This paper addresses the issue of Empirical Risk Minimization (ERM)-based Android malware detectors, which suffer from performance degradation over time due to distribution shifts caused by malware variants and new families. We attribute the shortcomings of existing detectors to their inability to learn stable discriminative features. To address this, we propose a novel framework, TIF, which applies time-invariant learning theory. TIF constructs an environment based on application observation dates to reveal temporal shifts and integrates specialized multi-proxy contrastive learning and invariant gradient alignment to generate and align high-quality, stable representations. Experimental results demonstrate that TIF performs well, especially during the early deployment phase, outperforming state-of-the-art methods.
