It is well-known that malware constantly evolves so as to evade detection and
this causes the entire malware population to be non-stationary. Contrary to
this fact, prior works on machine learning based Android malware detection have
assumed that the distribution of the observed malware characteristics (i.e.,
features) do not change over time. In this work, we address the problem of
malware population drift and propose a novel online machine learning based
framework, named DroidOL to handle it and effectively detect malware. In order
to perform accurate detection, security-sensitive behaviors are captured from
apps in the form of inter-procedural control-flow sub-graph features using a
state-of-the-art graph kernel. In order to perform scalable detection and to
adapt to the drift and evolution in malware population, an online
passive-aggressive classifier is used.
In a large-scale comparative analysis with more than 87,000 apps, DroidOL
achieves 84.29% accuracy outperforming two state-of-the-art malware techniques
by more than 20% in their typical batch learning setting and more than 3% when
they are continuously re-trained. Our experimental findings strongly indicate
that online learning based approaches are highly suitable for real-world
malware detection.

本研究旨在解决恶意软件的不断进化使得传统基于机器学习的检测方法失效的问题，提出了一种新的在线学习框架 DroidOL，采用了过程间控制流子图特征和在线主动 - 被动分类器，在比较试验中，DroidOL 的准确率高达 84.29%，有效地检测了不断进化的恶意软件。