# On Defending Against Label Flipping Attacks on Malware Detection Systems

arXiv: https://arxiv.org/abs/1908.04473 · HTML: https://mlsanity.com/paper/1908.04473/

## Key facts

- Cited by 22 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Aug 2019.

## Built on by (most cited first, 22 of 22)

- [Scaling Trends for Data Poisoning in LLMs](https://mlsanity.com/paper/2408.02946/) (2024)
- [Deep Learning for Android Malware Defenses: a Systematic Literature Review](https://mlsanity.com/paper/2103.05292/) (2021)
- [BadLabel: A Robust Perspective on Evaluating and Enhancing Label-noise Learning](https://mlsanity.com/paper/2305.18377/) (2023)
- [Threats and Defenses in Federated Learning Life Cycle: A Comprehensive Survey and Challenges](https://mlsanity.com/paper/2407.06754/) (2024)
- [The Hammer and the Nut: Is Bilevel Optimization Really Needed to Poison Linear Classifiers?](https://mlsanity.com/paper/2103.12399/) (2021)
- [Launching Adversarial Attacks against Network Intrusion Detection Systems for IoT](https://mlsanity.com/paper/2104.12426/) (2021)
- [BEAS: Blockchain Enabled Asynchronous & Secure Federated Machine Learning](https://mlsanity.com/paper/2202.02817/) (2022)
- [Active Learning Under Malicious Mislabeling and Poisoning Attacks](https://mlsanity.com/paper/2101.00157/) (2021)
- [A Novel Anomaly Detection Method for Multimodal WSN Data Flow via a Dynamic Graph Neural Network](https://mlsanity.com/paper/2202.10454/) (2022)
- [Fast Adversarial Label-Flipping Attack on Tabular Data](https://mlsanity.com/paper/2310.10744/) (2023)
- [On the Robustness of Random Forest Against Untargeted Data Poisoning: An Ensemble-Based Approach](https://mlsanity.com/paper/2209.14013/) (2022)
- [Adversarial Data Poisoning Attacks on Quantum Machine Learning in the NISQ Era](https://mlsanity.com/paper/2411.14412/) (2024)
- [Honest Score Client Selection Scheme: Preventing Federated Learning Label Flipping Attacks in Non-IID Scenarios](https://mlsanity.com/paper/2311.05826/) (2023)
- [Mitigating Label Flipping Attacks in Malicious URL Detectors Using Ensemble Trees](https://mlsanity.com/paper/2403.02995/) (2024)
- [ADAPT: A Pseudo-labeling Approach to Combat Concept Drift in Malware Detection](https://mlsanity.com/paper/2507.08597/) (2025)
- [SETTI: A Self-supervised Adversarial Malware Detection Architecture in an IoT Environment](https://mlsanity.com/paper/2204.07772/) (2022)
- [Manipulating Trajectory Prediction with Backdoors](https://mlsanity.com/paper/2312.13863/) (2023)
- [Robustness of Selected Learning Models under Label-Flipping Attack](https://mlsanity.com/paper/2501.12516/) (2025)
- [Prototype Guided Backdoor Defense](https://mlsanity.com/paper/2503.20925/) (2025)
- [Addressing The Devastating Effects Of Single-Task Data Poisoning In Exemplar-Free Continual Learning](https://mlsanity.com/paper/2507.04106/) (2025)
- [Online AutoML: Evaluating Poisoning Attacks on Cost-Utility Adversarial Training Defence Strategy for IoT Networks](https://mlsanity.com/paper/2610.05810/) (2026)
- [Space Over Statistic, Retraining Over Ranking: Auditing Training Labels Under Label-Only Backdoors](https://mlsanity.com/paper/2610.13051/) (2026)

## Abstract (arXiv)

Label manipulation attacks are a subclass of data poisoning attacks in adversarial machine learning used against different applications, such as malware detection. These types of attacks represent a serious threat to detection systems in environments having high noise rate or uncertainty, such as complex networks and Internet of Thing (IoT). Recent work in the literature has suggested using the K-Nearest Neighboring (KNN) algorithm to defend against such attacks. However, such an approach can suffer from low to wrong detection accuracy. In this paper, we design an architecture to tackle the Android malware detection problem in IoT systems. We develop an attack mechanism based on Silhouette clustering method, modified for mobile Android platforms. We proposed two Convolutional Neural Network (CNN)-type deep learning algorithms against this Silhouette Clustering-based Label Flipping Attack (SCLFA). We show the effectiveness of these two defense algorithms - Label-based Semi-supervised Defense (LSD) and clustering-based Semi-supervised Defense (CSD) - in correcting labels being attacked. We evaluate the performance of the proposed algorithms by varying the various machine learning parameters on three Android datasets: Drebin, Contagio, and Genome and three types of features: API, intent, and permission. Our evaluation shows that using random forest feature selection and varying ratios of features can result in an improvement of up to 19% accuracy when compared with the state-of-the-art method in the literature.