arXiv:2605.24903cs.CRcs.LG2026-05

在标注数据有限时,用半监督持续学习提升恶意软件检测对概念漂移的适应能力。

SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget

论文配图:SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
图 1 · 摘自论文原文
  • 不依赖语义结构,结合二元交叉熵与半监督持续学习
  • 仅用20%标注数据,对未知恶意软件检测准确率提升40%(BODMAS)
  • 适合资源受限的实时安全检测场景,尤其对抗未见威胁

基于机器学习的恶意软件检测器会因良性与恶意程序的概念漂移而过时。现有方法依赖全量标注数据,利用分层对比损失(HCL)与主动学习,通过挖掘恶意软件表征中的语义结构来增强鲁棒性。然而,在安全领域获取标注数据极为困难。在部分标注设置下,当数据集如BODMAS缺乏强语义结构时,HCL性能显著下降。本文提出SEED,一种不依赖语义结构的有限监督恶意软件检测方法。SEED结合定制化的二元交叉熵目标、半监督持续学习与主动学习。对于部分标注的已知任务,使用奇异值分解将未标注样本投影至先前已知数据构建的表征空间,并与合适标签样本配对以促进表征一致性;对于完全无标注的未知任务,通过表征空间中的余弦距离量化不确定性,选取最不确定样本供分析师标注。我们在Windows与Android恶意软件数据集上评估了SEED。仅使用20%标注数据,与半监督版HCL*相比,SEED在BODMAS上平均检测准确率提升40%,在AndroZoo上提升14%,同时在APIGraph上保持竞争力。此外,我们引入延迟缓冲区更新策略,减少重放过程中的标签噪声传播,提升学习稳定性。

原文摘要 · Abstract (English)

Machine learning based malware detectors become obsolete over time due to concept drift in benign and malware applications. Recent methods rely on fully labeled data and use hierarchical contrastive loss (HCL) with active learning to improve robustness against drift by exploiting semantic structure in malware representations. However, obtaining labeled data in the security domain is difficult. Under partially labeled settings, HCL suffers significant performance degradation in detecting unseen malware, especially on datasets such as BODMAS where strong semantic structure may not exist. In this paper, we propose SEED, a semantic-structure-agnostic method for malware detection under limited supervision. SEED combines a tailored binary cross-entropy objective with semi-supervised continual learning and active learning. For partially labeled seen tasks, unlabeled samples are projected into a representation space constructed from previously seen data using singular value decomposition, and paired with suitable labeled samples to encourage representation consistency. For unseen tasks with fully unlabeled data, uncertainty is quantified using cosine distance in representation space, and the most uncertain samples are selected for analyst labeling. We evaluate SEED on both Windows and Android malware datasets. Using only 20% labeled data on seen tasks, SEED achieves average AUT improvements of 40% on BODMAS and 14% on AndroZoo for unseen malware detection compared to HCL* (the semi-supervised adaptation of HCL), while remaining competitive on APIGraph. Finally, we introduce a delayed buffer update strategy to reduce label noise propagation during replay and improve learning stability.

恶意软件检测持续学习半监督主动学习

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。