SCRR: Stable Malware Detection under Unknown Deployment Environment Shift by Decoupled Spurious Correlations Filtering

Machine learning models have been prevalently deployed for malware detection. When properly trained under the training environment, they can deliver highly accurate detection results in the deployment environment provided that the two environments have no distribution shift from each other. Yet, in practice, various factors can cause environment shifts, which lead to degraded malware detection accuracy. In this work, we propose SCRR, a unified training framework to enhance the stability of malware detection models under unknown distribution shifts of the deployment environment. Our method can enhance the stability of the model by filtering out correlations between malicious behaviours and irrelevant features, known as the SC (spurious correlation), which can change significantly across different environments. What is more, SCRR proposes a fine-grained SC filtering strategy to achieve better accuracy performance. We evaluate SCRR in terms of in-distribution accuracy, degradation under environment shifts, and comprehensive detection ability with two real-world Android malware datasets, considering three types of causal factors and four environment shifts. SCRR outperforms the state-of-the-art malware detection training methods by improving the detection accuracy by up to 13.4% under the considered environment shifts. Moreover, it consistently showcases in-distribution accuracy comparable to the best outcomes achieved by baseline methods.