Pith. sign in

REVIEW 3 major objections 5 minor 92 references

ADAPT: A Pseudo-labeling Approach to Combat Concept Drift in Malware Detection

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Pseudo-labeling keeps malware detectors accurate as threats evolve

desk verdict Solid empirical package with a real overclaim: ADAPT helps on most but not all of its own experiments, and the theory appendix is asserted, not proven. read the letter →

arxiv 2507.08597 v2 pith:XYMANMVG submitted 2025-07-11 cs.LG cs.CR

Md Tanvirul Alam , Aritran Piplai , Nidhi Rastogi This is my paper
classification cs.LGcs.CR
keywords conceptdriftmalwaredetectionpseudo-labelingsemi-supervisedlearningself-trainingactiveclass-dependentthresholdingmixup
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that pseudo-labeling alone—retraining a malware detector on its own confident predictions over unlabeled, time-shifted samples—can keep the detector accurate as malware evolves, without waiting for costly ground-truth labels. The proposed algorithm, ADAPT, adds three safeguards against the self-poisoning that usually breaks self-training in this setting: class-specific thresholds that adapt to drift, data augmentation filtered for label consistency, and mixup regularization to calibrate confidence. Across five malware datasets spanning Android, Windows, and PDF files, the adapted models' F1 scores consistently beat both offline models and four self-training baselines, with the largest gains coming from reduced false negatives. If this holds, security teams could update deployed detectors month by month using only the unlabeled stream, slashing exposure during label delays.

What carries the argument

The load-bearing mechanism is drift-aware pseudo-label selection: instead of one fixed confidence threshold, ADAPT keeps separate thresholds $\tau_m$ and $\tau_b$ for malware and benign classes and updates them as $\tau_m^{\text{updated}} = \lambda \mu_m + (1-\lambda)\tau_m$ (similarly for benign), where $\mu_m$ and $\mu_b$ are the model's mean predicted probabilities on the unlabeled month's data. The paper motivates this with the observation that the malware class drifts more than the benign class, so class-specific thresholds keep enough drifted malware in the training pool. Two further components stabilize the self-training loop: feature-space augmentation restricted to same-class replacements and filtered by prediction consistency, and mixup interpolation, which the paper shows improves confidence calibration. The theoretical support is the gradual domain shift self-training bound from [43], translated into a class-asymmetric form with thresholded and regularized terms.

What would settle it

Run ADAPT on any of the five datasets after injecting a single test month dominated by a previously unseen malware family with no gradual ramp-up: if the pseudo-label update lowers F1 below the offline baseline or raises false negatives for that month, the gradual-shift premise that the bound relies on is violated.

Watch

Extended reading notes

Core claim

ADAPT's central claim is that a classifier can be kept current under gradual concept drift by periodically retraining on pseudo-labels selected by class-dependent adaptive thresholds. Because malware drifts more than benign software, the algorithm sets a separate confidence threshold for each class, then moves each threshold toward the model's current mean confidence on that class, so the pseudo-labeled pool tracks the shifting distribution. Retraining combines original labels, pseudo-labeled samples, label-consistent augmented samples, and mixup interpolations, which together reduce confirmation bias and keep predicted confidence aligned with actual accuracy. In the reported experiments, ADAPT improves F1 over the corresponding offline models on all five datasets, with XGBoost+ADAPT best on Drebin, BODMAS, and EMBER, MLP+ADAPT best on APIGraph, and Random Forest+ADAPT best on the PDF dataset; it also lowers false negatives and Absolute Exposure, combines with active learning under a 50-label monthly budget, and transfers to multiclass family classification.

Load-bearing premise

The whole adaptation story rests on the assumption that malware drift is gradual—each month's distribution is only a small step from the last—and that the share of malware versus benign samples stays roughly constant; if a new malware family lands all at once, the theoretical guarantee and the pseudo-labeling safeguard have no footing.

