The invention relates to the technical field of
computer security, in particular to a dynamically updated Android malicious
software continuous learning detection method, which comprises the following steps of: acquiring and sequencing historical
Android application samples according to time to construct a
training set, and training a hierarchical comparison classifier; new applications are collected regularly to form a to-be-tested batch, and the current classifier is used for prediction; for each sample in the to-be-detected batch, executing pseudo loss
uncertainty calculation to obtain an uncertainty
score of the sample; according to the
score, selecting a predetermined number of most uncertain samples for labeling, and obtaining a real
label; adding the new labeled sample into the
training set, and performing incremental training by adopting a
hot start mode based on the weight of the current classifier to obtain an updated classifier; and circularly executing, and detecting the new application in the next period by using the updated classifier. According to the method, the labeling cost can be remarkably reduced, the
concept drift can be effectively coped, and efficient, stable and continuous malicious
software detection is realized.