Online Learning-Based Android Malware Detection Using API Call Graphs and Drift Detection: A Comparative Study

Abstract

The rapid growth and complexity of Android applications have made the platform a serious target for cybercriminals, posing substantial risks to mobile security and user data. Traditional malware detection models, although they have shown promise, can hardly be applied at run-time since they cannot adapt quickly enough to new malware variants and evolving attack methods. Such models, trained on preexisting data, suffer from performance degradation due to concept drift, where data distributions change over time as malware evolves. This paper presents an Online Learning-Based Android Malware Detection framework that systematically pairs various drift detection algorithms—such as ADWIN, DDM, and EDDM—with various machine learning models to identify the most effective combinations for maintaining detection accuracy in real-time. Our best-performing model achieved an accuracy of up to 96.01%.