Abstract Due to the continuous evolution of Android malware, machine learning-based malware detection systems face the challenge of performance degradation. To address this issue, active learning has been employed to retrain models with new labeled data. Traditionally, active learning relies on ground-truth labels, which are time-consuming to obtain. Although leveraging model-predicted pseudo-labels for model retraining offers a cost-effective alternative, incorrect pseudo-labels may lead to model self-contamination. To alleviate the annotation overhead during model retraining and mitigate the detrimental effects of erroneous pseudo-labels on active learning performance, we introduce a novel framework, PLCDroid. The framework incorporates a label correction mechanism when using pseudo-labels for model retraining. Specifically, we present a pseudo-label type recognition method (PTR) based on model uncertainty and confidence to identify incorrect pseudo-labels. On the basis of PTR, we design fine-grained correction strategies to refine pseudo-labels. Consequently, the proposed method mitigates pseudo-label errors, thereby improving malware detection performance under concept drift. Experimental results over a decade-long period demonstrate the effectiveness of our approach. In the retraining task, leveraging corrected pseudo-labels leads to a substantial performance gain. Specifically, the false negative rate decreases from 76.0% to 47.6% on average, corresponding to an improvement of 37.4% compared to the related pseudo label-based active learning method MORPH.

Android’s dominant market share has made it a prime target for malware attacks. Although machine learning-based detection systems have demonstrated effectiveness, they remain vulnerable to adversarial attacks, which modify samples to preserve malicious functionality while evading detection. Adversarial training is a prevalent defense strategy. However, generating effective adversarial examples for Android malware is challenging due to the complex mapping between feature and problem space. To address this, recent efforts have explored feature-space attacks constrained by statistical dependencies. Yet, such approaches inherently rely on large-scale datasets to achieve strong performance, and may fail to capture the underlying semantic relationships among features, like call associations. In this paper, we propose a novel method that incorporates semantic dependencies, i.e., API dependencies extracted from function call graphs of APKs. By leveraging these dependencies as domain constraints, our method preserves intrinsic call associations among features during perturbation. This leads to adversarial examples that more closely reflect realistic attack behaviors. Furthermore, a reinforcement learning-based mechanism is employed to enhance the evasive capability of the generated adversarial samples against detection models. The resulting adversarial samples are leveraged for adversarial training to enhance detector robustness. Experimental results demonstrate that the adversarial examples generated by our approach effectively enhance model robustness via adversarial training, yielding superior resilience in realistic adversarial environments. In adversarial attack scenarios, the proposed method attains the highest detection accuracy against problem-space attacks, surpassing the baseline model without adversarial training by 45.7% and 14.3%, respectively. Moreover, our method significantly reduces the average generation time by 83.5% compared to problem-space adversarial example generation approaches.

Many researchers have started to apply deep learning algorithms for source code vulnerability detection. However, the detection results of existing methods are still not accurate enough. Most of these methods treat the program source code directly as natural language. These methods may ignore the structural information specific to the program code, which is a key part of the semantics of the code composition. In this paper, we propose a novel vulnerability detection method named CEVulDet. First, we adopt centrality analysis to remove unimportant nodes from the PDG to obtain a new graph that preserves the important parts of the program. Second, we propose a new program semantic extraction method that acquires feature vectors to represent the semantic information of the program code and the graph edge information. It can locate the vulnerability trigger path with the aid of the model explanation technique. Finally, the extracted vectors obtained by our method are fed into the CNN to train a vulnerability detector. In our experiments, we evaluate the performance of CEVulDet on a dataset containing 33,360 functions with 12,303 vulnerable functions and 21,057 non-vulnerable functions. Experimental results show that CEVulDet far outperforms rule-based detectors and trumps the state-of-the-art deep learning-based detector. CEVulDet improved by 3.2%, 3.4%, 5.1% and 4.2% in terms of accuracy, precision, recall and F1 metrics, respectively.