arXiv:2605.24294cs.CRcs.AI2026-05

用强化学习动态调整安卓恶意软件检测,降低维护成本同时保持高精度。

Concept Drift Adaptation Using Self-Supervised and Reinforcement Learning In Android Malware Detection

论文配图:Concept Drift Adaptation Using Self-Supervised and Reinforcement Learning In Android Malware Detection
图 1 · 摘自论文原文
  • 通过自监督学习建立稳定特征表示,冻结编码器减少更新开销。
  • 在非平稳环境下,检测准确率保持高位,内存保留率达92%以上。
  • 适合需要长期运行且资源受限的移动端安全系统部署场景。

安卓恶意软件检测器在部署后常因概念漂移而性能下降,而每次完整重训练成本高昂。本文提出一种时间序列自适应维护框架,将维护过程建模为序列决策问题。初始化阶段通过自监督学习获取稳定潜在表示,冻结编码器后,在固定表示空间中测量潜在漂移,并使用可训练适配器与分类头进行轻量级下游适应。采用近端策略优化(PPO)控制器,根据检测器状态(当前效用、固定内存集上的保留率、潜在漂移指标及更新成本)选择低成本维护动作。在模拟器和真实安卓恶意软件数据集上,基于静态与动态特征,采用因果部署协议评估。结果表明,该强化学习控制器提供强成本感知的适应策略,在非平稳部署条件下持续保持领先性能,实现时序性能、内存保留率与维护成本的优良平衡。

原文摘要 · Abstract (English)

Android malware detectors often degrade after deployment because of concept drift, while full retraining at each maintenance step is costly. We propose a chronological adaptive maintenance framework that models deployment-time maintenance as a sequential decision problem. The framework learns a stable latent representation through self-supervised learning during initialization, freezes the encoder, measures latent drift in the fixed representation space, and performs lightweight downstream adaptation using a trainable adapter and classification head. A proximal policy optimization controller selects low-cost maintenance actions based on the detector state, including current utility, retention on a fixed memory set, latent drift indicators, and update cost. We evaluate the framework under a causal deployment-style protocol on emulator and real Android malware datasets with static and dynamic features. Results show that the RL controller provides a strong cost-aware adaptation strategy, consistently remaining among the top-performing policies while achieving a favorable balance between temporal performance, memory retention, and maintenance cost under non-stationary deployment conditions.

恶意软件检测强化学习概念漂移

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。