arXiv:2608. 03250v1 Announce Type: cross Abstract: The rapid advancement of modern technology has led to a significant increase in the use of smart devices, such as smartphones and tablets, resulting in the widespread adoption of mobile applications.
By Md Faisal Ahmed, Zarin Tasnim Biash, Abu Raihan Shakil, Ahmed Ann Noor Ryen, Arman Hossain, Faisal Bin Ashraf, Muhammad Iqbal Hossain
The paper introduces a new benchmark for assessing out-of-distribution robustness in graph-based Android malware classifiers, highlighting that current models drop up to 45% accuracy on unseen malware variants. It presents two scenarios—MalNet-Tiny-Common for covariate shift and MalNet-Tiny-Distinct for domain shift—and identifies a limitation in existing benchmarks that rely solely on structure-only function call graphs. To address this, the authors propose a semantic enrichment framework that augments graph topology with function-level attributes and LLM-based code embeddings, demonstrating that this data-centric approach improves robustness under distribution shift and complements model-based methods.
By Ngoc N. Tran, Anwar Said, Waseem Abbas, Tyler Derr, Xenofon D. Koutsoukos
The study evaluates pseudo‑labeling for semi‑supervised learning on Android malware attribution using six classifiers. Results show that the benefit of SSL varies strongly by classifier: SVM gains the most, LightGBM improves modestly, and Random Forest can be harmed at low label ratios. The approach particularly helps hard‑to‑classify families and achieves near‑optimal performance with about 800 labeled samples.
By Md Rafid Islam, Zahid Hasan, Hafiz Abdur Rahman
arXiv:2606. 26707v1 Announce Type: cross Abstract: Adversarial APKs are Android applications modified in the problem space to evade machine-learning malware detectors.
By Christian Scano, Diego Soi, Angelo Sotgiu, Luca Demetrio, Davide Maiorca, Giorgio Giacinto, Fabio Roli, Battista Biggio
arXiv:2507. 18313v2 Announce Type: replace Abstract: Malware evolves rapidly, forcing machine learning-based detectors to be continuously updated.
By Daniele Ghiani, Daniele Angioni, Giorgio Piras, Angelo Sotgiu, Luca Minnei, Srishti Gupta, Maura Pintor, Fabio Roli, Battista Biggio
HYDRA is a proactive Android malware drift adaptation framework that learns drift‑invariant representations from hierarchically structured data. It combines fine‑grained Control Flow Graphs and coarse‑grained Function Call Graphs to model applications, then applies a cross‑domain contrastive learning objective to align historical and new data distributions. Experiments on large‑scale, time‑ordered malware datasets show HYDRA achieves lower false negative and false positive rates than state‑of‑the‑art baselines while needing up to 87.5% fewer labeled samples.
By Han Chen, Hanchen Wang, Hongmei Chen, Lu Qin, Wenjie Zhang, Ying Zhang