Single-Pass Learning Android Malware Detector for Mobile Computing Platforms

Emilien Meyer, Colin Dupuis, Abu Masum, Sercan Aygun

Abstract: This paper presents a lightweight malware detection framework for Android applications based on Hyperdimensional Computing (HDC). By leveraging structural information such as opcodes and method names, we encode high-dimensional bipolar hypervectors from Dalvik (DEX) bytecode. During training, each opcode is bound to its method name, which enables the model to capture intricate relationships indicative of malicious behavior. The hypervectors are bundled together across hundreds of benign and malware Android Package Kit (APK) samples to form two distinct class vectors. During inference, a single APK is encoded in the same way and classified using the highest cosine similarity score when compared to the precomputed class vectors. Our method achieves comparable accuracy with minimal hardware overhead and computation owing to its single-pass learning model. We validate hardware feasibility by deploying our model on a Samsung smartphone and measuring power consumption. Results show that our single-pass HDC approach offers a promising solution for on-device malware detection.

External IDs:doi:10.1109/les.2026.3661836