Longitudinal Evaluation of Android Malware Detection Using Deep Learning Classifiers

The widespread use of Android applications has led to an increasing number of malicious variants, necessitating robust malware detection methods to enhance mobile platform security. Since Android malware and the operating system continue to evolve, designing resilient malware detection techniques that can adapt over time without frequent modifications or retraining presents a significant challenge. Nonetheless, malware authors continuously update their sample characteristics to evade detection, leading to changes in data distribution that directly impact the detection performance of machine learning models, a consideration largely absent in most academic work. In this study, we address the impact of this constant evolution by conducting a longitudinal evaluation. Our approach involves utilizing API call sequences extracted at different abstraction levels (e.g., package level, class level) by tracing the Call Graph structure to capture the order of API calls. We employ two well-established deep learning classifiers, CNN and RNN-LSTM, on a dataset comprising 80,000 Android apps. Through extensive experiments comparing API-level abstractions and classifiers, we aim to identify the most effective approach for real-world scenarios. The results of our empirical evaluation show that CNN offers better longitudinal performance than the RNN-LSTM.