The growing popularity of Android requires malware detection systems that can keep up with the pace of new software being released. According to a recent study, a new piece of malware appears online every 12 seconds. To address this, we treat Android malware detection as a streaming data problem and explore the use of active online learning as a means of mitigating the problem of labelling applications in a timely and cost-effective manner. Specifically, we develop a semi-supervised active learning framework that incrementally trains online learning models using only samples with low prediction confidence, while detecting concept drift and retraining the models when drift is observed. Our resulting framework achieves accuracies of up to 96% on a balanced dataset, requires as little as 24% of the training data to be labelled, and compensates for concept drift that occurs between the release and labelling of an application. We also consider the broader practicalities of online learning within Android malware detection, and systematically explore the trade-offs between using different static, dynamic and hybrid feature sets to classify malware. We find that features derived from static API calls lead to the best performing models, though models based around lower-dimensional permission and opcode feature sets provide a potentially more practical basis for deployment, with only a marginal deficit in accuracy. Dynamic and hybrid feature sets are found to significantly increase feature extraction costs with no net benefit to predictive performance.

It is estimated that around 70% of mobile phone users have an Android device. Due to this popularity, the Android operating system attracts a lot of malware attacks. The sensitive nature of data present on smartphones means that it is important to protect against these attacks. Classic signature-based detection techniques fall short when they come up against a large number of users and applications. Machine learning, on the other hand, appears to work well, and also helps in identifying zero-day attacks, since it does not require an existing database of malicious signatures. In this paper, we critically review past works that have used machine learning to detect Android malware. The review covers supervised, unsupervised, deep learning and online learning approaches, and organises them according to whether they use static, dynamic or hybrid features.