用伪标签方法让杀毒模型自动适应新型恶意软件
ADAPT: A Pseudo-labeling Approach to Combat Concept Drift in Malware Detection
- 通过伪标签技术利用无标注数据，减少人工标注依赖
- 在5个不同数据集上均优于现有方法，稳定提升检测效果
- 适用于各类模型，特别适合需要持续更新的杀毒系统
机器学习模型常用于恶意软件分类，但因概念漂移导致性能随时间下降。模型适应变化的数据分布需频繁更新，而传统方法依赖昂贵的真实标签标注。尽管主动学习可降低标注负担，但在恶意软件检测中利用无标签数据的半监督学习仍研究不足。本文提出 exttt{ADAPT}，一种新型伪标签半监督算法，应对概念漂移问题。该方法模型无关，可应用于神经网络和树基模型。我们在涵盖 Android、Windows 和 PDF 领域的五个不同恶意软件检测数据集上进行了广泛实验。结果表明，本方法在所有数据集上均持续优于基线模型和竞争性基准。该工作为机器学习模型在恶意软件检测中有效应对概念漂移提供了新路径。
原文摘要 · Abstract (English)
Machine learning models are commonly used for malware classification; however, they suffer from performance degradation over time due to concept drift. Adapting these models to changing data distributions requires frequent updates, which rely on costly ground truth annotations. While active learning can reduce the annotation burden, leveraging unlabeled data through semi-supervised learning remains a relatively underexplored approach in the context of malware detection. In this research, we introduce \texttt{ADAPT}, a novel pseudo-labeling semi-supervised algorithm for addressing concept drift. Our model-agnostic method can be applied to various machine learning models, including neural networks and tree-based algorithms. We conduct extensive experiments on five diverse malware detection datasets spanning Android, Windows, and PDF domains. The results demonstrate that our method consistently outperforms baseline models and competitive benchmarks. This work paves the way for more effective adaptation of machine learning models to concept drift in malware detection.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。