Editorial extensions

If this is right

  • Deployed malware detectors can be refreshed monthly on unlabeled test traffic, so the damage from delayed sandbox or analyst labels shrinks.
  • Because ADAPT is model-agnostic, teams can keep fast, interpretable models like Random Forest or XGBoost and still track drift, avoiding a forced switch to neural networks.
  • With a tiny annotation budget of 50 samples per month, ADAPT plus active learning outperforms random labeling and the prior active-learning baseline on both Android datasets.
  • When the original training set cannot be retained for privacy or storage reasons, the source-free variant still improves over the offline baseline on the first year of Android test data.
  • The same algorithm extends to multiclass malware family classification, where it raises macro F1 over XGBoost on BODMAS and EMBER.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The asymmetric-threshold idea points beyond malware: any detection task where one class evolves faster than the other, such as fraud or intrusion detection, could use the same class-specific pseudo-label selection, though threshold adaptation would need retuning for different class imbalances.
  • The label-consistency filter likely biases the pseudo-labeled pool toward samples the current decision boundary already handles, which could under-represent genuinely novel malware; a testable extension would track how much of the F1 gain comes from boundary samples versus samples deep in the existing region.
  • If drift turns out to be abrupt rather than gradual, the appendix's bound no longer applies and the margin over offline baselines should narrow; a stress test with sudden new families would reveal where the gradual assumption starts to bite.
  • The mixup component's main practical benefit may be calibration rather than raw accuracy: better-calibrated confidence makes the class thresholds meaningful, so the two mechanisms should be evaluated jointly rather than as independent tricks.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes ADAPT, a pseudo-labeling semi-supervised algorithm for malware detection under concept drift. The method combines class-dependent adaptive pseudo-label thresholds, class-consistent feature-space augmentation, and mixup regularization to retrain a base classifier on unlabeled monthly data. The authors evaluate ADAPT with Random Forest, XGBoost, MLP, and SVM on five malware datasets (Drebin, APIGraph, BODMAS, EMBER, PDF), comparing against offline models and four self-training baselines, with additional experiments on active learning, multiclass family classification, and source-free adaptation. The central claim is that ADAPT 'consistently outperforms baseline models and competitive benchmarks' and achieves state-of-the-art results across all tasks.

Significance. If the empirical results are taken as presented, ADAPT is a useful model-agnostic recipe for label-efficient drift adaptation in malware detection: it improves F1 and reduces false negatives on most of the 15 base-model/dataset cells, and the paper provides unusually broad validation, including multiple domains, multiple base learners, ablations, Wilcoxon tests, active learning, multiclass problems, source-free adaptation, and a computational overhead analysis. The GitHub link and the detailed hyperparameter tables also support reproducibility. However, the headline claim is stronger than the evidence: several ADAPT cells lose to their own base models and to MORSE/offline XGBoost, and many Wilcoxon tests are non-significant. The theoretical appendix does not repair this, because the extension in Eqs. (9)–(13) is asserted rather than derived. With a qualified, cell-specific claim the contribution would be solid; as written, the manuscript overstates its central result.

