简单模型比复杂神经网络更有效，且可复现性关键。
R+R: Revisiting Static Feature-Based Android Malware Detection using Machine Learning
- 用严格方法评估六种模型在去重数据上的表现
- 树模型如XGBoost在去重后准确率显著高于神经网络
- 开源代码助力安全研究可复现，适合做检测基线
基于静态特征的机器学习安卓恶意软件检测因可扩展性和高效性仍具重要性。然而现有方法常忽视可复现性问题，如数据集重复、超参数调优不足及随机初始化方差，严重削弱实际效果。本文提出更严谨的模型选择与评估方法，基于Drebin和APIGraph两个常用数据集，在离线与持续主动学习设置下，评估六种不同复杂度的机器学习模型。分析表明，与普遍认知相反，经过充分调优的简单模型（特别是树模型如XGBoost）在去除重复样本后，始终优于更复杂的神经网络。为促进透明与可复现性，我们开源了可扩展的代码库，支持新模型与数据集集成，助力可复现的安全研究。
原文摘要 · Abstract (English)
Static feature-based Android malware detection using machine learning (ML) remains critical due to its scalability and efficiency. However, existing approaches often overlook security-critical reproducibility concerns, such as dataset duplication, inadequate hyperparameter tuning, and variance from random initialization. This can significantly compromise the practical effectiveness of these systems. In this paper, we systematically investigate these challenges by proposing a more rigorous methodology for model selection and evaluation. Using two widely used datasets, Drebin and APIGraph, we evaluate six ML models of varying complexity under both offline and continuous active learning settings. Our analysis demonstrates that, contrary to popular belief, well-tuned, simpler models, particularly tree-based methods like XGBoost, consistently outperform more complex neural networks, especially when duplicates are removed. To promote transparency and reproducibility, we open-source our codebase, which is extensible for integrating new models and datasets, facilitating reproducible security research.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。