# Self-Supervised Learning for Android Malware Detection on a Time-Stamped Dataset

arXiv: https://arxiv.org/abs/2604.23025 · HTML: https://mlsanity.com/paper/2604.23025/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 26 references that are in the map.
- First posted on arXiv 24 Apr 2026.

## Builds on (most cited first, 8 of 8)

- [Bootstrap your own latent: A new approach to self-supervised Learning](https://mlsanity.com/paper/2006.07733/) (2020)
- [TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time](https://mlsanity.com/paper/1807.07838/) (2018)
- [Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Drift](https://mlsanity.com/paper/2010.03856/) (2020)
- [Continuous Learning for Android Malware Detection](https://mlsanity.com/paper/2302.04332/) (2023)
- [Explainable AI for Android Malware Detection: Towards Understanding Why the Models Perform So Well?](https://mlsanity.com/paper/2209.00812/) (2022)
- [N-opcode Analysis for Android Malware Classification and Categorization](https://mlsanity.com/paper/1607.08149/) (2016)
- [Self-Supervised Vision Transformers for Malware Detection](https://mlsanity.com/paper/2208.07049/) (2022)
- [Contrastive Learning for Robust Android Malware Familial Classification](https://mlsanity.com/paper/2107.03799/) (2021)

## Abstract (arXiv)

Android malware detectors built with machine learning often suffer from temporal bias: models are trained and evaluated without respecting apps' actual release times, inflating accuracy and weakening real-world robustness. We address this by constructing a time-stamped dataset of benign and malicious Android apps and introducing a timestamp-verification procedure to ensure temporal accuracy. We then propose a detection framework that uses Bootstrap Your Own Latent (BYOL) for self-supervised pre-training to learn obfuscation-resilient representations, followed by supervised classification. Under time-aware evaluation, the method attains 98% accuracy and 89% F1. We further characterize malware behavior by analyzing true positives and false negatives using VirusTotal and the MITRE ATT&CK framework. To support reproducibility and further innovation, we release our dataset and source code.