When Label Noise Meets Class Imbalance: A Robust Framework for Android Malware Family Classification

Abstract

Machine learning methods for Android malware family classification have achieved high accuracy, but their application is hindered by two major challenges. First, the widely used code obfuscation severely disrupts the automated labeling process and introduces substantial label noise into training datasets. Second, training datasets often exhibit severe class imbalance, leading to poor performance of family classification models. Although existing studies have proposed various solutions to either label noise or class imbalance, they often overlook the interplay between these two factors. Under class imbalance, the presence of hard-to-learn minority-class samples can significantly impair the effectiveness of existing countermeasures for noisy samples. To jointly address label noise and class imbalance, we propose a robust Android malware family classification framework, RoMaC. It employs a self-training strategy to correct noisy labels and, more importantly, discriminately treats head-family and tail-family samples. This design effectively mitigates the adverse impact of class imbalance on noise-robust learning. Moreover, RoMaC integrates a class reweighting mechanism with multi-model ensemble learning, thereby enhancing both classification accuracy and noise robustness. We evaluate RoMaC on a combined dataset constructed from two public datasets. When 30% of the samples are obfuscated, RoMaC achieves an overall Macro-F1 score of 0.803 and an accuracy of 0.871, as well as a tail-class Macro-F1 score of 0.672 and an accuracy of 0.784. Compared with existing methods, RoMaC demonstrates performance improvements of 6%-20% across various obfuscation scenarios and noise levels.