On the relativity of time: Implications and challenges of data drift on long-term effective android malware detection

Abderrahmane, 2019, Android malware detection based on system calls analysis and CNN classification, 1 Afonso, 2015, Identifying android malware using dynamically obtained features, J. Comput. Virol. Hack. Tech., 11, 9, 10.1007/s11416-014-0226-7 Aggarwal, 2015 Ahsan-Ul-Haque, 2018, Sequencing system calls for effective malware detection in android, 1 Allix, 2015, Are your training datasets yet relevant?, 51 Alzaylaee, 2017, Emulator vs. real phone: android malware detection using machine learning, 65 Alzaylaee, 2020, Dl-droid: deep learning based android malware detection using real devices, Comput. Secur., 89, 101663, 10.1016/j.cose.2019.101663 Amin, 2016, Behavioral malware detection approaches for android, 1 Android, 2021a. App manifest overview. https://developer.android.com/guide/topics/manifest/manifest-intro. Android, 2021b. Package index. https://developer.android.com/reference/packages. Arp, D., Quiring, E., Pendlebury, F., Warnecke, A., Pierazzi, F., Wressnegger, C., Cavallaro, L., Rieck, K., 2020. Dos and don’ts of machine learning in computer security. arXiv preprint arXiv:2010.09470 Arp, 2014, Drebin: effective and explainable detection of android malware in your pocket, vol. 14, 23 AV-Test, 2021. Malware. https://www.av-test.org/en/statistics/malware/. Barbero, F., Pendlebury, F., Pierazzi, F., Cavallaro, L., 2020. Transcending transcend: revisiting malware classification with conformal evaluation. arXiv preprint arXiv:2010.03856 Bhatia, 2017, Malware detection in android based on dynamic analysis, 1 Buchka, N., Kuzin, M., 2016. Attack on zygote: a new twist in the evolution of mobile threats. https://securelist.com/attack-on-zygote-a-new-twist-in-the-evolution-of-mobile-threats/74032/. Buczak, 2015, A survey of data mining and machine learning methods for cyber security intrusion detection, IEEE Commun. Surv. Tutor., 18, 1153, 10.1109/COMST.2015.2494502 Burguera, 2011, Crowdroid: behavior-based malware detection system for android, 15 Cai, 2020, Assessing and improving malware detection sustainability through app evolution studies, ACM Trans. Softw. Eng. Methodol. (TOSEM), 29, 1, 10.1145/3371924 Cai, 2020, A study of run-time behavioral evolution of benign versus malicious apps in android, Inf. Softw. Technol., 122, 106291, 10.1016/j.infsof.2020.106291 Cai, 2019, Droidcat: effective android malware detection and categorization via app-level profiling, IEEE Trans. Inf. Forensics Secur., 14, 1455, 10.1109/TIFS.2018.2879302 Cai, 2021, Jowmdroid: android malware detection based on feature weighting with joint optimization of weight-mapping and classifier parameters, Comput. Secur., 100, 102086, 10.1016/j.cose.2020.102086 Cai, 2021, Jowmdroid: android malware detection based on feature weighting with joint optimization of weight-mapping and classifier parameters, Comput. Secur., 100, 102086, 10.1016/j.cose.2020.102086 Canfora, 2015, Detecting android malware using sequences of system calls, 13 Casolare, 2021, Dynamic mobile malware detection through system call-based image representation, J. Wirel. Mob. Netw. Ubiquitous Comput. Dependable Appl., 12, 44 Da, 2016, Detection of android malware security on system calls, 974 Desnos, A., Gueguen, G., Bachmann, S., 2018. Androguard. https://androguard.readthedocs.io/en/latest/index.html. Dimjašević, 2016, Evaluation of android malware detection based on system calls, 1 Dr.Web, 2018. Doctor web: banking trojan android.bankbot.149.origin has become a rampant tool of cybercriminals. https://news.drweb.com/show/?i=11772. F-secure, 2021a. Trojan:android/droiddream.a. https://www.f-secure.com/v-descs/trojan_android_droiddream_a.shtml. F-secure, 2021b. Trojan:android/geinimi. https://www.f-secure.com/v-descs/trojan_android_geinimi.shtml. Feizollah, 2015, A review on feature selection in mobile malware detection, Digit. Invest., 13, 22, 10.1016/j.diin.2015.02.001 Feng, 2018, A novel dynamic android malware detection system with ensemble learning, IEEE Access, 6, 30996, 10.1109/ACCESS.2018.2844349 