用时间戳数据训练安卓恶意软件检测模型，提升真实场景下的准确率。
Self-Supervised Learning for Android Malware Detection on a Time-Stamped Dataset
- 基于时间戳构建数据集，避免模型因时间偏差误判。
- 自监督预训练+监督分类，实现98%准确率和89% F1值。
- 公开数据集与代码，助力恶意行为分析与可复现研究。
基于机器学习的安卓恶意软件检测器常受时间偏差影响：模型训练与评估未考虑应用的实际发布时间，导致准确率虚高且在真实场景中鲁棒性差。为此，我们构建了一个包含良性与恶意安卓应用的时间戳数据集，并引入时间戳验证流程以确保时间准确性。随后提出一种检测框架，采用自监督预训练方法Bootstrap Your Own Latent（BYOL）学习抗混淆特征表示，再进行监督分类。在时间感知评估下，该方法达到98%准确率与89% F1值。进一步通过VirusTotal与MITRE ATT&CK框架分析真阳性与假阴性案例，揭示恶意行为模式。为支持可复现性与后续创新，我们开源了数据集与源代码。
原文摘要 · Abstract (English)
Android malware detectors built with machine learning often suffer from temporal bias: models are trained and evaluated without respecting apps' actual release times, inflating accuracy and weakening real-world robustness. We address this by constructing a time-stamped dataset of benign and malicious Android apps and introducing a timestamp-verification procedure to ensure temporal accuracy. We then propose a detection framework that uses Bootstrap Your Own Latent (BYOL) for self-supervised pre-training to learn obfuscation-resilient representations, followed by supervised classification. Under time-aware evaluation, the method attains 98% accuracy and 89% F1. We further characterize malware behavior by analyzing true positives and false negatives using VirusTotal and the MITRE ATT&CK framework. To support reproducibility and further innovation, we release our dataset and source code.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。