Abstract
The high-quality labeled dataset is crucial for building effective Android malware detection models. However, widely used automated labeling systems (e.g., antivirus services) are often not stable enough and may introduce label noise. In this paper, we identify and analyze two types of noise: RDMnoise and IDNnoise. RDMnoise is introduced by the labeling system randomly flipping labels, exhibiting class symmetry. In contrast, IDNnoise arises primarily because engines tend to misclassify obfuscated software as malware, exhibiting class dependency. Both types of noise can bias the training process of malware detection systems, thereby affecting the overall performance of the model. To combat these two types of noise of Android malware detection, we propose a lightweight training framework called CoNoMAD, which combines model-level and data-level approaches to jointly mitigate label noise. Specifically, to overcome the uncertainty introduced by noisy labels for model training, we assist the training by seeking more certainty in the supervisory information from both the model and data levels. On the model level, CoNoMAD relies on an under-trained model. The intuition behind this is to reduce the model's sensitivity to noisy labels by limiting its capacity to overfit. On the data level, CoNoMAD employs a clustering algorithm to mitigate the impact of noise on data distribution by identifying and grouping similar data points. Through auxiliary training on these two levels, CoNoMAD effectively mitigates the negative impact of label noise on models in complex scenarios. We validate the performance of CoNoMAD on 25 datasets with varying noise ratios, including the RDMnoise dataset, the IDNnoise dataset, and a mixed dataset containing both types of noise. Experiments show CoNoMAD improves detection performance by 50.89%, 24.30%, and 29.34% on popular malware detectors, under the RDMnoise, IDNnoise, and Mixed Noise. Compared to state-of-the-art methods, CoNoMAD achieves higher detection performance and training efficiency. Finally, this study calls for more attention to the impact of label noise on Android malware detection.