Publication Type

Journal Article

Version

acceptedVersion

Publication Date

5-2026

Abstract

Android malware detection approaches commonly use APIs and permissions as features for classifying malware. However, since the release of the first Android operating system in 2008, the Android framework has undergone numerous version updates. The evolution of the Android framework over time has led to changes in APIs and permissions, including deprecations and replacements. These changes can result in inaccurate characterization of Android malware, thereby affecting performance of malware detectors. There is a lack of methods to mitigate the impact of Android framework evolution on malware detection. To fill this gap, we conduct a systematic study of the impact of Android framework evolution on APIs and permissions. We thenpropose a new representation of APIs and permissions that is robust against framework evolution. This new representation characterizes deprecated APIs / permissions and their corresponding replacements. Additionally, for class-level replacements, due to the absence of corresponding API replacement information, we use a LLM to assist in mining deprecation-replacement relationships. We also explore how to better utilize the LLM by applying it to the mining of deprecation-replacement pairs in framework evolution. We consider APIs / permissions with deprecation-replacement relationships as the same feature, as they typically perform the same or similar functions. We apply our proposed representation to improve the performance of four popular Android malware detectors, namely Drebin, Mamadroid, Xmal, and FAMCF. Our experiments focus on evaluating the performance of these malware detectors in the context of framework evolution, more specifically, over API levels 9 to 24. The results indicate that malware detectors utilizing Func features achieve statistically better F1 scores according to Wilcoxon rank-sum tests.

Keywords

Android, framework evolution, malware detection, concept drift

Discipline

Software Engineering

Research Areas

Cybersecurity

Areas of Excellence

Digital transformation

Publication

Empirical Software Engineering

Volume

31

Issue

3

First Page

1

Last Page

44

ISSN

1382-3256

Identifier

10.1007/s10664-025-10747-6

Publisher

Springer

Additional URL

https://doi.org/10.1007/s10664-025-10747-6

Download

Share

COinS