallina- Rodriguez, and S. Egelman, “50 ways to leak your data: An explo- ration of apps’ circumvention of the android permissions system,” login Usenix Mag., vol. 44, no. 4, 2019. [Online]. Available: https: //www.usenix.o...

    2019

  37. [45]

    Phyjacking: Physical input hijacking for zero-permission authorization attacks on 13 android,

    X. Wang, S. Shi, Y. Chen, and W. C. Lau, “Phyjacking: Physical input hijacking for zero-permission authorization attacks on 13 android,” inNDSS. The Internet Society, 2022. [Online]. Available: https://www.ndss-symposium.org/ndss-paper/auto-draft-187/

    2022

  38. [46]

    Pmdroid: Permission supervision for android advertising,

    X. Gao, D. Liu, H. Wang, and K. Sun, “Pmdroid: Permission supervision for android advertising,” inSRDS. IEEE Computer Society, 2015, pp. 120–129. [Online]. Available: https://doi.org/ 10.1109/SRDS.2015.41

    2015 doi

  39. [47]

    POSTER: bitheft: Stealing your secrets by bidirectional covert channel communication with zero-permission android application,

    J. Wu, Y. Wu, M. Yang, Z. Wu, T. Luo, and Y. Wang, “POSTER: bitheft: Stealing your secrets by bidirectional covert channel communication with zero-permission android application,” in SIGSAC. ACM, 2015, pp. 1690–1692. [Online]. Available: https://doi.org/10.1145/2810103.2810108

    2015

  40. [48]

    COVERT: compositional analysis of android inter-app permission leakage,

    H. Bagheri, A. Sadeghi, J. Garcia, and S. Malek, “COVERT: compositional analysis of android inter-app permission leakage,” IEEE Trans. Software Eng., vol. 41, no. 9, pp. 866–886, 2015. [Online]. Available: https://doi.org/10.1109/TSE.2015.2419611

    2015

  41. [49]

    Permission use analysis for vetting undesirable behaviors in android apps,

    Y. Zhang, M. Yang, Z. Yang, G. Gu, P . Ning, and B. Zang, “Permission use analysis for vetting undesirable behaviors in android apps,”IEEE Trans. Inf. Forensics Secur., vol. 9, no. 11, pp. 1828–1842, 2014. [Online]. Available: https://doi.org/10.1109/ TIFS.2014.2347206

    2014

  42. [50]

    Permlyzer: Analyzing permission usage in android applications,

    W. Xu, F. Zhang, and S. Zhu, “Permlyzer: Analyzing permission usage in android applications,” inISSRE. IEEE Computer Society, 2013, pp. 400–410. [Online]. Available: https://doi.org/10.1109/ISSRE.2013.6698893

    2013

  43. [51]

    revdroid: Code analysis of the side effects after dynamic permission revocation of android apps,

    Z. Fang, W. Han, D. Li, Z. Guo, D. Guo, X. S. Wang, Z. Qian, and H. Chen, “revdroid: Code analysis of the side effects after dynamic permission revocation of android apps,” inAsiaCCS. ACM, 2016, pp. 747–758. [Online]. Available: https://doi.org/10.1145/2897845.2897914

    2016

  44. [52]

    APER: evolution-aware runtime permission misuse detection for android apps,

    S. Wang, Y. Wang, X. Zhan, Y. Wang, Y. Liu, X. Luo, and S. Cheung, “APER: evolution-aware runtime permission misuse detection for android apps,” inICSE. ACM, 2022, pp. 125–137. [Online]. Available: https://doi.org/10.1145/3510003.3510074

    2022

  45. [53]

    Permdroid: automatically testing permission-related behaviour of android applications,

    S. Yang, Z. Zeng, and W. Song, “Permdroid: automatically testing permission-related behaviour of android applications,” inISSTA. ACM, 2022, pp. 593–604. [Online]. Available: https://doi.org/10.1145/3533767.3534221

    2022

  46. [54]

    Patdroid: permission- aware GUI testing of android,

    A. Sadeghi, R. Jabbarvand, and S. Malek, “Patdroid: permission- aware GUI testing of android,” inESEC/FSE. ACM, 2017, pp. 220–232. [Online]. Available: https://doi.org/10.1145/3106237. 3106250

    2017 doi

  47. [55]

    DPC: A dynamic permission control mechanism for android third-party libraries,

    F. Hsu, N. Liu, Y. Hwang, C. Liu, C. Wang, and C. Chen, “DPC: A dynamic permission control mechanism for android third-party libraries,”IEEE Trans. Dependable Secur. Comput., vol. 18, no. 4, pp. 1751–1761, 2021. [Online]. Available: https://doi.org/10.1109/TDSC.2019.2937925

    2021

  48. [56]

    Permpair: Android malware detection using permission pairs,

    A. Arora, S. K. Peddoju, and M. Conti, “Permpair: Android malware detection using permission pairs,”IEEE Trans. Inf. Forensics Secur., vol. 15, pp. 1968–1982, 2020. [Online]. Available: https://doi.org/10.1109/TIFS.2019.2950134

    1968

  49. [57]

