Are Your Training Datasets Yet Relevant? - An Investigation into the Importance of Timeline in Machine Learning-Based Malware Detection

In this paper, we consider the relevance of timeline in the construction of datasets,
to highlight its impact on the performance of a machine learning-based malware
detection scheme. Typically, we show that simply picking a random set of known
malware to train a malware detector, as it is done in many assessment scenarios
from the literature, yields significantly biased results. In the process of assessing
the extent of this impact through various experiments, we were also able to con-
firm a number of intuitive assumptions about Android malware. For instance,
we discuss the existence of Android malware lineages and how they could impact
the performance of malware detection in the wild.