{"id":"https://openalex.org/W7160822512","doi":"https://doi.org/10.48550/arxiv.2605.06894","title":"McNdroid: A Longitudinal Multimodal Benchmark for Robust Drift Detection in Android Malware","display_name":"McNdroid: A Longitudinal Multimodal Benchmark for Robust Drift Detection in Android Malware","publication_year":2026,"publication_date":"2026-05-07","ids":{"openalex":"https://openalex.org/W7160822512","doi":"https://doi.org/10.48550/arxiv.2605.06894"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.06894","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.06894","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.06894","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5118176049","display_name":"Md Mahmuduzzaman Kamol","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kamol, Md Mahmuduzzaman","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135829271","display_name":"Jesus Lopez","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lopez, Jesus","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5114869081","display_name":"Saeefa Rubaiyet Nowmi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nowmi, Saeefa Rubaiyet","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084071065","display_name":"Emilia Rivas","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Rivas, Emilia","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135840294","display_name":"Md Ahsanul Haque","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Haque, Md Ahsanul","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068036546","display_name":"Edward Raff","orcid":"https://orcid.org/0000-0002-9900-1972"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Raff, Edward","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5014855298","display_name":"Aritran Piplai","orcid":"https://orcid.org/0000-0002-6437-1324"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Piplai, Aritran","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5135849927","display_name":"Mohammad Saidur Rahman","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Rahman, Mohammad Saidur","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":8,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9629999995231628,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9629999995231628,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":0.015799999237060547,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.003000000026077032,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/sandbox","display_name":"Sandbox (software development)","score":0.794700026512146},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7864999771118164},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.6597999930381775},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.6050999760627747},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.38850000500679016},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.3797000050544739},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.37450000643730164},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.3598000109195709},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.3546999990940094}],"concepts":[{"id":"https://openalex.org/C167981075","wikidata":"https://www.wikidata.org/wiki/Q2667186","display_name":"Sandbox (software development)","level":2,"score":0.794700026512146},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7864999771118164},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7427999973297119},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.6597999930381775},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.6050999760627747},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5590999722480774},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5460000038146973},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.38850000500679016},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.3797000050544739},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.37450000643730164},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.3598000109195709},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.3546999990940094},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.3540000021457672},{"id":"https://openalex.org/C2776436953","wikidata":"https://www.wikidata.org/wiki/Q5163215","display_name":"Consistency (knowledge bases)","level":2,"score":0.3361999988555908},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.32359999418258667},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.3222000002861023},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.3046000003814697},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2962999939918518},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.2962000072002411},{"id":"https://openalex.org/C2780967490","wikidata":"https://www.wikidata.org/wiki/Q1291200","display_name":"Mobile malware","level":3,"score":0.29179999232292175},{"id":"https://openalex.org/C60777511","wikidata":"https://www.wikidata.org/wiki/Q3045002","display_name":"Concept drift","level":3,"score":0.28859999775886536},{"id":"https://openalex.org/C71901391","wikidata":"https://www.wikidata.org/wiki/Q7126699","display_name":"Upload","level":2,"score":0.2784999907016754},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.2782000005245209},{"id":"https://openalex.org/C2780226545","wikidata":"https://www.wikidata.org/wiki/Q6888030","display_name":"Modality (human\u2013computer interaction)","level":2,"score":0.26489999890327454},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.262800008058548},{"id":"https://openalex.org/C60692881","wikidata":"https://www.wikidata.org/wiki/Q584529","display_name":"Humanoid robot","level":3,"score":0.25870001316070557},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.25369998812675476}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.06894","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.06894","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.06894","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.06894","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Machine":[0],"learning":[1,181],"(ML)":[2],"in":[3,160,182],"real-world":[4],"systems":[5],"must":[6],"contend":[7],"with":[8,19,76],"concept":[9],"drift,":[10,154],"adversarial":[11],"actors,":[12],"and":[13,22,41,64,72,83,92,106,145,157,169,178],"a":[14],"spectrum":[15],"of":[16,28],"potential":[17],"features":[18,80,88,94],"varying":[20],"costs":[21],"benefits.":[23],"Malware":[24],"naturally":[25],"exhibits":[26],"all":[27],"these":[29,46],"complexities,":[30],"but":[31],"for":[32,61],"the":[33,54,123,146],"same":[34],"reason,":[35],"it":[36],"is":[37],"challenging":[38],"to":[39,44,51,171],"curate":[40],"organize":[42],"data":[43],"study":[45],"factors.":[47],"We":[48,150,163],"present":[49],"McNdroid,":[50,166],"our":[52],"knowledge":[53],"largest":[55],"longitudinal":[56],"multimodal":[57,120,180],"Android":[58],"malware":[59,62],"benchmark":[60,167],"detection":[63],"drift":[65,139],"analysis.":[66],"McNdroid":[67],"spans":[68],"2013--2025,":[69],"excluding":[70],"2015,":[71],"represents":[73],"each":[74],"application":[75],"three":[77],"aligned":[78],"modalities--static":[79],"from":[81,89,95],"manifests":[82],"smali":[84],"code,":[85],"dynamic":[86],"behavioral":[87],"sandbox":[90],"execution,":[91],"graph-based":[93],"function-call":[96],"graphs.":[97],"Using":[98],"temporally":[99],"separated":[100],"splits,":[101,168],"we":[102],"evaluate":[103],"standard":[104],"ML":[105],"deep-learning":[107],"detectors":[108],"across":[109,127],"increasing":[110],"train--test":[111],"time":[112],"gaps.":[113,130],"Results":[114],"show":[115],"clear":[116],"temporal":[117,129,158,176],"degradation,":[118],"while":[119],"fusion":[121],"outperforms":[122],"best":[124],"single":[125],"modality":[126],"long-term":[128],"Cross-modal":[131],"agreement":[132],"also":[133],"declines":[134],"over":[135],"time,":[136],"suggesting":[137],"that":[138],"affects":[140],"both":[141],"individual":[142],"feature":[143],"spaces":[144],"consistency":[147],"among":[148],"modalities.":[149],"further":[151],"analyze":[152],"modality-specific":[153],"malware-family":[155],"evolution,":[156],"changes":[159],"model":[161],"explanations.":[162],"publicly":[164],"release":[165],"code":[170],"support":[172],"reproducible":[173],"research":[174],"on":[175],"generalization":[177],"robust":[179],"security-critical,":[183],"non-stationary":[184],"settings.":[185]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2026-05-12T00:00:00"}