Self-Supervised Learning for Android Malware Detection on a Time-Stamped Dataset

TL;DR

This paper presents a self-supervised learning framework using BYOL for Android malware detection on a time-stamped dataset, achieving high accuracy while addressing temporal bias.

Contribution

It introduces a time-aware dataset and a BYOL-based detection method that improves robustness against obfuscation and respects app release timelines.

Findings

Achieved 98% accuracy and 89% F1 score under time-aware evaluation.

Constructed a novel time-stamped Android app dataset.

Released dataset and source code for reproducibility.

Abstract

Android malware detectors built with machine learning often suffer from temporal bias: models are trained and evaluated without respecting apps' actual release times, inflating accuracy and weakening real-world robustness. We address this by constructing a time-stamped dataset of benign and malicious Android apps and introducing a timestamp-verification procedure to ensure temporal accuracy. We then propose a detection framework that uses Bootstrap Your Own Latent (BYOL) for self-supervised pre-training to learn obfuscation-resilient representations, followed by supervised classification. Under time-aware evaluation, the method attains 98% accuracy and 89% F1. We further characterize malware behavior by analyzing true positives and false negatives using VirusTotal and the MITRE ATT&CK framework. To support reproducibility and further innovation, we release our dataset and source code.