Abstract: In recent years, supervised machine learning-based Android malware detection methods have made some progress. However, due to the difficulty in collecting malware samples, the size of labeled datasets is generally small, which leads to limited generalization ability of the trained supervised models. To address this problem, an unsupervised and supervised combined malware detection method is proposed. Firstly, a language model is pre-trained on a large amount of unlabeled APK samples using unsupervised methods to learn the rich and complex semantic relationships between different operators. Then, the pre-trained language model is fine-tuned by the labeled malware samples to realize the malware detecting ability. Experiments on datasets such as Drebin demonstrate that the proposed method has better generalization ability and detection performance compared with the baseline method, which achieves a maximum accuracy of 98.7%. 

Key words: Android, malware detection, pre-trained language model, unsupervised learning