Few-Shot Android Malware Classification with QuantumEnhanced Prototypical Learning and Drift Detection

Few-Shot Android Malware Classification with QuantumEnhanced Prototypical Learning and Drift Detection | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article Few-Shot Android Malware Classification with QuantumEnhanced Prototypical Learning and Drift Detection MOHAMMED TAWFIK, Hussam Tarazi, Ahmad Dalalah, Bajeszeyad aljunaeidia, and 2 more This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-8691829/v1 This work is licensed under a CC BY 4.0 License Status: Published Journal Publication published 28 Mar, 2026 Read the published version in Scientific Reports → Version 1 posted 15 You are reading this latest preprint version Abstract Android malware detection systems face critical challenges including data scarcity for emerging threat families, highdimensional feature spaces, and concept drift caused by evolving attack techniques. Traditional machine learningapproaches require extensive labeled datasets and frequent retraining, limiting their practical deployment againstrapidly emerging threats. This paper proposes an adaptive few-shot malware classification framework that integratesCatBoost-based feature selection, prototypical networks with episodic meta-learning, quantum-enhanced classification,concept drift detection, and explainable AI (XAI) analysis using SHAP and LIME. The CatBoost feature selection reducesdimensionality by 99.46% on CCCS-CIC-AndMal-2020 (9,503 to 51 features) and 94.07% on KronoDroid (489 to 29features) while preserving discriminative information. The prototypical network learns metric-based representationsenabling classification with only 5 support samples per class. Extensive experiments demonstrate state-of-the-artperformance with 99.70% accuracy on CCCS-CIC-AndMal-2020 (15 malware families) and 99.33% accuracy onKronoDroid (binary classification), outperforming existing methods by 0.70–9.70%. The framework exhibits robusttemporal stability with maximum accuracy degradation of 0.24% across evaluation periods. XAI analysis reveals thatfile descriptor manipulation and file system operations are the most discriminative features for malware detection.These results establish few-shot prototypical learning with intelligent feature selection as an effective paradigm forpractical malware detection requiring minimal annotation, interpretable decisions, and stable long-term performance Biological sciences/Computational biology and bioinformatics Physical sciences/Mathematics and computing Few-shot learning Android malware detection Quantum machine learning Prototypical networks Concept drift detection Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Published Journal Publication published 28 Mar, 2026 Read the published version in Scientific Reports → Version 1 posted Editorial decision: Revision requested 16 Feb, 2026 Reviews received at journal 12 Feb, 2026 Reviewers agreed at journal 12 Feb, 2026 Reviewers agreed at journal 12 Feb, 2026 Reviewers agreed at journal 12 Feb, 2026 Reviews received at journal 11 Feb, 2026 Reviewers agreed at journal 11 Feb, 2026 Reviews received at journal 11 Feb, 2026 Reviewers agreed at journal 11 Feb, 2026 Reviewers agreed at journal 11 Feb, 2026 Reviewers invited by journal 11 Feb, 2026 Editor assigned by journal 10 Feb, 2026 Editor invited by journal 10 Feb, 2026 Submission checks completed at journal 09 Feb, 2026 First submitted to journal 09 Feb, 2026 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-8691829","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":590618380,"identity":"ee68ce09-cf6e-4c4e-a04b-c377b776246c","order_by":0,"name":"MOHAMMED TAWFIK","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA1UlEQVRIiWNgGAWjYNACGwkDfjCDjSjlzECcJmEg2UCiFgYDgwPEatFt4D/4mSfBwtj4/BkDhg9lhxkMjjfg12J2gJlZmidBwszsRo4B44xzQC1nDhDUwiCd+0PCxuwGjwEzbxtQy40Ewrb8zkmQsDHuP2PA/Bek5f4DglrYpIFazAwYcgyYGcG24NfBYHaY2cz6T4KEscSNtIKDPefSeSTPEHLY8cbHN2ck1Bn29x/e+OBHmbUc3/EDBKxhRmKD1PIoENKBCeQbSNYyCkbBKBgFwxwAAFqnP6P5hk3FAAAAAElFTkSuQmCC","orcid":"","institution":"Sana'a University","correspondingAuthor":true,"prefix":"","firstName":"MOHAMMED","middleName":"","lastName":"TAWFIK","suffix":""},{"id":590618382,"identity":"3800132b-4a53-4534-8ea5-3fe1de8b791b","order_by":1,"name":"Hussam Tarazi","email":"","orcid":"","institution":"Ajloun National University","correspondingAuthor":false,"prefix":"","firstName":"Hussam","middleName":"","lastName":"Tarazi","suffix":""},{"id":590618383,"identity":"9b915302-ca32-4a6b-9666-5dff492a1c03","order_by":2,"name":"Ahmad Dalalah","email":"","orcid":"","institution":"Ajloun National University","correspondingAuthor":false,"prefix":"","firstName":"Ahmad","middleName":"","lastName":"Dalalah","suffix":""},{"id":590618384,"identity":"c6a46afa-23e7-4d17-9545-cc881cfdbf4b","order_by":3,"name":"Bajeszeyad aljunaeidia","email":"","orcid":"","institution":"Ajloun National University","correspondingAuthor":false,"prefix":"","firstName":"Bajeszeyad","middleName":"","lastName":"aljunaeidia","suffix":""},{"id":590618385,"identity":"6463784f-5c3b-43c0-856c-92fbd2f40593","order_by":4,"name":"Warda M Shaban","email":"","orcid":"","institution":"Ajloun National University","correspondingAuthor":false,"prefix":"","firstName":"Warda","middleName":"M","lastName":"Shaban","suffix":""},{"id":590618386,"identity":"773e098d-1ebb-4b7f-a3e9-8e7ba9bc0d15","order_by":5,"name":"Islam S Fathi","email":"","orcid":"","institution":"Ajloun National University","correspondingAuthor":false,"prefix":"","firstName":"Islam","middleName":"S","lastName":"Fathi","suffix":""}],"badges":[],"createdAt":"2026-01-25 10:39:04","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-8691829/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-8691829/v1","draftVersion":[],"editorialEvents":[{"content":"https://doi.org/10.1038/s41598-026-45738-0","type":"published","date":"2026-03-28T16:13:01+00:00"}],"editorialNote":"","failedWorkflow":false,"files":[{"id":105755712,"identity":"f6ebd131-fafe-4fdf-95e5-3804374cfe8e","added_by":"auto","created_at":"2026-03-30 16:29:49","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":5384236,"visible":true,"origin":"","legend":"","description":"","filename":"Paperv1.