Geometry-Aware Risk-Guided Active Learning for Malware Concept Drift Adaptation

Abstract

Mobile malware evolution induces concept drift, degrading the performance of static supervised detectors. Concept Drift Adaptation with Active Learning (CDA-AL) mitigates this problem by querying informative samples for model updating, but existing methods still face two limitations. First, uncertainty-based selection measures prediction ambiguity without explicitly assessing consistency with previously learned representation structure, causing confidently misclassified drifted samples to be overlooked. Second, conventional retraining often treats labeled samples uniformly, providing insufficient emphasis on missed malware and samples near ambiguous benign-malicious boundaries. To address these limitations, we propose GRAD (Geometry-Aware Risk-Guided Active Drift Adaptation), a CDA-AL framework with three complementary modules. Geometry-Aware Drift-Risk Ranking uses residual deviations from locally estimated benign tangent spaces to prioritize potential misclassification risks. Hybrid active sample selection combines geometry-ranked risk candidates with uncertainty sampling under a fixed annotation budget. Boundary-Aware Retraining constructs Error Memory and Semantic Ambiguity Memory and applies targeted triplet constraints to correct missed malware and improve class separation. Experiments on two large-scale temporal malware datasets totaling over 460K samples show that GRAD achieves the best F1 performance on both datasets, improving F1 by 3.26% on APIGraph and 7.23% on AndroZoo, while reducing FNR by 39.15% and FPR by 72.50%, respectively. GRAD also shows no evidence of systematic catastrophic forgetting and reduces the number of long-lived malware samples by 12.5% on APIGraph.