SSCL-TransMD: Semi-Supervised Continual Learning Transformer for Malicious Software Detection
Source abstract
Abstract
Machine learning-based malware (malicious software) detection methods have a wide range of real-world applications. However, these types of approaches suffer from the fatal problem of “model aging”, in which the validity of the model decreases rapidly as the malware continues to evolve and variants emerge continuously. The model aging problem is usually solved by model retraining, which relies on lots of labeled samples obtained at great expense. To address this challenge, this paper proposes a semi-supervised continuous learning malware detection model based on Transformer. Firstly, this model improves the lifelong semi-supervised mixture algorithm to dynamically adjust the weighted combination of new sample sequences and historical ones to solve the imbalance problem. Secondly, the Learning with Local and Global Consistency algorithm is used to iteratively compute similarity scores for the unlabeled samples in the mixed samples to obtain pseudo-labels. Lastly, the Multilayer Perceptron is applied for malware classification. To validate the effectiveness of the model, this paper conducts experiments on the CICMalDroid2020 dataset. The experimental results show that the proposed model performs better than existing deep learning detection models. The F1 score has an average improvement of 1.27% compared to other models when conducting binary classification. And, after inputting hybrid samples, including historical data and new data, four times, the F1 score is still 1.96% higher than other models.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Anomaly Detection Techniques and Applications · Network Security and Intrusion Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
State Key Laboratory of Complex Electromagnetic Environment Effects on Electronics and Information System, Luoyang 471000, China
College of Cyberspace, Hangzhou Dianzi University, Hangzhou 310018, China
Funding
Key Technology Research and Development Program of the Zhejiang Province · General Research Program of the Department of Education
References (30)
Show source-provided references
1. Catastrophic interference in connectionist networks: The sequential learning problem10.1016/S0079-7421(08)60536-8 ↗
2. Catastrophic forgetting in connectionist networks10.1016/S1364-6613(99)01294-2 ↗
3. Obfuscated malware detection using deep generative model based on global/local features10.1016/j.cose.2021.102501 ↗
4. The rise of machine learning for detection and classification of malware: Research developments, trends and challenge10.1016/j.jnca.2019.102526 ↗
5. A comprehensive survey on machine learning approaches for malware detection in IoT-based enterprise information system10.1080/17517575.2021.2023764 ↗
6. Faiz, M.F.I., Hussain, M.A., and Marchang, N. (2021). The Complex, Intelligent and Software Intensive Systems: Proceedings of the 14th International Conference on Complex, Intelligent and Software Intensive Systems (CISIS-2020), Springer.
7. Alqahtani, E.J., Zagrouba, R., and Almuhaideb, A. (2019, January 10–13). A survey on android malware detection techniques using machine learning algorithms. Proceedings of the 2019 Sixth International Conference on Software Defined Systems (SDS), Rome, Italy.10.1109/SDS.2019.8768729 ↗
8. Lashkari, A.H., Kadir, A.F.A., Taheri, L., and Ghorbani, A.A. (2018, January 22–25). Toward developing a systematic approach to generate benchmark android malware datasets and classification. Proceedings of the 2018 International Carnahan Conference on Security Technology (ICCST), Montreal, QC, Canada.10.1109/CCST.2018.8585560 ↗
9. Ray, S. (2019, January 14–16). A quick review of machine learning algorithms. Proceedings of the 2019 International Conference on Machine Learning, Big Data, Cloud and Parallel Computing (COMITCon), Faridabad, India.10.1109/COMITCon.2019.8862451 ↗
10. Ilham, S., Abderrahim, G., and Abdelhakim, B.A. (2019). The Innovations in Smart Cities Applications Edition 2: The Proceedings of the Third International Conference on Smart City Applications, Springer.