Ferrante, 2016, Spotting the malicious moment: characterizing malware behavior using dynamic features, 372 Frenklach, 2021, Android malware detection via an app similarity graph, Comput. Secur., 109, 102386, 10.1016/j.cose.2021.102386 Gama, 2014, A survey on concept drift adaptation, ACM Comput. Surv. (CSUR), 46, 1, 10.1145/2523813 Gao, 2021, Gdroid: android malware detection and classification with graph convolutional network, Comput. Secur., 106, 102264, 10.1016/j.cose.2021.102264 Google, 2008. Android market: now available for users. https://android-developers.googleblog.com/2008/10/android-market-now-available-for-users.html. Google, 2021. Google play protect. https://developers.google.com/android/play-protect. Guerra-Manzanares, 2021, Kronodroid: time-based hybrid-featured dataset for effective android malware detection and characterization, Comput. Secur., 102399, 10.1016/j.cose.2021.102399 Guerra-Manzanares, 2019, Differences in android behavior between real device and emulator: a malware detection perspective, 399 Guerra-Manzanares, 2022, Android malware concept drift using system calls: detection, characterization and challenges, Expert Syst. Appl., 117200, 10.1016/j.eswa.2022.117200 Guerra-Manzanares, 2022, Concept drift and cross-platform behavior: challenges and implications for effective android malware detection, Comput. Secur., 120, 102757, 10.1016/j.cose.2022.102757 Guerra-Manzanares, 2019, In-depth feature selection and ranking for automated detection of mobile malware, 274 Guerra-Manzanares, 2019, Time-frame analysis of system calls behavior in machine learning-based mobile malware detection, 1 Hei, 2021, Hawk: rapid android malware detection through heterogeneous graph attention networks, IEEE Trans. Neural Netw. Learn. Syst., 1, 10.1109/TNNLS.2021.3105617 Hou, 2016, Deep4maldroid: a deep learning framework for android malware detection based on Linux kernel system call graphs, 104 Irolla, 2018, The duplication issue within the drebin dataset, J. Comput. Virol. Hack. Tech., 14, 245, 10.1007/s11416-018-0316-z Islam, Z., 2021. Android malware on the rise, google’s os is more “interesting” to cybercriminals than apple IoS. https://www.techspot.com/news/91519-android-more-interesting-average-cybercriminal-than-ios-malware.html. Isohara, 2011, Kernel-based behavior analysis for android malware detection, 1011 Jaiswal, 2018, Android gaming malware detection using system call analysis, 1 Jang, 2014, Andro-profiler: anti-malware system based on behavior profiling of mobile malware, 737 Jiang, 2013 Johnson, J., 2021. Development of new android malware worldwide from june 2016 to march 2020. https://www.statista.com/statistics/680705/global-android-malware-volume/. Jordaney, 2017, Transcend: detecting concept drift in malware classification models, 625 Kapratwar, 2017, Static and dynamic analysis of android malware, 653 Kiss, 2016, Kharon dataset: android malware under a microscope, 1 Lei, 2019, Evedroid: event-aware android malware detection against model degrading for IoT devices, IEEE Internet Things J., 6, 6668, 10.1109/JIOT.2019.2909745 Lin, 2013, Identifying android malicious repackaged applications by thread-grained system call sequences, Comput. Secur., 39, 340, 10.1016/j.cose.2013.08.010 Lindorfer, 2015, Marvin: efficient and comprehensive mobile app classification through static and dynamic analysis, vol. 2, 422 Lipovsky, R., Stefanko, L., Branisa, G., 2017. Trends in android ransomware. https://www.welivesecurity.com/wp-content/uploads/2017/02/ESET_Trends_2017_in_Android_Ransomware.pdf. Liu, 2021, Research on unsupervised feature learning for android malware detection based on restricted boltzmann machines, Future Gener. Comput. Syst., 120, 91, 10.1016/j.future.2021.02.015 Lu, 2018, Learning under concept drift: a review, IEEE Trans Knowl Data Eng, 31, 2346 du Luxembourg, U., 2021. Androzoo - lists of apks. https://androzoo.uni.lu/lists. Mahindru, 2021, Mldroid-framework for android malware detection using machine learning techniques, Neural Comput. Appl., 33, 5183, 10.1007/s00521-020-05309-4 Malik, 2016, System call analysis of android malware