Abstract Due to the continuous evolution of Android malware, machine learning-based malware detection systems face the challenge of performance degradation. To address this issue, active learning has been employed to retrain models with new labeled data. Traditionally, active learning relies on ground-truth labels, which are time-consuming to obtain. Although leveraging model-predicted pseudo-labels for model retraining offers a cost-effective alternative, incorrect pseudo-labels may lead to model self-contamination. To alleviate the annotation overhead during model retraining and mitigate the detrimental effects of erroneous pseudo-labels on active learning performance, we introduce a novel framework, PLCDroid. The framework incorporates a label correction mechanism when using pseudo-labels for model retraining. Specifically, we present a pseudo-label type recognition method (PTR) based on model uncertainty and confidence to identify incorrect pseudo-labels. On the basis of PTR, we design fine-grained correction strategies to refine pseudo-labels. Consequently, the proposed method mitigates pseudo-label errors, thereby improving malware detection performance under concept drift. Experimental results over a decade-long period demonstrate the effectiveness of our approach. In the retraining task, leveraging corrected pseudo-labels leads to a substantial performance gain. Specifically, the false negative rate decreases from 76.0% to 47.6% on average, corresponding to an improvement of 37.4% compared to the related pseudo label-based active learning method MORPH.

Android’s dominant market share has made it a prime target for malware attacks. Although machine learning-based detection systems have demonstrated effectiveness, they remain vulnerable to adversarial attacks, which modify samples to preserve malicious functionality while evading detection. Adversarial training is a prevalent defense strategy. However, generating effective adversarial examples for Android malware is challenging due to the complex mapping between feature and problem space. To address this, recent efforts have explored feature-space attacks constrained by statistical dependencies. Yet, such approaches inherently rely on large-scale datasets to achieve strong performance, and may fail to capture the underlying semantic relationships among features, like call associations. In this paper, we propose a novel method that incorporates semantic dependencies, i.e., API dependencies extracted from function call graphs of APKs. By leveraging these dependencies as domain constraints, our method preserves intrinsic call associations among features during perturbation. This leads to adversarial examples that more closely reflect realistic attack behaviors. Furthermore, a reinforcement learning-based mechanism is employed to enhance the evasive capability of the generated adversarial samples against detection models. The resulting adversarial samples are leveraged for adversarial training to enhance detector robustness. Experimental results demonstrate that the adversarial examples generated by our approach effectively enhance model robustness via adversarial training, yielding superior resilience in realistic adversarial environments. In adversarial attack scenarios, the proposed method attains the highest detection accuracy against problem-space attacks, surpassing the baseline model without adversarial training by 45.7% and 14.3%, respectively. Moreover, our method significantly reduces the average generation time by 83.5% compared to problem-space adversarial example generation approaches.

Machine learning based mobile traffic classification has become a popular topic in recent years. As mobile traffic data is dynamic in nature, the static model has become ineffective for the task of classifying future traffic. This is known as the concept drift problem in data streams. To this end, this paper presents an adaptive mobile traffic classification method. Specifically, a method based on the fuzzy competence model is devised to detect concept drift, and a dynamic learning method is presented to update the classification model, so as to adapt to an ever-changing environment at an appropriate time. The concept drift detection method relies on the data distribution instead of the classification error rate. Furthermore, the weights of flow samples are dynamically updated and flow samples are resampled for training a new model when a concept drift is detected. Moreover, recently trained models are saved and used for classification in weighted voting. The weight of each model is updated according to the performance it obtains on the most recent flow samples. On mobile traffic data, experimental results show that our proposed method obtains lower classification error rate with less time consumption on updating models as compared to related methods designed for handling concept drift problems.

Mobile app traffic classification aims to automatically map mobile packets into apps. It has become an active task in mobile traffic engineering, and numerous algorithms have been proposed for this task, including machine learning, deep packet inspection methods. However, existing works mainly evaluate their methods on their own collected mobile traffic traces. There is no public benchmark data. The results in existing papers cannot be directly compared. This largely limits the development of mobile app traffic classification methods. This paper describes our Mobile Traffic Data(MTD): Android app traffic flow sample sets with ground truth. The goal of MTD is to advance the state-of-arts in mobile app traffic classification. For building MTD, we collected and annotated more than ten thousands of traffic flows using Mobilegt system. The popularity used flow features were also extracted to build flow samples for mobile traffic classification using machine learning. MTD sets have been shared in public. In addition, this paper provides the performance analysis of typical machine learning techniques on MTD, which can be served as the baseline results on this benchmark data.

Class imbalance problem has attracted a great attention in the field of ELM (extreme learning machine). Cost sensitive ELM was proposed to address class imbalance but it merely handled binary class imbalance and required to predefine misclassification costs subjectively. Boosting WELM has been presented to handle multi class imbalance, and performed well on improving the classification accuracy of the minority class, but it may excessively strengthen minority class samples and degrade the performance of the majority class. This paper presents a method named OCS-BWELM (objective cost-sensitive-boosting-WELM) to handle multi class imbalance. It takes boosting WELM as the basic learning algorithm. The misclassification costs are determined by the distributions of the given data rather than being defined subjectively. More specifically, it seeks optimal costs through maximizing the mutual information between real targets and prediction outputs. A specific feature of OCS-BWELM is that its costs are objective. Experiments are carried out to compare our method against existing ELM related works on handling multi class imbalance. Results show that our method could achieve a better performance balance between minority class and majority class than boosting WELM. And it outperforms others in terms of G-mean, F-score and F-measures of minority classes in most cases.

Mobile network traffic engineering and management activities require traffic traces where each packet or flow is associated with some ground truth regarding mobile app or protocol. This paper presents a system named mobilegt that collects mobile traffic and links the ground truth to it without rooting mobile devices. It consists of two elements: mobilegt client and mobilegt server. Mobilegt client iteratively probes monitored mobile nodes' kernel to obtain socket information on active TCP/UDP sessions. Mobilegt server captures the packets generated on monitored nodes at the aid of Virtual Private Network (VPN), and labels each packet/flow by exploring the association between socket and packet. Our preliminary experimental results show that mobilegt can tag more than 98% of bytes and 93% of flows on average without significantly affecting CPU load.