11. Zhao, C., Zheng, W., Gong, L., Zhang, M., and Wang, C. (2018, January 17–19). Quick and accurate android malware detection based on sensitive APIs. Proceedings of the 2018 IEEE International Conference on Smart Internet of Things (SmartIoT), Xi’an, China.10.1109/SmartIoT.2018.00034 ↗
12. Evaluation of advanced ensemble learning techniques for Android malware detection10.1142/S2196888820500086 ↗
13. Droidfusion: A novel multilevel classifier fusion approach for android malware detection10.1109/TCYB.2017.2777960 ↗
14. Birman, Y., Hindi, S., Katz, G., and Shabtai, A. (2019). Transferable Cost-Aware Security Policy Implementation for Malware Detection Using Deep Reinforcement Learning. arXiv.
15. Deep learning based cross architecture internet of things malware detection and classification10.1016/j.cose.2022.102779 ↗
16. DL-Droid: Deep learning based android malware detection using real devices10.1016/j.cose.2019.101663 ↗
17. Detecting Android malware using long short-term memory (LSTM)10.3233/JIFS-169424 ↗
18. Xu, K., Li, Y., Deng, R.H., and Chen, K. (2018, January 24–26). Deeprefiner: Multi-layer android malware detection system applying deep neural networks. Proceedings of the 2018 IEEE European Symposium on Security and Privacy (EuroS&P), London, UK.10.1109/EuroSP.2018.00040 ↗
19. Static malware detection and attribution in android byte-code through an end-to-end deep system10.1016/j.future.2019.07.070 ↗
20. AdMat: A CNN-on-matrix approach to Android malware detection and classification10.1109/ACCESS.2021.3063748 ↗
21. Oak, R., Du, M., Yan, D., Takawale, H., and Amit, I. (2019, January 15). Malware detection on highly imbalanced data through sequence modeling. Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security, London, UK.10.1145/3338501.3357374 ↗
22. CHILD: A first step towards continual learning10.1023/A:1007331723572 ↗
23. A continual learning survey: Defying forgetting in classification tasks
24. Zhang, L., Deng, Z., Kawaguchi, K., Ghorbani, A., and Zou, J. (2020). How does mixup help with robustness and generalization?. arXiv.
25. Hou, S., Pan, X., Loy, C.C., Wang, Z., and Lin, D. (2019, January 15–20). Learning a unified classifier incrementally via rebalancing. Proceedings of the IEEE/CVF conference on Computer Vision and Pattern Recognition, Long Beach, CA, USA.10.1109/CVPR.2019.00092 ↗
26. Santos, I., Nieves, J., and Bringas, P.G. (2011, January 6–8). Semi-supervised learning for unknown malware detection. Proceedings of the International Symposium on Distributed Computing and Artificial Intelligence, Salamanca, Spain.10.1007/978-3-642-19934-9_53 ↗
27. Artificial neural networks (the multilayer perceptron)—A review of applications in the atmospheric sciences10.1016/S1352-2310(97)00447-0 ↗
28. Narayanan, A., Yang, L., Chen, L., and Jinliang, L. (2016, January 24–29). Adaptive and scalable android malware detection through online learning. Proceedings of the 2016 International Joint Conference on Neural Networks (IJCNN), Vancouver, BC, Canada.10.1109/IJCNN.2016.7727508 ↗
29. Xu, K., Li, Y., Deng, R., Chen, K., and Xu, J. (2019, January 17–19). Droidevolver: Self-evolving android malware detection system. Proceedings of the 2019 IEEE European Symposium on Security and Privacy (EuroS&P), Stockholm, Sweden.10.1109/EuroSP.2019.00014 ↗
30. Mahdavifar, S., Kadir, A.F.A., Fatemi, R., Alhadidi, D., and Ghorbani, A.A. (2020, January 17–22). Dynamic android malware category classification using semi-supervised deep learning. Proceedings of the 2020 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech), Calgary, AB, Canada.10.1109/DASC-PICom-CBDCom-CyberSciTech49142.2020.00094 ↗