  The vulnerability to adversarial examples remains one major obstacle for
Machine Learning (ML)-based Android malware detection. Realistic attacks in the
Android malware domain create Realizable Adversarial Examples (RealAEs), i.e.,
AEs that satisfy the domain constraints of Android malware. Recent studies have
shown that using such RealAEs in Adversarial Training (AT) is more effective in
defending against realistic attacks than using unrealizable AEs (unRealAEs).
This is because RealAEs allow defenders to explore certain pockets in the
feature space that are vulnerable to realistic attacks. However, existing
defenses commonly generate RealAEs in the problem space, which is known to be
time-consuming and impractical for AT. In this paper, we propose to generate
RealAEs in the feature space, leading to a simpler and more efficient solution.
Our approach is driven by a novel interpretation of Android domain constraints
in the feature space. More concretely, our defense first learns feature-space
domain constraints by extracting meaningful feature dependencies from data and
then applies them to generating feature-space RealAEs during AT. Extensive
experiments on DREBIN, a well-known Android malware detector, demonstrate that
our new defense outperforms not only unRealAE-based AT but also the
state-of-the-art defense that relies on non-uniform perturbations. We further
validate the ability of our learned feature-space domain constraints in
representing Android malware properties by showing that our feature-space
domain constraints can help distinguish RealAEs from unRealAEs.
