Concept Drift Adaptation Using Self-Supervised and Reinforcement Learning In Android Malware Detection

2026/05/22 by Ahmed Sabbah, Mohammad Kharma, Mohammad Alkhanafseh +3 · 1 voice
Computer Science · #cs.AI #cs.CR #cs.LG

paper · pdf · doi:10.48550/arxiv.2605.24294

Abstract

Android malware detectors often degrade after deployment because of concept drift, while full retraining at each maintenance step is costly. We propose a chronological adaptive maintenance framework that models deployment-time maintenance as a sequential decision problem. The framework learns a stable latent representation through self-supervised learning during initialization, freezes the encoder, measures latent drift in the fixed representation space, and performs lightweight downstream adaptation using a trainable adapter and classification head. A proximal policy optimization controller selects low-cost maintenance actions based on the detector state, including current utility, retention on a fixed memory set, latent drift indicators, and update cost. We evaluate the framework under a causal deployment-style protocol on emulator and real Android malware datasets with static and dynamic features. Results show that the RL controller provides a strong cost-aware adaptation strategy, consistently remaining among the top-performing policies while achieving a favorable balance between temporal performance, memory retention, and maintenance cost under non-stationary deployment conditions.

Citations

• DRMD: Deep Reinforcement Learning for Malware Detection under Concept Drift
• Empirical Evaluation of Concept Drift in ML-Based Android Malware Detection
• Regression-aware Continual Learning for Android Malware Detection
• ADAPT: A Pseudo-labeling Approach to Combat Concept Drift in Malware Detection
• MADCAT: Combating Malware Detection Under Concept Drift with Test-Time Adaptation
• LAMDA: A Longitudinal Android Malware Benchmark for Concept Drift Analysis
• Combating Concept Drift with Explanatory Detection and Adaptation for Android Malware Classification
• ActDroid: An active learning framework for Android malware detection
• MORPH: Towards Automated Concept Drift Adaptation for Malware Detection
• Efficient Concept Drift Handling for Batch Android Malware Detection Models
• Continuous Learning for Android Malware Detection
• Transcending Transcend: Revisiting Malware Classification in the\n Presence of Concept Drift
• TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time
• Proximal Policy Optimization Algorithms
• Human-level control through deep reinforcement learning
• A survey on concept drift adaptation
• Incremental learning from noisy data
• Reinforcement Learning: An Introduction

Discussions

• #cs.CR #cs.AI #cs.LG Origin | Interest | Match [bsky, 0 points, 0 comments]

Related

• DRMD: Deep Reinforcement Learning for Malware Detection under Concept Drift
• Efficient Concept Drift Handling for Batch Android Malware Detection Models
• Combating Concept Drift with Explanatory Detection and Adaptation for Android Malware Classification
• MADCAT: Combating Malware Detection Under Concept Drift with Test-Time Adaptation
• Learning Temporal Invariance in Android Malware Detectors