Scalable Android Malware Detection via Incremental Learning and Chi-Square-based Feature Reduction

The rapid evolution of Android malware requires adaptable detection systems that can retain historical knowledge while detecting newly emerging threats. Conventional models are challenged by catastrophic forgetting, overly static training, and are expensive to retrain. In response, an incremental learning framework for Android malware detection, with chi-squared-based feature selection and sequential training across heterogeneous datasets, is proposed. Seven models, including Naïve Bayes, Logistic Regression, Decision Tree, K-Nearest Neighbors (KNN), SVMs with linear and RBF kernels, and XGBoost, are compared on two Android malware datasets, with permission-based features that partially overlap. Each model used a balanced dataset during initial training (56,000 benign, 56,000 malware) named Permissions I and was then updated incrementally using an imbalanced dataset (31,381 malware 26,755 benign) named Permissions II (train) used for training in chunks of 1000 samples and finally tested on Permissions II (test) having 20000 samples (10000 malware, 10000 benign). Feature selection was performed using the SelectKBest with a chi-square score, based on which the top 40 permissions were selected for all models to ensure consistent dimensionality, reduce training time, and improve generalization. The experimental findings demonstrate that utilizing incremental training provides significant improvements to the Permissions II (test) dataset, with only minor degradations of the performance of the Permissions I (test) dataset. XGBoost classifier showed the best overall performance with a slight decline in accuracy in the Permissions I (test) dataset from 96.76% to 89.56% which is evident and very close to the highest shown among all models and increase in accuracy on the Permissions II (test) dataset from 77.54% to 91.93% which is highest among other models. The same is true for the Logistic Regression model and Decision Tree classifiers, which increased the accuracy on the Permissions II (test) dataset from 76.82% to 90.64% and from 73.85% to 90.71%, respectively. This approach provides a readily interpretable, scalable, and feasible Android malware detection in real-world scenarios without using highly complex models.