  The growing popularity of Android requires malware detection systems that can
keep up with the pace of new software being released. According to a recent
study, a new piece of malware appears online every 12 seconds. To address this,
we treat Android malware detection as a streaming data problem and explore the
use of active online learning as a means of mitigating the problem of labelling
applications in a timely and cost-effective manner. Our resulting framework
achieves accuracies of up to 96\%, requires as little of 24\% of the training
data to be labelled, and compensates for concept drift that occurs between the
release and labelling of an application. We also consider the broader
practicalities of online learning within Android malware detection, and
systematically explore the trade-offs between using different static, dynamic
and hybrid feature sets to classify malware.
