HYDRA: Proactive Android Malware Drift Adaptation via Hierarchical Graph Contrastive Learning

Android malware evolves rapidly, causing concept drift that severely degrades the performance of machine learning detectors. Existing adaptation strategies are either reactive—responding only after performance drops and requiring significant manual annotation—or proactive but reliant on unstable adversarial training and incomplete, single-level graph representations. To address these limitations, the authors propose HYDRA (Hybrid Drift Adaptation), a proactive framework that learns drift-invariant representations from hierarchically structured data. The core insight is that combining fine-grained and coarse-grained behavioral views enables more comprehensive and stable modeling of application semantics, while cross-domain contrastive learning aligns historical and new data distributions without complex adversarial objectives.

Extensive experiments on large-scale, time-ordered malware datasets demonstrate that HYDRA achieves substantially lower False Negative Rates (FNR) and False Positive Rates (FPR) than state-of-the-art baselines. Notably, HYDRA requires up to 87.5% fewer labeled samples while maintaining superior performance. This efficiency stems from its proactive adaptation and effective use of unlabeled target data via pseudo-labeling and contrastive alignment. The results confirm that the hybrid graph representation and cross-domain contrastive objective together yield robust drift adaptation.