ProtoMal: Prototype-Guided Dual-Branch Continual Learning for Robust Android Malware Detection

Traditional Android malware detection systems struggle to adapt to evolving threats without sacrificing performance on legacy families. To address this, we present ProtoMal, a dual-branch continual learning framework that achieves a fine-grained balance between stability and plasticity. The framework utilizes a frozen old branch for knowledge preservation and a trainable new branch for novel threat acquisition. A key contribution is our robust median-based prototype learning mechanism, which leverages centroids and outlier filtering to handle the high intra-class variability and label noise inherent in malware datasets. Experimental results across three large-scale benchmarks AMD, VirusShare, and VirusShareYears demonstrate that ProtoMal significantly curtails performance degradation and achieves highly competitive average accuracy. Most notably, the proposed framework demonstrates highly competitive model stability and yields robust anti-forgetting capabilities alongside current state-of-the-art incremental learning paradigms, maintaining particular resilience under severe concept drift.