Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

LAMDA: A Longitudinal Android Malware Benchmark for Concept Drift Analysis

Md Ahsanul Haque, Ismail Hossain, Md Mahmuduzzaman Kamol, Md Jahangir Alam, Suresh Kumar Amalapuram, Sajedul Talukder, Mohammad Saidur Rahman

TL;DR

LAMDA tackles the real-world problem of concept drift in Android malware detection by introducing a longitudinal benchmark that spans 2013–2025 (excluding 2015) and encompasses over 1M APKs across 1,380 malware families. It constructs a static-feature representation based on Drebin features, labels data using VirusTotal consensus, and enriches samples with family labels via AVClass2, enabling both binary and multi-class analyses. The paper conducts extensive drift analyses including supervised learning degradation under AnoShift-style splits, feature-space and latent-space stability studies, and SHAP-based explanation drift, while comparing against API Graph to show LAMDA’s stronger drift signals. The contributions provide a robust platform for evaluating concept drift, generalization, explainability, and continual learning in evolving Android malware contexts, with practical implications for building more resilient detectors. LAMDA thus offers a scalable, reproducible resource to study long-term threat evolution, model adaptation, and reliable drift-aware defenses in real-world malware detection settings.

Abstract

Machine learning (ML)-based malware detection systems often fail to account for the dynamic nature of real-world training and test data distributions. In practice, these distributions evolve due to frequent changes in the Android ecosystem, adversarial development of new malware families, and the continuous emergence of both benign and malicious applications. Prior studies have shown that such concept drift -- distributional shifts in benign and malicious samples, leads to significant degradation in detection performance over time. Despite the practical importance of this issue, existing datasets are often outdated and limited in temporal scope, diversity of malware families, and sample scale, making them insufficient for the systematic evaluation of concept drift in malware detection. To address this gap, we present LAMDA, the largest and most temporally diverse Android malware benchmark to date, designed specifically for concept drift analysis. LAMDA spans 12 years (2013-2025, excluding 2015), includes over 1 million samples (approximately 37% labeled as malware), and covers 1,380 malware families and 150,000 singleton samples, reflecting the natural distribution and evolution of real-world Android applications. We empirically demonstrate LAMDA's utility by quantifying the performance degradation of standard ML models over time and analyzing feature stability across years. As the most comprehensive Android malware dataset to date, LAMDA enables in-depth research into temporal drift, generalization, explainability, and evolving detection challenges. The dataset and code are available at: https://iqsec-lab.github.io/LAMDA/.

LAMDA: A Longitudinal Android Malware Benchmark for Concept Drift Analysis

TL;DR

LAMDA tackles the real-world problem of concept drift in Android malware detection by introducing a longitudinal benchmark that spans 2013–2025 (excluding 2015) and encompasses over 1M APKs across 1,380 malware families. It constructs a static-feature representation based on Drebin features, labels data using VirusTotal consensus, and enriches samples with family labels via AVClass2, enabling both binary and multi-class analyses. The paper conducts extensive drift analyses including supervised learning degradation under AnoShift-style splits, feature-space and latent-space stability studies, and SHAP-based explanation drift, while comparing against API Graph to show LAMDA’s stronger drift signals. The contributions provide a robust platform for evaluating concept drift, generalization, explainability, and continual learning in evolving Android malware contexts, with practical implications for building more resilient detectors. LAMDA thus offers a scalable, reproducible resource to study long-term threat evolution, model adaptation, and reliable drift-aware defenses in real-world malware detection settings.

Abstract

Machine learning (ML)-based malware detection systems often fail to account for the dynamic nature of real-world training and test data distributions. In practice, these distributions evolve due to frequent changes in the Android ecosystem, adversarial development of new malware families, and the continuous emergence of both benign and malicious applications. Prior studies have shown that such concept drift -- distributional shifts in benign and malicious samples, leads to significant degradation in detection performance over time. Despite the practical importance of this issue, existing datasets are often outdated and limited in temporal scope, diversity of malware families, and sample scale, making them insufficient for the systematic evaluation of concept drift in malware detection. To address this gap, we present LAMDA, the largest and most temporally diverse Android malware benchmark to date, designed specifically for concept drift analysis. LAMDA spans 12 years (2013-2025, excluding 2015), includes over 1 million samples (approximately 37% labeled as malware), and covers 1,380 malware families and 150,000 singleton samples, reflecting the natural distribution and evolution of real-world Android applications. We empirically demonstrate LAMDA's utility by quantifying the performance degradation of standard ML models over time and analyzing feature stability across years. As the most comprehensive Android malware dataset to date, LAMDA enables in-depth research into temporal drift, generalization, explainability, and evolving detection challenges. The dataset and code are available at: https://iqsec-lab.github.io/LAMDA/.

Paper Structure

This paper contains 71 sections, 21 figures, 16 tables.

Table of Contents

  1. Introduction
  2. Contributions in the Appendices and Supplementary Materials.
  3. Related Work
  4. LAMDA Creation
  5. Label Assignment and Collection Strategy.
  6. Family Label Acquisition.
  7. Decompilation and Static Feature Extraction.
  8. Vectorization and Temporal Feature Alignment.
  9. Concept Drift Analysis
  10. Concept Drift Analysis with Supervised Learning
  11. Experimental Setting.
  12. Results.
  13. Visual Analysis of Concept Drift
  14. Visualization Setting.
  15. Analysis.
  16. ...and 56 more sections

Figures (21)

  • Figure 1: Temporal trends in malware family evolution.
  • Figure 2: F1-score over time across different temporal splits.
  • Figure 3: Jeffreys divergence heatmaps across years for LAMDA and API Graph datasets.
  • Figure 4: t-SNE projections showing feature space evolution for LAMDA and API Graph.
  • Figure 5: The distribution of feature stability scores for top 100 malware families. 58 families are common in both LAMDA ( green) and API Graph ( blue) datasets, and families marked as red labels along $x$-axis available in LAMDA with minimum family size criteria.
  • ...and 16 more figures