Towards robust Android malware detection under concept drift and code obfuscation

Publication Type

Journal Article

Publication Date

8-2026

Abstract

With the annual increase of Android applications, numerous malware detection approaches are proposed. However, learning-based detection methods still face two critical challenges: (1) concept drift renders model aging, leading to significant performance degradation on new data; and (2) malicious developers employ obfuscation techniques, complicating detection. To address these challenges, we propose ASGDroid, which constructs an abstract call graph by keeping only sensitive APIs and their callers. This abstraction produces a simplified representation that maintains feature structural stability during application evolution, thereby reducing the impact of concept drift. This structural stability also enhances robustness against structural obfuscation, such as call indirection. To further enhance obfuscation resilience, we propose a sensitive-operation-aware API embedding method during the node representation stage, which improves robustness against renaming-based obfuscation. In addition, ASGDroid in-corporates permission features that are inherently difficult to obfuscate, further strengthening its resistance to obfuscation. Additionally, we design a malicious component localization algorithm that leverages the attention weights of sensitive APIs: it performs backward propagation over their k-hop callers in the raw call graph and identifies the top N most suspicious methods based on the malicious scores of these k-hop callers. Large-scale evaluation on 58,986 samples demonstrates ASGDroid’s robust detection accuracy under realistic time-aware and spatial-aware experimental settings, maintaining 80.95% AUT (Area Under Time) for F1-Score and achieving 9.81% better AUT than the best baseline. ASGDroid also demonstrates superior robustness against eleven obfuscation techniques, achieving 1.83% higher average Recall than the best baseline. In terms of malicious component localization, our method also outperforms the current state-of-the-art approaches by at least 18.30% in average F1-Score.

Keywords

Android Malware Detection, Concept Drift, Malicious Component Localization, Obfuscation, Static Analysis

Discipline

Artificial Intelligence and Robotics | Software Engineering

Research Areas

Information Systems and Management

Publication

IEEE Transactions on Software Engineering

First Page

1

Last Page

22

ISSN

0098-5589

Identifier

10.1109/TSE.2026.3725737

Publisher

Institute of Electrical and Electronics Engineers

Additional URL

https://doi.org/10.1109/TSE.2026.3725737

This document is currently not available here.

Share

COinS