PLCDroid: enhancing android malware detection by mitigating pseudo-label noise in the presence of concept drift

Abstract Due to the continuous evolution of Android malware, machine learning-based malware detection systems face the challenge of performance degradation. To address this issue, active learning has been employed to retrain models with new labeled data. Traditionally, active learning relies on ground-truth labels, which are time-consuming to obtain. Although leveraging model-predicted pseudo-labels for model retraining offers a cost-effective alternative, incorrect pseudo-labels may lead to model self-contamination. To alleviate the annotation overhead during model retraining and mitigate the detrimental effects of erroneous pseudo-labels on active learning performance, we introduce a novel framework, PLCDroid. The framework incorporates a label correction mechanism when using pseudo-labels for model retraining. Specifically, we present a pseudo-label type recognition method (PTR) based on model uncertainty and confidence to identify incorrect pseudo-labels. On the basis of PTR, we design fine-grained correction strategies to refine pseudo-labels. Consequently, the proposed method mitigates pseudo-label errors, thereby improving malware detection performance under concept drift. Experimental results over a decade-long period demonstrate the effectiveness of our approach. In the retraining task, leveraging corrected pseudo-labels leads to a substantial performance gain. Specifically, the false negative rate decreases from 76.0% to 47.6% on average, corresponding to an improvement of 37.4% compared to the related pseudo label-based active learning method MORPH.