Continuous Learning for Android Malware Detection (2023-02-08T00:00:00.000000Z)

TL;DR

This paper proposes a new hierarchical contrastive learning scheme, and a new sample selection technique to continuously train the Android malware classifier, and shows that this approach maintains more consistent performance across a seven-year time period than past methods.

Abstract

Machine learning methods can detect Android malware with very high accuracy. However, these classifiers have an Achilles heel, concept drift: they rapidly become out of date and ineffective, due to the evolution of malware apps and benign apps. Our research finds that, after training an Android malware classifier on one year's worth of data, the F1 score quickly dropped from 0.99 to 0.76 after 6 months of deployment on new test samples. In this paper, we propose new methods to combat the concept drift problem of Android malware classifiers. Since machine learning technique needs to be continuously deployed, we use active learning: we select new samples for analysts to label, and then add the labeled samples to the training set to retrain the classifier. Our key idea is, similarity-based uncertainty is more robust against concept drift. Therefore, we combine contrastive learning with active learning. We propose a new hierarchical contrastive learning scheme, and a new sample selection technique to continuously train the Android malware classifier. Our evaluation shows that this leads to significant improvements, compared to previously published methods for active learning. Our approach reduces the false negative rate from 14% (for the best baseline) to 9%, while also reducing the false positive rate (from 0.86% to 0.48%). Also, our approach maintains more consistent performance across a seven-year time period than past methods.

Authors

David A. Wagner

2 papers

Yizheng Chen

2 papers

Zhoujie Ding

1 papers

TL;DR

Abstract

Authors

References60 items

Is It Overkill? Analyzing Feature-Space Concept Drift in Malware Detectors

OpenOOD: Benchmarking Generalized Out-of-Distribution Detection

Meta-Query-Net: Resolving Purity-Informativeness Dilemma in Open-set Active Learning

On the Limitations of Continual Learning for Malware Classification

Is Self-Supervised Learning More Robust Than Supervised Learning?

Out-of-distribution Detection with Deep Nearest Neighbors

A Comparative Survey of Deep Active Learning

A Survey on Active Deep Learning: From Model Driven to Data Driven

HCSC: Hierarchical Contrastive Selective Coding

Active Learning at the ImageNet Scale

Investigating Labelless Drift Adaptation for Malware Detection

Can We Leverage Predictive Uncertainty to Detect Dataset Shift and Adversarial Examples in Android Malware Detection?

BODMAS: An Open Dataset for Learning based Temporal Analysis of PE Malware

A Neural Pre-Conditioning Active Learning Algorithm to Reduce Label Complexity

Enhancing State-of-the-art Classifiers with API Semantics to Detect Evolved Android Malware

Transcending TRANSCEND: Revisiting Malware Classification in the Presence of Concept Drift

Energy-based Out-of-distribution Detection

A Survey of Deep Active Learning

A Survey of Active Learning for Text Classification using Deep Neural Networks

Unsupervised Feature Learning by Cross-Level Instance-Group Discrimination

Contrastive Training for Improved Out-of-Distribution Detection

AVclass2: Massive Malware Tag Extraction from AV Labels

Unsupervised Learning of Visual Features by Contrasting Cluster Assignments

Prototypical Contrastive Learning of Unsupervised Representations

Supervised Contrastive Learning

State-Relabeling Adversarial Active Learning

Calibrating Deep Neural Networks using Focal Loss

A Simple Framework for Contrastive Learning of Visual Representations

Momentum Contrast for Unsupervised Visual Representation Learning

DroidEvolver: Self-Evolving Android Malware Detection System

Learning Loss for Active Learning

Recent Advances in Open Set Recognition: A Survey

TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time

Hierarchical Novelty Detection for Visual Object Recognition

Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks

Deep Ground Truth Analysis of Current Android Malware

On Calibration of Modern Neural Networks

Context-Aware, Adaptive, and Scalable Android Malware Detection Through Online Learning

MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models

Simple and Scalable Predictive Uncertainty Estimation using Deep Ensembles

Prescience: Probabilistic Guidance on the Retraining Conundrum for Malware Detection

Adaptive and scalable Android malware detection through online learning

AndroZoo: Collecting Millions of Android Apps for the Research Community

Reviewer Integration and Performance Measurement for Malware Detection

Dropout as a Bayesian Approximation: Representing Model Uncertainty in Deep Learning

Unsupervised Visual Representation Learning by Context Prediction

FaceNet: A unified embedding for face recognition and clustering

Are Your Training Datasets Yet Relevant? - An Investigation into the Importance of Timeline in Machine Learning-Based Malware Detection

Et al

A tutorial on conformal prediction

Dimensionality Reduction by Learning an Invariant Mapping

This paper is included in the Proceedings of the 31st USENIX Security Symposium.

CADE: Detecting and Explaining Concept Drift Samples for Security Applications

Best practices in pool-based active learning for image classification

Transcend: Detecting Concept Drift in Malware Classification Models

Context-Aware

DREBIN: Effective and Explainable Detection of Android Malware in Your Pocket

Active Learning Literature Survey

We start with the following set of initial training samples to train all models before doing active learning. We extract

One sample is benign and the other is malicious

Field of Study

Journal Information

Name

Volume

Venue Information

Name

Type

URL

Alternate Names