Concept Drift Adaptation Using Self-Supervised and Reinforcement Learning In Android Malware Detection
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866918519436738560 |
|---|---|
| author | Sabbah, Ahmed Kharma, Mohammad Alkhanafseh, Mohammad Jarrar, Radi Zein, Samer Mohaisen, David |
| author_facet | Sabbah, Ahmed Kharma, Mohammad Alkhanafseh, Mohammad Jarrar, Radi Zein, Samer Mohaisen, David |
| contents | Android malware detectors often degrade after deployment because of concept drift, while full retraining at each maintenance step is costly. We propose a chronological adaptive maintenance framework that models deployment-time maintenance as a sequential decision problem. The framework learns a stable latent representation through self-supervised learning during initialization, freezes the encoder, measures latent drift in the fixed representation space, and performs lightweight downstream adaptation using a trainable adapter and classification head. A proximal policy optimization controller selects low-cost maintenance actions based on the detector state, including current utility, retention on a fixed memory set, latent drift indicators, and update cost. We evaluate the framework under a causal deployment-style protocol on emulator and real Android malware datasets with static and dynamic features. Results show that the RL controller provides a strong cost-aware adaptation strategy, consistently remaining among the top-performing policies while achieving a favorable balance between temporal performance, memory retention, and maintenance cost under non-stationary deployment conditions. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2605_24294 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Concept Drift Adaptation Using Self-Supervised and Reinforcement Learning In Android Malware Detection Sabbah, Ahmed Kharma, Mohammad Alkhanafseh, Mohammad Jarrar, Radi Zein, Samer Mohaisen, David Cryptography and Security Artificial Intelligence Machine Learning Android malware detectors often degrade after deployment because of concept drift, while full retraining at each maintenance step is costly. We propose a chronological adaptive maintenance framework that models deployment-time maintenance as a sequential decision problem. The framework learns a stable latent representation through self-supervised learning during initialization, freezes the encoder, measures latent drift in the fixed representation space, and performs lightweight downstream adaptation using a trainable adapter and classification head. A proximal policy optimization controller selects low-cost maintenance actions based on the detector state, including current utility, retention on a fixed memory set, latent drift indicators, and update cost. We evaluate the framework under a causal deployment-style protocol on emulator and real Android malware datasets with static and dynamic features. Results show that the RL controller provides a strong cost-aware adaptation strategy, consistently remaining among the top-performing policies while achieving a favorable balance between temporal performance, memory retention, and maintenance cost under non-stationary deployment conditions. |
| title | Concept Drift Adaptation Using Self-Supervised and Reinforcement Learning In Android Malware Detection |
| topic | Cryptography and Security Artificial Intelligence Machine Learning |
| url | https://arxiv.org/abs/2605.24294 |