SEED: 预算约束下应对概念漂移的半监督持续恶意软件检测
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
AI总结：
提出SEED方法，结合定制二元交叉熵损失与半监督持续学习和主动学习，在有限标注下有效检测未知恶意软件，平均AUT提升40%（BODMAS）和14%（AndroZoo）。
摘要：
基于机器学习的恶意软件检测器会随着良性应用和恶意应用中的概念漂移而随时间变得过时。最近的方法依赖完全标注数据，并利用层次对比损失（HCL）与主动学习，通过利用恶意软件表示中的语义结构来提高对漂移的鲁棒性。然而，在安全领域获取标注数据很困难。在部分标注设置下，HCL在检测未知恶意软件时性能显著下降，尤其是在BODMAS等可能缺乏强语义结构的数据集上。本文提出SEED，一种在有限监督下进行恶意软件检测的语义结构无关方法。SEED将定制的二元交叉熵目标与半监督持续学习和主动学习相结合。对于部分标注的已见任务，未标注样本通过奇异值分解投影到从先前已见数据构建的表示空间中，并与合适的标注样本配对以鼓励表示一致性。对于完全未标注的未见任务，使用表示空间中的余弦距离量化不确定性，并选择最不确定的样本供分析师标注。我们在Windows和Android恶意软件数据集上评估SEED。在已见任务上仅使用20%标注数据，与HCL*（HCL的半监督适应）相比，SEED在未知恶意软件检测上平均AUT提升40%（BODMAS）和14%（AndroZoo），同时在APIGraph上保持竞争力。最后，我们引入延迟缓冲区更新策略以减少重放期间的标签噪声传播并提高学习稳定性。
英文摘要：
Machine learning based malware detectors become obsolete over time due to concept drift in benign and malware applications. Recent methods rely on fully labeled data and use hierarchical contrastive loss (HCL) with active learning to improve robustness against drift by exploiting semantic structure in malware representations. However, obtaining labeled data in the security domain is difficult. Under partially labeled settings, HCL suffers significant performance degradation in detecting unseen malware, especially on datasets such as BODMAS where strong semantic structure may not exist. In this paper, we propose SEED, a semantic-structure-agnostic method for malware detection under limited supervision. SEED combines a tailored binary cross-entropy objective with semi-supervised continual learning and active learning. For partially labeled seen tasks, unlabeled samples are projected into a representation space constructed from previously seen data using singular value decomposition, and paired with suitable labeled samples to encourage representation consistency. For unseen tasks with fully unlabeled data, uncertainty is quantified using cosine distance in representation space, and the most uncertain samples are selected for analyst labeling. We evaluate SEED on both Windows and Android malware datasets. Using only 20% labeled data on seen tasks, SEED achieves average AUT improvements of 40% on BODMAS and 14% on AndroZoo for unseen malware detection compared to HCL* (the semi-supervised adaptation of HCL), while remaining competitive on APIGraph. Finally, we introduce a delayed buffer update strategy to reduce label noise propagation during replay and improve learning stability.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
