FlagThis

Abstract

Machine learning based malware detectors become obsolete over a period of time due to _concept drift_ in the benign and malware apps. Recent method requires fully labeled data and combines hierarchical contrastive loss with active learning (HCL), leveraging the semantic structure of malware representations to improve robustness against drift. However, obtaining labeled data remains an arduous task in the security domain. Alternately, if training is performed using partially labeled data, HCL suffers a performance degradation in detecting unseen malware (in terms of area under the time (AUT) metric computed over precision recall area under the curve), particularly on datasets (such as BODMAS) where such semantic structures may not be present. Specifically, on the BODMAS dataset the reduction is from 0.795 to 0.613 and on AndroZoo, it is from 0.879 to 0.780. In this paper, we propose a semantic-structure-agnostic method for malware detection. The proposed method dubbed SEED is robust under limited supervision, outperforming contrastive learning in the absence of strong semantic structure while remaining competitive when such structure exists. Specifically SEED adopts a tailored binary cross-entropy, and integrates it with semi-supervised continual learning and active learning. The proposed method finds a suitable labeled sample for each unlabeled sample (from the seen tasks) by projecting it into the representation space constructed from the basis vectors of the previously seen data using singular value decomposition and encourages the malware detector to learn the same representation for these pairwise samples. On unseen tasks (fully unlabeled data), we quantify the uncertainty of the new sample using cosine distance in representation space and select the most uncertain samples for the security analyst to label. Later, we train the unseen tasks using seen tasks procedure. We evaluated the SEED using both Windows and Android malware datasets. Our experiments show that the proposed method, using 20% labeled data on seen tasks, achieves an average improvement (in terms of AUT) of 40% on the BODMAS dataset and 14% on the AndroZoo dataset for detecting unseen malware across varying labeling budgets, compared to HCL[] (the semi-supervised adaptation of HCL). Further, its performance is competitive with HCL[] on APIGraph dataset. Eventually, we introduce a delayed buffer update strategy to mitigate the effect of label noise in unseen tasks. This reduces noise propagation during replay and improves learning stability. Our code is available at the following link[1].