# Efficient Concept Drift Handling for Batch Android Malware Detection Models

arXiv: https://arxiv.org/abs/2309.09807 · HTML: https://mlsanity.com/paper/2309.09807/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 41 references that are in the map.
- First posted on arXiv 18 Sep 2023.

## Builds on (most cited first, 13 of 13)

- [Learning under Concept Drift: A Review](https://mlsanity.com/paper/2004.05785/) (2020)
- [A review on outlier/anomaly detection in time series data](https://mlsanity.com/paper/2002.04236/) (2020)
- [TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time](https://mlsanity.com/paper/1807.07838/) (2018)
- [Characterizing Concept Drift](https://mlsanity.com/paper/1511.03816/) (2015)
- [From Concept Drift to Model Degradation: An Overview on Performance-Aware Drift Detectors](https://mlsanity.com/paper/2203.11070/) (2022)
- [Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Drift](https://mlsanity.com/paper/2010.03856/) (2020)
- [Continuous Learning for Android Malware Detection](https://mlsanity.com/paper/2302.04332/) (2023)
- [Survey of Machine Learning Techniques for Malware Analysis](https://mlsanity.com/paper/1710.08189/) (2017)
- [Context-aware, Adaptive and Scalable Android Malware Detection through Online Learning (extended version)](https://mlsanity.com/paper/1706.00947/) (2017)
- [MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models (Extended Version)](https://mlsanity.com/paper/1711.07477/) (2017)
- [Survey of Network Intrusion Detection Methods from the Perspective of the Knowledge Discovery in Databases Process](https://mlsanity.com/paper/2001.09697/) (2020)
- [Towards a Fair Comparison and Realistic Evaluation Framework of Android Malware Detectors based on Static Analysis and Machine Learning](https://mlsanity.com/paper/2205.12569/) (2022)
- [Don't Pick the Cherry: An Evaluation Methodology for Android Malware Detection Methods](https://mlsanity.com/paper/1903.10560/) (2019)

## Built on by (most cited first, 5 of 5)

- [Cluster Analysis and Concept Drift Detection in Malware](https://mlsanity.com/paper/2502.14135/) (2025)
- [Understanding Concept Drift with Deprecated Permissions in Android Malware Detection](https://mlsanity.com/paper/2507.22231/) (2025)
- [MADCAT: Combating Malware Detection Under Concept Drift with Test-Time Adaptation](https://mlsanity.com/paper/2505.18734/) (2025)
- [DeepTrust: Multi-Step Classification through Dissimilar Adversarial Representations for Robust Android Malware Detection](https://mlsanity.com/paper/2510.12310/) (2025)
- [Concept Drift Adaptation Using Self-Supervised and Reinforcement Learning In Android Malware Detection](https://mlsanity.com/paper/2605.24294/) (2026)

## Abstract (arXiv)

The rapidly evolving nature of Android apps poses a significant challenge to static batch machine learning algorithms employed in malware detection systems, as they quickly become obsolete. Despite this challenge, the existing literature pays limited attention to addressing this issue, with many advanced Android malware detection approaches, such as Drebin, DroidDet and MaMaDroid, relying on static models. In this work, we show how retraining techniques are able to maintain detector capabilities over time. Particularly, we analyze the effect of two aspects in the efficiency and performance of the detectors: 1) the frequency with which the models are retrained, and 2) the data used for retraining. In the first experiment, we compare periodic retraining with a more advanced concept drift detection method that triggers retraining only when necessary. In the second experiment, we analyze sampling methods to reduce the amount of data used to retrain models. Specifically, we compare fixed sized windows of recent data and state-of-the-art active learning methods that select those apps that help keep the training dataset small but diverse. Our experiments show that concept drift detection and sample selection mechanisms result in very efficient retraining strategies which can be successfully used to maintain the performance of the static Android malware state-of-the-art detectors in changing environments.