PaperlayerView exact revision on arXiv

Source-linked AI summary

TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time

Feargus Pendlebury, Fabio Pierazzi, Roberto Jordaney, Johannes Kinder, Lorenzo Cavallaro

arXiv:1807.07838v4cs.CRcs.LG

TL;DR

Android malware classification results may be inflated by spatial and temporal experimental bias. TESSERACT enforces realistic evaluation constraints and reveals that published performance can decrease by up to 50% in practice.

  • Problem

    Android malware classifiers operate in evolving environments, but common evaluation settings can introduce temporal and spatial bias that limits evidence of real-world robustness.

  • Method

    TESSERACT applies spatio-temporal constraints, the AUT robustness metric, and tuning to evaluate malware classifiers under realistic conditions.

  • Results

    Up to 50%: performance can decrease in practice because of experimental bias when evaluating two Android malware classifiers on 129K applications.

  • Takeaways & Limitations

    TESSERACT can reveal true classifier performance and support robustness assessment for deployment scenarios where frequent labeling and retraining are costly.

  • Takeaways & Limitations

    The evaluation assumes Android malware constitutes around 10% of applications, although estimating this in-the-wild percentage is challenging.

Abstract

from arXiv · show

Is Android malware classification a solved problem? Published F1 scores of up to 0.99 appear to leave very little room for improvement. In this paper, we argue that results are commonly inflated due to two pervasive sources of experimental bias: "spatial bias" caused by distributions of training and testing data that are not representative of a real-world deployment; and "temporal bias" caused by incorrect time splits of training and testing sets, leading to impossible configurations. We propose a set of space and time constraints for experiment design that eliminates both sources of bias. We introduce a new metric that summarizes the expected robustness of a classifier in a real-world setting, and we present an algorithm to tune its performance. Finally, we demonstrate how this allows us to evaluate mitigation strategies for time decay such as active learning. We have implemented our solutions in TESSERACT, an open source evaluation framework for comparing malware classifiers in a realistic setting. We used TESSERACT to evaluate three Android malware classifiers from the literature on a dataset of 129K applications spanning over three years. Our evaluation confirms that earlier published results are biased, while also revealing counter-intuitive performance and showing that appropriate tuning can lead to significant improvements.

1 Introduction

The introduction argues that Android malware-classification results are inflated by spatial and temporal experimental bias, because common evaluations depart from real-world deployment conditions. It presents TESSERACT’s evaluation methodology as a response, including sounder experiment constraints and evidence that bias can substantially reduce practical performance.

  • Motivation: Android malware classifiers are often evaluated in settings that are not representative of real-world deployments.The paper focuses on Android malware because public, large-scale, timestamped data and reproducible algorithms are available.
  • Sources of Bias: Spatial bias concerns unrealistic goodware-to-malware ratios, while temporal bias arises from incorrect train-test splits and evolving malware.The goodware-to-malware ratio must be enforced consistently during testing, and prediction quality decays as malware evolves.
  • Contributions: The paper proposes constraints for sound experiment design to systematize evaluation bias in Android malware classification.The authors identify temporal bias from incorrect train-test splits and spatial bias from unrealistic dataset distributions.
  • Novelty: Unlike prior guidelines, the paper addresses temporal and spatial bias as sources of misleading results regardless of the evaluation metrics used.Prior work discussed security-evaluation challenges and guidelines but did not identify these two biases or quantify their impact on classifier performance.
  • Empirical Impact: 50%: performance can decrease by up to 50% in practice on a dataset of 129K apps with 10% malware because of experimental bias.This result was demonstrated for the DREBIN and MAMADROID classifiers, referred to as ALG1 and ALG2.

2 Android Malware Classification

This section establishes the Android malware classification setting by selecting reproducible baseline classifiers, characterizing realistic malware prevalence, and defining the AndroZoo dataset and time-aware splits used throughout the evaluation.

