# ActDroid: An active learning framework for Android malware detection

arXiv: https://arxiv.org/abs/2401.16982 · HTML: https://mlsanity.com/paper/2401.16982/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 42 references that are in the map.
- First posted on arXiv 30 Jan 2024.

## Builds on (most cited first, 7 of 7)

- [River: machine learning for streaming data in Python](https://mlsanity.com/paper/2012.04740/) (2020)
- [Context-aware, Adaptive and Scalable Android Malware Detection through Online Learning (extended version)](https://mlsanity.com/paper/1706.00947/) (2017)
- [Adaptive and Scalable Android Malware Detection through Online Learning](https://mlsanity.com/paper/1606.07150/) (2016)
- [Identification of Significant Permissions for Efficient Android Malware Detection](https://mlsanity.com/paper/2103.00643/) (2021)
- [N-opcode Analysis for Android Malware Classification and Categorization](https://mlsanity.com/paper/1607.08149/) (2016)
- [Fast & Furious: Modelling Malware Detection as Evolving Data Streams](https://mlsanity.com/paper/2205.12311/) (2022)
- [DroidDissector: A Static and Dynamic Analysis Tool for Android Malware Detection](https://mlsanity.com/paper/2308.04170/) (2023)

## Built on by (most cited first, 2 of 2)

- [Label-efficient Training Updates for Malware Detection over Time](https://mlsanity.com/paper/2603.28396/) (2026)
- [Concept Drift Adaptation Using Self-Supervised and Reinforcement Learning In Android Malware Detection](https://mlsanity.com/paper/2605.24294/) (2026)

## Abstract (arXiv)

The growing popularity of Android requires malware detection systems that can keep up with the pace of new software being released. According to a recent study, a new piece of malware appears online every 12 seconds. To address this, we treat Android malware detection as a streaming data problem and explore the use of active online learning as a means of mitigating the problem of labelling applications in a timely and cost-effective manner. Our resulting framework achieves accuracies of up to 96%, requires as little of 24% of the training data to be labelled, and compensates for concept drift that occurs between the release and labelling of an application. We also consider the broader practicalities of online learning within Android malware detection, and systematically explore the trade-offs between using different static, dynamic and hybrid feature sets to classify malware.