    Enhancing android application security: A novel approach using droidxgb for malware detection based on permission analysis,

    P . Kumar and S. Singh, “Enhancing android application security: A novel approach using droidxgb for malware detection based on permission analysis,”Secur. Priv., vol. 7, no. 2, 2024. [Online]. Available: https://doi.org/10.1002/spy2.361

    2024 doi

  50. [58]

    Malpat: Mining patterns of malicious and benign android apps via permission- related apis,

    G. Tao, Z. Zheng, Z. Guo, and M. R. Lyu, “Malpat: Mining patterns of malicious and benign android apps via permission- related apis,”IEEE Trans. Reliab., vol. 67, no. 1, pp. 355–369, 2018. [Online]. Available: https://doi.org/10.1109/TR.2017.2778147

    2018

  51. [59]

    Multi-label classification for android malware based on active learning,

    Q. Qiao, R. Feng, S. Chen, F. Zhang, and X. Li, “Multi-label classification for android malware based on active learning,”IEEE Transactions on Dependable and Secure Computing, pp. 1–18, 2022

    2022

  52. [60]

    Transcend: Detecting concept drift in malware classification models,

    R. Jordaney, K. Sharad, S. K. Dash, Z. Wang, D. Papini, I. Nouretdinov, and L. Cavallaro, “Transcend: Detecting concept drift in malware classification models,” inUSENIX. USENIX Association, 2017, pp. 625–

    2017

  53. [61]

    Transcending TRANSCEND: revisiting malware classification in the presence of concept drift,

    F. Barbero, F. Pendlebury, F. Pierazzi, and L. Cavallaro, “Transcending TRANSCEND: revisiting malware classification in the presence of concept drift,” in43rd SP. IEEE, 2022, pp. 805–823. [Online]. Available: https://doi.org/10.1109/SP46214. 2022.9833659

    2022

  54. [62]

    Dream: Combating concept drift with explanatory detection and adaptation in malware classification,

    Y. He, J. Lei, Z. Qin, and K. Ren, “Dream: Combating concept drift with explanatory detection and adaptation in malware classification,” 2024. [Online]. Available: https: //arxiv.org/abs/2405.04095

    2024 arXiv

  55. [63]

    Exposing the limitations of machine learning for malware detection under concept drift,

    A. Abusnaina, A. Anwar, M. Saad, A. Alabduljabbar, R. Jang, S. Salem, and D. Mohaisen, “Exposing the limitations of machine learning for malware detection under concept drift,” inWISE, vol. 15437. Springer, 2024, pp. 273–289. [Online]. Available: https://doi.org/10.1007/978-98...

    2024 doi

  56. [64]

    Continuous learning for android malware detection,

    Y. Chen, Z. Ding, and D. A. Wagner, “Continuous learning for android malware detection,” inUSENIX. USENIX Association, 2023, pp. 1127–1144. [Online]. Available: https://www.usenix. org/conference/usenixsecurity23/presentation/chen-yizheng

    2023

  57. [65]

    Cluster analysis and concept drift detection in malware,

    A. Mishra and M. Stamp, “Cluster analysis and concept drift detection in malware,”CoRR, vol. abs/2502.14135, 2025. [Online]. Available: https://doi.org/10.48550/arXiv.2502.14135

    2025 doi

  58. [66]

    Revisiting concept drift in windows malware detection: Adaptation to real drifted malware with minimal samples,

    A. S. Li, A. Iyengar, A. Kundu, and E. Bertino, “Revisiting concept drift in windows malware detection: Adaptation to real drifted malware with minimal samples,” inNDSS. ISOC, 2025

    2025

  59. [67]

    Deep learning-driven malware classification with api call sequence analysis and concept drift handling,

    B. P . Gond and D. P . Mohapatra, “Deep learning-driven malware classification with api call sequence analysis and concept drift handling,” 2025. [Online]. Available: https: //arxiv.org/abs/2502.08679 Ahmed Sabbahreceived a Bachelor’s degree in computer science from An-Najah N...

    2025 arXiv

  60. [642]

    Available: https://www.usenix.org/conference/ usenixsecurity17/technical-sessions/presentation/jordaney

    [Online]. Available: https://www.usenix.org/conference/ usenixsecurity17/technical-sessions/presentation/jordaney

  61. [2016]

    He has over 20 years of academic ex- perience and has contributed as a software engi- neer to several management information system (MIS) projects since 2000

    He is currently an Associate Professor in the Department of Computer Science at Birzeit University. He has over 20 years of academic ex- perience and has contributed as a software engi- neer to several management information system (MIS) projects since 2000. His research inter...

    2018

  62. [2017]

    Available: https://doi.org/10.1155/2017/4956386

    [Online]. Available: https://doi.org/10.1155/2017/4956386

    2017 doi

  63. [2021]

    de- gree with the Department of Computer Science, Birzeit University

    He is currently working toward a Ph.D. de- gree with the Department of Computer Science, Birzeit University. His research interests include security, machine learning, software engineer- ing, and mobile malware analysis. Radi Jarrarreceived his B.Sc. in Computer In- formation ...

    2007

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.