mlsanityData to 14 Oct 2026

Understanding Concept Drift with Deprecated Permissions in Android Malware Detection

arXiv 2507.22231 ↗First posted 29 Jul 2025cs.CR cs.LGcited by 2

Not on the map. Why?

Abstract (arXiv)

Permission analysis is a widely used method for Android malware detection. It involves examining the permissions requested by an application to access sensitive data or perform potentially malicious actions. In recent years, various machine learning (ML) algorithms have been applied to Android malware detection using permission-based features and feature selection techniques, often achieving high accuracy. However, these studies have largely overlooked important factors such as protection levels and the deprecation or restriction of permissions due to updates in the Android OS -- factors that can contribute to concept drift. In this study, we investigate the impact of deprecated and restricted permissions on the performance of machine learning models. A large dataset containing 166 permissions was used, encompassing more than 70,000 malware and benign applications. Various machine learning and deep learning algorithms were employed as classifiers, along with different concept drift detection strategies. The results suggest that Android permissions are highly effective features for malware detection, with the exclusion of deprecated and restricted permissions having only a marginal impact on model performance. In some cases, such as with CNN, accuracy improved. Excluding these permissions also enhanced the detection of concept drift using a year-to-year analysis strategy. Dataset balancing further improved model performance, reduced low-accuracy instances, and enhanced concept drift detection via the Kolmogorov-Smirnov test.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 14 of its 90 references that are in the map. First posted on arXiv 29 Jul 2025.

Builds on

14 of 90 references.

References · 14

  1. 2015Characterizing Concept Driftcited by 94
  2. 2022From Concept Drift to Model Degradation: An Overview on Performance-Aware Drift Detectorscited by 83
  3. 2020Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Driftcited by 53
  4. 2023Continuous Learning for Android Malware Detectioncited by 33
  5. 2024Revisiting Concept Drift in Windows Malware Detection: Adaptation to Real Drifted Malware with Minimal Samplescited by 11
  6. 2024TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time (Extended Version)cited by 9
  7. 2024MORPH: Towards Automated Concept Drift Adaptation for Malware Detectioncited by 8
  8. 2024Combating Concept Drift with Explanatory Detection and Adaptation for Android Malware Classificationcited by 7
  9. 2023Efficient Concept Drift Handling for Batch Android Malware Detection Modelscited by 5
  10. 2022Aper: Evolution-Aware Runtime Permission Misuse Detection for Android Appscited by 4
  11. 2025Deep Learning-Driven Malware Classification with API Call Sequence Analysis and Concept Drift Handlingcited by 2
  12. 2025Cluster Analysis and Concept Drift Detection in Malwarecited by 2
2 more
  1. 2024Multi-label Classification for Android Malware Based on Active Learningcited by 1
  2. 2025Malware families discovery via Open-Set Recognition on Android manifest permissionscited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026FreeMOCA: Memory-Free Continual Learning for Malicious Code Analysiscited by 0
  2. 2026Adversarial Vulnerability Under Temporal Concept Drift: A Longitudinal Study of Android Malware Detectioncited by 0