arXiv:2505.18551cs.CRcs.LG2025-05被引 10

构建首个覆盖12年安卓恶意软件演化的基准数据集,用于分析检测模型随时间退化问题。

LAMDA: A Longitudinal Android Malware Benchmark for Concept Drift Analysis

  • 构建跨12年、超百万样本的动态安卓恶意软件数据集,模拟真实环境分布变化。
  • 实测主流模型在长期使用中性能显著下降,验证概念漂移对检测效果的严重影响。
  • 适合研究模型泛化、可解释性及持续学习的科研人员和安全团队参考。

基于机器学习的恶意软件检测系统常忽视现实训练与测试数据分布的动态变化。由于安卓生态频繁更新、新型恶意软件家族不断出现以及良性与恶意应用持续涌现,数据分布会随时间发生显著偏移,即概念漂移,导致检测性能严重下降。现有数据集多已过时,时间跨度短、恶意样本家族少、样本量不足,难以系统评估概念漂移问题。为此,我们提出LAMDA——迄今最大且时间跨度最广的安卓恶意软件基准数据集,专为概念漂移分析设计。该数据集涵盖2013至2025年(不含2015年)共12年数据,包含超过100万份样本(约37%标记为恶意),覆盖1,380个恶意软件家族和15万个单例样本,真实反映安卓应用的演化特征。我们通过实证表明,标准机器学习模型在长期使用中性能显著下降,并分析了特征稳定性随时间的变化。作为目前最全面的安卓恶意软件数据集,LAMDA支持对时间漂移、泛化能力、可解释性及演变检测挑战的深入研究。数据与代码已公开:https://iqsec-lab.github.io/LAMDA/

原文摘要 · Abstract (English)

Machine learning (ML)-based malware detection systems often fail to account for the dynamic nature of real-world training and test data distributions. In practice, these distributions evolve due to frequent changes in the Android ecosystem, adversarial development of new malware families, and the continuous emergence of both benign and malicious applications. Prior studies have shown that such concept drift -- distributional shifts in benign and malicious samples, leads to significant degradation in detection performance over time. Despite the practical importance of this issue, existing datasets are often outdated and limited in temporal scope, diversity of malware families, and sample scale, making them insufficient for the systematic evaluation of concept drift in malware detection. To address this gap, we present LAMDA, the largest and most temporally diverse Android malware benchmark to date, designed specifically for concept drift analysis. LAMDA spans 12 years (2013-2025, excluding 2015), includes over 1 million samples (approximately 37% labeled as malware), and covers 1,380 malware families and 150,000 singleton samples, reflecting the natural distribution and evolution of real-world Android applications. We empirically demonstrate LAMDA's utility by quantifying the performance degradation of standard ML models over time and analyzing feature stability across years. As the most comprehensive Android malware dataset to date, LAMDA enables in-depth research into temporal drift, generalization, explainability, and evolving detection challenges. The dataset and code are available at: https://iqsec-lab.github.io/LAMDA/.

恶意软件检测概念漂移安卓安全数据集

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。