  • 2.1 Reference approaches: ALG1 is a linear SVM over high-dimensional binary features from lightweight static analysis, while ALG2 is a Random Forest using caller-callee relationships over Android API methods.Both recently published approaches were reimplemented because they were available and provided stable baselines.
  • 2.2 Malware prevalence: Android malware is a minority class, so unbiased experiments require a realistic malware-to-goodware ratio, potentially enforced by downsampling the majority class.The malware proportion can substantially affect classifier performance, and each malware domain has its own prevalence in the wild.
  • 2.2 Malware prevalence: 6%–18.8% is the reported Android malware prevalence range across sources, including approximately 6% from an industrial player, around 8% from AndRadar, and 18.8% in AndroZoo metadata.Google’s 2017 security report suggests 6–10% malware among Android apps.
  • 2.3 Dataset: 129,728 Android applications form the final dataset, comprising 116,993 goodware and 12,735 malware samples from AndroZoo.The broader AndroZoo collection contains more than 8.5 million apps spanning 2010 to early 2019, with timestamps and mostly VirusTotal metadata.
  • 2.3 Dataset: Training on 2014 and testing on 2015 and 2016 is used for all time-aware experiments, with the dataset spanning Jan 2014 to Dec 2016.The collected evaluation set contains 129,728 applications with average 10% malware.

3 Sources of Experimental Bias

The section shows that Android malware classification results can be inflated by temporal and spatial experimental bias. Realistic temporal ordering and representative malware proportions produce substantially worse performance than commonly reported configurations.

  • Temporal experimental bias: 10-fold CV positively biases malware classification because similar samples from each malware family can appear in both training and testing.New malware families would instead be unknown during training in real-world deployment.
  • Temporal experimental bias: Testing goodware and malware from non-overlapping periods lets classifiers distinguish time periods rather than malware from goodware.This bias can occur when the two classes originate from different data sources.
  • Temporal experimental bias: Realistic temporal precedence produces the worst classifier performance in most cases.The classifier is trained on earlier data and tested on later data, exposing time decay effects.
  • Spatial experimental bias: Increasing malware in testing leaves malware Recall constant but increases malware Precision, making testing proportions a source of spatial bias.The testing malware percentage should reflect in-the-wild deployment and cannot be arbitrarily changed for representative evaluation.
  • Spatial experimental bias: Increasing malware in training improves malware Recall while reducing malware Precision, while shifting the opposite tradeoff for goodware.Training distributions therefore affect classifier behavior, and the appropriate ratio depends on the user’s objective.

4 Space-Time Aware Evaluation

TESSERACT defines space-time constraints, the AUT metric, and a tuning algorithm for evaluating and improving Android malware classifiers under realistic temporal decay. Applied to three classifiers, it reveals that bias-corrected performance is lower than conventional results and that deep learning is most robust over two years.

  • Space-time constraints: TESSERACT formalizes realistic evaluation through three constraints, including temporal precedence and consistent testing windows, and identifies C2 and C3 as novel and fundamental.Violating temporal precedence introduces future knowledge and inflates results.
  • Time-aware metric: AUT summarizes classifier performance over time by measuring the area under a time-decay performance curve across N time units.AUT can use point estimates, which more closely capture temporal trends; cumulative versions should be marked AUTcml.
  • Classifier tuning: The tuning algorithm adjusts the training ratio ϕ to optimize minority-class F1, Precision, or Recall under a maximum tolerated error while reducing time decay.The method targets imbalanced datasets and optimizes a user-specified performance metric.
  • Evaluation results: 0.58 for ALG1, 0.32 for ALG2, and 0.64 for DL are the reported AUT(F1,24m) values after removing temporal bias.Each AUT(F1,24m) value is lower than 10-fold F1, which can violate C1 and C2.
  • Evaluation results: DL is most robust to time decay and performs best over the two-year test period, although ALG1 outperforms it during the first few months.After tuning, ALG1 and DL have similar F1 performance, while DL retains higher AUT.

5 Delaying Time Decay

This section uses TESSERACT to compare budget-constrained strategies for delaying time decay without proposing new strategies. It evaluates performance-cost trade-offs using AUT, labeling cost, and quarantine cost, showing that tuning and retraining can improve realistic classifier performance.

