HYDRA: Proactive Android Malware Drift Adaptation via Hierarchical Graph Contrastive Learning
HYDRA uses hierarchical Android app graphs and contrastive learning to adapt malware detectors to concept drift with far fewer labels.
Researchers propose HYDRA, a proactive framework that models Android apps with control-flow and function-call graphs and aligns historical and new data through cross-domain contrastive learning. Pseudo-labels for unlabeled target samples pull similar applications together without adversarial training. On large time-ordered malware datasets, HYDRA reports lower false-negative and false-positive rates than baselines while using up to 87.5% fewer labeled samples.
- Combines control-flow and function-call graphs into one app model.
- Contrastive learning aligns historical and new malware distributions.
- Pseudo-labels replace unstable adversarial domain training.
- Reports up to 87.5% fewer labeled samples than baselines.
- Products
- Android
From the original article
1 min read at arxiv.orgConcept drift, driven by the rapid evolution of Android malware, severely degrades the performance of machine learning detectors. Current adaptation strategies are often reactive, responding only after performance has dropped and imposing a significant manual annotation burden, or they are proactive but rely on unstable adversarial training and incomplete, single-level graph representations.
By Han Chen · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.