families, Indian J. Sci. Technol., 9, 1, 10.17485/ijst/2016/v9i21/90273 Margara, 2018, 1 McLaughlin, 2017, Deep android malware detection, 301 Narayanan, 2016, Adaptive and scalable android malware detection through online learning, 2484 Naval, 2015, Employing program semantics for malware detection, IEEE Trans. Inf. Forensics Secur., 10, 2591, 10.1109/TIFS.2015.2469253 Onwuzurike, 2019, Mamadroid: detecting android malware by building Markov chains of behavioral models (extended version), ACM Trans. Privacy Secur. (TOPS), 22, 1, 10.1145/3313391 Pendlebury, 2019, {TESSERACT}: eliminating experimental bias in malware classification across space and time, 729 Rathore, 2021, Robust android malware detection system against adversarial attacks using q-learning, Inf. Syst. Front., 23, 867, 10.1007/s10796-020-10083-8 Saif, 2018, Deep belief networks-based framework for malware detection in android systems, Alex. Eng. J., 57, 4049, 10.1016/j.aej.2018.10.008 Samsung, 2021. About knox. https://www.samsungknox.com/en/about-knox. Saracino, 2018, Madam: effective and efficient behavior-based android malware detection and prevention, IEEE Trans. Dependable Secure Comput., 15, 83, 10.1109/TDSC.2016.2536605 Sasidharan, 2021, Prodroidan android malware detection framework based on profile hidden Markov model, Pervasive Mob. Comput., 72, 101336, 10.1016/j.pmcj.2021.101336 Sharma, 2021, Malicious application detection in android—A systematic literature review, Comput. Sci. Rev., 40, 100373, 10.1016/j.cosrev.2021.100373 Shipman, M., 2011. More bad news: two new pieces of android malware—plankton and yzhcsms. https://news.ncsu.edu/2011/06/wms-android-plankton/. Sihag, 2021, De-lady: deep learning based android malware detection using dynamic features, J. Internet Serv. Inf. Secur. (JISIS), 11, 34 Singh, 2017, Dynamic behavior analysis of android applications for malware detection, 1 Statista, 2021. Mobile operating system market share worldwide, July 2020–July 2021. https://gs.statcounter.com/os-market-share/mobile/worldwide. Surendran, 2020, A tan based hybrid model for android malware detection, J. Inf. Secur. Appl., 54, 102483 Tchakounté, 2013, System calls analysis of malwares on android, Int. J. Sci. Technol., 2, 669 Tong, 2017, A hybrid approach of mobile malware detection in android, J. Parallel Distrib. Comput., 103, 22, 10.1016/j.jpdc.2016.10.012 Vidal, 2017, Malware detection in mobile devices by analyzing sequences of system calls, World Acad. Sci., Eng. Technol., Int. J. Comput., Electr., Autom., Control Inf. Eng., 11, 594 Vinod, 2019, A machine learning based approach to detect malicious android apps using discriminant system calls, Future Gener. Comput. Syst., 94, 333, 10.1016/j.future.2018.11.021 Wahanggara, 2015, Malware detection through call system on android smartphone using vector machine method, 62 Wang, 2021, Android malware detection through machine learning on kernel task structures, Neurocomputing, 435, 126, 10.1016/j.neucom.2020.12.088 Wei, 2017, Deep ground truth analysis of current android malware, 252 Xiao, 2015, Two effective methods to detect mobile malware, vol. 1, 1041 Xiao, 2016, Identifying android malware with system call co-occurrence matrices, Trans. Emerg. Telecommun. Technol., 27, 675, 10.1002/ett.3016 Xiao, 2019, Android malware detection based on system call sequences and LSTM, Multimed. Tools Appl., 78, 3979, 10.1007/s11042-017-5104-0 Xu, 2019, Droidevolver: self-evolving android malware detection system, 47 Yu, R., 2013. Ginmaster : a case study in android malware. https://www.virusbulletin.com/conference/vb2013/abstracts/ginmaster-case-study-android-malware. Yu, 2013, On behavior-based detection of malware on android platform, 814 Yuan, 2014, Droid-sec: deep learning in android malware detection, 371 Zhang, 2020, Enhancing state-of-the-art classifiers with api semantics to detect evolved android malware, 757 Zhou, 2012, Dissecting android malware: characterization and evolution, 95 Zyblewski, 2021, Preprocessed dynamic classifier ensemble selection for highly imbalanced drifted data streams, Inf. Fusion, 66, 138, 10.1016/j.inffus.2020.09.004