  • Evaluation framework: TESSERACT enables fair comparison of popular approaches for mitigating time decay under budget constraints, rather than proposing novel delay strategies.The framework is intended for researchers evaluating new solutions and practitioners estimating real-world performance and resource requirements.
  • Delay strategies: The evaluated strategies are incremental retraining, uncertainty-sampling active learning, and classification with rejection.Incremental retraining labels all objects monthly as an ideal but unrealistic upper bound; active learning selects uncertain objects for labeling; rejection quarantines low-confidence decisions.
  • Evaluation criteria: Performance-cost trade-offs are characterized by AUT-based performance P, periodic labeling cost L, and quarantine cost Q.Table 3 uses AUT(F1,24m) while enforcing the paper’s space and time constraints, with performance columns corresponding to training with ˆσ and ϕ∗F1.
  • Results: ϕ∗F1 achieves better no-delay performance than ˆσ for both ALG1 and ALG2, while improving ALG2 in every other configuration and generally benefiting ALG1.For ALG1, rejection and AL 1% are exceptions; for ALG2, the tuned ratio improves performance across the remaining configurations.
  • Results: The tuning algorithm’s F1-Score improvement requires no labeling or quarantine cost, while delay methods can further improve in-the-wild performance at cost L or Q.The tuning is most effective when it finds a ϕ∗P that differs from estimated ˆσ; objects selected for labeling or rejection are the classifier’s most uncertain objects, not necessarily malware.

6 Discussion

The discussion highlights TESSERACT’s practical value for measuring robustness without retraining and its applicability beyond Android, while identifying domain-specific assumptions and evaluation limitations. It also emphasizes that realistic spatio-temporal evaluation should precede assessment of adversarial mitigations.

  • Actionable points on TESSERACT: TESSERACT’s baseline AUT performance without classifier retraining measures robustness to performance decay, while its evaluations can reveal true and counter-intuitive performance.The authors argue that robustness over extended time periods is practically relevant for deployment scenarios.
  • Generalization to other security domains: TESSERACT generalizes beyond Android to machine learning-driven security domains, provided domain-specific parameters such as time granularity ∆ and test time length reflect realistic conditions.The methodology is intended to eliminate spatio-temporal bias, which may affect other security domains under concept drift.
  • Domain-specific in-the-wild malware percentage ˆσ: The assumed in-the-wild Android malware percentage ˆσ is around 10%, but estimating it correctly remains challenging and motivates representative measurement studies and data sharing.The assumption concerns the malware percentage in the testing dataset and the need for realistic experimental settings.
  • Correct observation labels: The study assumes correct goodware and malware labels, treating VirusTotal labels as reliable because detections stabilize after one year, while future work may address noisy oracles.The dataset uses observations through December 2016.
  • Resilience of malware classifiers: TESSERACT offers unbiased evaluation for classifiers beyond the three studied, and experimental bias should be addressed before realistic evaluations of adversarial ML mitigations.The authors frame adversarial ML as an artificially induced worst-case concept-drift scenario while leaving the adversarial setting open.

7 Related Work

Prior studies examine imbalance, temporal effects, dataset quality, and evaluation metrics, but do not address the full bias problem for evolving malware data. TESSERACT contributes actionable constraints, metrics, and tool support for realistic performance evaluation over time.

  • Related work: Prior work identifies dataset-label errors, but does not evaluate their impact on classifier performance.
  • Related work: Allix et al. show that future knowledge can inflate malware-classification performance, while other work finds that more goodware lowers performance in-the-wild settings.
  • Related work: ROC curves can mislead on imbalanced datasets, motivating performance metrics that account for imbalance.
  • Related work: This paper proposes actionable constraints and metrics with tool support to evaluate classifier performance decay over time.
  • Related work: Existing studies do not address the entire bias problem in evolving data, and constraint C1 alone is insufficient to eliminate bias.

9 Conclusions

The paper identifies temporal and spatial bias in Android malware classification and addresses it with TESSERACT, an open-source framework for realistic evaluation. It argues that TESSERACT can support unbiased comparisons and broader study of concept drift in security.

  • Contributions: The authors identify temporal and spatial bias and propose constraints, metrics, and tuning to address these issues.These methods expose classifier performance that remains hidden under incorrect experimental settings in non-stationary contexts.
  • Contributions: TESSERACT is an open-source tool for correctly evaluating and comparing malware classifiers, especially mitigation strategies for time decay.Future framework work includes modeling a time-varying malware percentage and using performance-decay slopes to distinguish algorithms with similar AUT.
  • Future Work: The authors envision TESSERACT enabling realistic, comparable, and unbiased Android malware-classification results and evaluating temporal and spatial bias in other security domains.They specifically highlight domains where concept drift still needs to be quantified.