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8691829/v1_covered_a926ea9d-e78d-4dcf-b46a-69c82ca2c5b1.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Few-Shot Android Malware Classification with QuantumEnhanced Prototypical Learning and Drift Detection","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":true,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true},"keywords":"Few-shot learning, Android malware detection, Quantum machine learning, Prototypical networks, Concept drift detection","lastPublishedDoi":"10.21203/rs.3.rs-8691829/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-8691829/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"Android malware detection systems face critical challenges including data scarcity for emerging threat families, highdimensional feature spaces, and concept drift caused by evolving attack techniques. Traditional machine learningapproaches require extensive labeled datasets and frequent retraining, limiting their practical deployment againstrapidly emerging threats. This paper proposes an adaptive few-shot malware classification framework that integratesCatBoost-based feature selection, prototypical networks with episodic meta-learning, quantum-enhanced classification,concept drift detection, and explainable AI (XAI) analysis using SHAP and LIME. The CatBoost feature selection reducesdimensionality by 99.46% on CCCS-CIC-AndMal-2020 (9,503 to 51 features) and 94.07% on KronoDroid (489 to 29features) while preserving discriminative information. The prototypical network learns metric-based representationsenabling classification with only 5 support samples per class. Extensive experiments demonstrate state-of-the-artperformance with 99.70% accuracy on CCCS-CIC-AndMal-2020 (15 malware families) and 99.33% accuracy onKronoDroid (binary classification), outperforming existing methods by 0.70–9.70%. The framework exhibits robusttemporal stability with maximum accuracy degradation of 0.24% across evaluation periods. XAI analysis reveals thatfile descriptor manipulation and file system operations are the most discriminative features for malware detection.These results establish few-shot prototypical learning with intelligent feature selection as an effective paradigm forpractical malware detection requiring minimal annotation, interpretable decisions, and stable long-term performance","manuscriptTitle":"Few-Shot Android Malware Classification with QuantumEnhanced Prototypical Learning and Drift Detection","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-02-16 03:32:33","doi":"10.21203/rs.3.rs-8691829/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2026-02-16T08:04:15+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-02-13T03:57:57+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"301754480752187441832810453781869068689","date":"2026-02-13T03:24:52+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"122984334434684371021410372631517235218","date":"2026-02-13T01:55:25+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"189663428269582259256575728671475571937","date":"2026-02-12T16:32:23+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-02-11T15:17:44+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"234262147041659322209076160073276448399","date":"2026-02-11T13:57:44+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-02-11T13:38:32+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"246990778372637825358150584679647336117","date":"2026-02-11T13:06:02+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"116357999802386444149026643085436996772","date":"2026-02-11T12:49:37+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2026-02-11T12:21:32+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2026-02-10T15:16:21+00:00","index":"","fulltext":""},{"type":"editorInvited","content":"","date":"2026-02-10T14:59:27+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2026-02-09T10:17:48+00:00","index":"","fulltext":""},{"type":"submitted","content":"Scientific Reports","date":"2026-02-09T10:15:32+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"3fba2b88-c2ba-4736-8140-73d221d3e45b","owner":[],"postedDate":"February 16th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"published-in-journal","subjectAreas":[{"id":62849373,"name":"Biological sciences/Computational biology and bioinformatics"},{"id":62849374,"name":"Physical sciences/Mathematics and computing"}],"tags":[],"updatedAt":"2026-03-30T16:24:50+00:00","versionOfRecord":{"articleIdentity":"rs-8691829","link":"https://doi.org/10.1038/s41598-026-45738-0","journal":{"identity":"scientific-reports","isVorOnly":false,"title":"Scientific Reports"},"publishedOn":"2026-03-28 16:13:01","publishedOnDateReadable":"March 28th, 2026"},"versionCreatedAt":"2026-02-16 03:32:33","video":"","vorDoi":"10.1038/s41598-026-45738-0","vorDoiUrl":"https://doi.org/10.1038/s41598-026-45738-0","workflowStages":[]},"version":"v1","identity":"rs-8691829","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-8691829","identity":"rs-8691829","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}