A Appendix · A.1 Algorithm Hyperparameters

The appendix reports the settings used to replicate ALG1, ALG2, and DL. The replications reproduce published results, including ALG1’s original performance on its source dataset, while specifying the neural-network training configuration.

  • A Appendix: The appendix documents hyperparameters for replicating ALG1, ALG2, and DL.These details are reported for reproducing the classifiers’ experiments.
  • A.1 Algorithm Hyperparameters: ALG1 uses a linear SVM with C=1.The implementation uses SCIKIT-LEARN.
  • A.1 Algorithm Hyperparameters: ALG2 uses package mode with a random forest of 101 trees and maximum depth 64.These settings follow the respective paper’s description.
  • A.1 Algorithm Hyperparameters: ALG1 replication achieves around 0.91 10-fold F1 on the authors’ dataset.On ALG1’s original dataset, replication achieves about 0.94 10-fold F1.
  • A.1 Algorithm Hyperparameters: The ALG1 replication on its original dataset achieves about 0.94 10-fold F1.This reproduces the original reported performance.
  • A.1 Algorithm Hyperparameters: DL is re-implemented in KERAS using the same initial input features as ALG1.The implementation follows the guidelines in and uses the best-performing neural-network architecture described there.
  • A.1 Algorithm Hyperparameters: DL training uses 10 epochs and batch size 1,000.Optimization uses stochastic gradient descent with lr=0.1, momentum=0.0, decay=0.0, and nesterov=False.

A.2 Symbol table

This section introduces Table 4 as a legend of the main symbols used throughout the paper, improving readability.

  • A.2 Symbol table: Table 4 provides a legend for the paper’s main symbols.Its purpose is to improve readability.
  • A.2 Symbol table: The symbol table is labeled Table 4.

A.3 Cumulative Plots for Time Decay

Figure 10 presents the cumulative performance plot defined in §4.2, providing the cumulative counterpart to Figure 5.

  • Figure 10 shows the cumulative performance plot defined in §4.2.
  • The plot is the cumulative version of Figure 5.

A.4 Delay Strategies · A.5 TESSERACT Implementation · A.6 Summary of Datasets Evaluated by Prior Work

The paper evaluates delay-mitigation strategies, implements its space-time constraints and metrics in the TESSERACT library, and distinguishes its unbiased dataset from datasets used in prior evaluations.

  • A.4 Delay Strategies: Incremental retraining periodically manually labels all test objects and adds them to training, tending toward an ideal performance P∗.The model for month mi is trained on Tr ∪ {m0,m1,...,mi−1}.
  • A.4 Delay Strategies: Active learning uses uncertainty sampling to select a percentage of the least-certain objects each month for labeling and retraining.The strategy targets objects likely to reveal concept drift and improve decision boundaries.
  • A.4 Delay Strategies: Classification with rejection quarantines uncertain predictions for later manual inspection, trading rejected objects for improved performance on the remainder.The reject option is presented as orthogonal to active learning because malware evolves rapidly over time.
  • A.4 Delay Strategies: Figure 10 examines performance time decay with cumulative estimates for ALG1, ALG2 and DL using δ = 10% malware in testing and ϕ = 10% malware in training.These distributions define the figure’s evaluation setting.
  • A.5 TESSERACT Implementation: TESSERACT is a Python library compatible with SCIKIT-LEARN and KERAS that implements time-aware partitioning, class-ratio adjustment, metrics, evaluation, selection, and rejection modules.Its modular API supports classifier updates and pluggable query or reject strategies.
  • A.5 TESSERACT Implementation: The library supports optimal training-ratio search, AUT computation for metrics including F1, Precision, and AUC, and evaluations across selected time periods.It also checks spatial constraint C3 and exposes update-strategy hooks.
  • A.6 Summary of Datasets Evaluated by Prior Work: The paper evaluates ALG1, ALG2 and DL on its own first-row dataset, constructed to avoid spatio-temporal bias, rather than the experimentally biased datasets used by prior work.Table 5 summarizes the paper’s dataset alongside prior datasets from ALG1, ALG2 [33], and DL.
Loading 1807.07838v4…