major comments (3)
  1. [Abstract; Section VII, Table II] The abstract and the first paragraph of Section VII claim that ADAPT 'consistently outperforms baseline models and competitive benchmarks.' Table II contradicts this literal claim: RF+ADAPT is below plain RF on BODMAS (96.1 vs 96.3) and EMBER (86.2 vs 86.3), and MLP+ADAPT is below plain MLP on PDF (97.2 vs 97.4). Against the listed benchmarks, MORSE outperforms RF+ADAPT and MLP+ADAPT on BODMAS (98.8 vs 96.1 and 98.6), and offline XGBoost outperforms MLP+ADAPT on PDF (97.9 vs 97.2). The paper needs to state precisely where ADAPT helps (e.g., XGBoost across all five datasets, and the Android datasets for all base models) and where it does not; as written, the headline claim is not supported by the paper's own numbers.
  2. [Section VII-E, Table VI] The Wilcoxon signed-rank tests do not support blanket consistency. For Random Forest the p-values are 0.6875 (BODMAS), 0.7646 (EMBER), and 0.4375 (PDF); for MLP the p-value on PDF is 0.15625. These non-significant values align with the losing or flat cells in Table II. The paper should report which model–dataset combinations are statistically significant, ideally with correction for multiple comparisons, and should qualify any claim of consistent superiority accordingly.
  3. [Appendix H, Eqs. (8)–(13)] The theoretical extension is asserted rather than derived. Equation (9) states that thresholding reduces ramp loss, but no proof is given that the filtered class-conditional distributions remain within the same gradual-shift regime with the same ρm and ρb used in Eq. (8). Equation (13) replaces the finite-sample term n by nτm,τb in the bound, but the weighted-mixture derivation is not shown. The statement that augmentation and mixup reduce R is also asserted and is explicitly deferred ('A detailed theoretical analysis of these effects is left for future work'). Moreover, Theorem 1 assumes equal label marginals P(Y)=Q(Y), which is at odds with the paper's motivating scenario of changing malware prevalence. The manuscript should either provide the missing steps or explicitly label this section as an intuitive adaptation of Kumar et al., not a proof.
minor comments (5)
  1. [Figure 9; Section V-C] Figure 9 caption refers to 'test months' for the PDF dataset, but Section V-C describes weekly data; please correct the caption to say weeks.
  2. [Section VII-C, Table III] The text says 'In most scenarios, FPR is maintained or reduced alongside FNR,' but Table III shows a negative ΔFPR (i.e., increased FPR) in 8 of 15 cells, including XGBoost on APIGraph (−1.30) and RF on EMBER (−0.09). The summary sentence should be revised to match the table.
  3. [Section IV-A, Eqs. (1)–(4)] The mean probabilities µm and µb are computed from the subsets D_mu and D_bu that are themselves defined by the current model's predictions; the pseudocode should state whether these means are computed before thresholding and whether the threshold update is applied once per month or iteratively.
  4. [Section VI-C and Section VIII] The main experiments use a fixed budget of 200 random hyperparameter searches, while the active-learning experiments use 100 iterations; the paper should clarify whether this difference affects the comparison, or use the same budget for all methods.
  5. [Table II] Table II reports means over five runs but does not report standard deviations or confidence intervals, even though Section VI-D says both mean and standard deviation are computed; adding the spread would help readers judge the losing cells.

Circularity Check

0 steps flagged · score 1.0 of 10

No circular derivation: ADAPT's core claim is supported by held-out temporal evaluation, and its theoretical backing is imported from external work.

full rationale

ADAPT's central derivation is an algorithm plus an empirical evaluation, not a self-referential fit. The model is trained on an initial labeled period, updated monthly with pseudo-labels selected by the adaptive thresholds in Eqs. (3)-(4), augmented and mixup-regularized, and then measured on future test months. The evaluation is temporally held out: Section VI-C states hyperparameters are "jointly tuned ... using the validation set" under a fixed 200-trial random search, and the test periods in Table I are strictly later than the validation periods, so the reported F1/FPR/FNR numbers are not fitted to the test labels. The adaptive threshold is a selection rule computed from unlabeled model probabilities; it is not a prediction of the evaluation metric, and any self-referential element is the standard self-training mechanism whose guarantees are imported from Kumar et al. [43], an external source. Appendix H's extension to class-specific thresholds is asserted rather than fully derived (Eqs. (9)-(13), with "A detailed theoretical analysis of these effects is left for future work"), which weakens the theory but does not make the empirical result circular. The authors' self-citations [2] and [3] support hyperparameter-tuning methodology and related-work context, not the load-bearing claim. The abstract's "consistently outperforms" statement is contradicted by the paper's own Table II in three cells (e.g., RF+ADAPT 96.1 vs RF 96.3 on BODMAS), but that is an overclaim relative to the paper's own data, which is a correctness/calibration concern rather than a circularity of derivation.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The algorithm introduces five tuned hyperparameters that directly control pseudo-label selection and training; no new physical or conceptual entities are postulated. The empirical method also relies on gradual-shift theory from Kumar et al. plus several unproved extension assumptions about thresholding, augmentation, and mixup.

free parameters (5)
  • tau_b (benign base threshold) = e.g., 0.96-0.98 on APIGraph; tuned per dataset/model
    Controls which benign pseudo-labels are accepted; central to adaptive thresholding.
  • tau_m (malware base threshold) = e.g., 0.63-0.70 on APIGraph; tuned per dataset/model
    Lower threshold admits drifted malware samples but also introduces noisy labels.
  • lambda (adaptation weight) = searched in [0.0, 0.5]
    Blends the model's mean class confidence with the base threshold; determines how quickly thresholds adapt.
  • p_a (masking probability) = searched in [0.0, 0.2]
    Controls augmentation strength; the paper shows too-high values flip labels.
  • alpha (mixup parameter) = searched in [0.0, 0.2]
    Controls interpolation strength in mixup and affects confidence calibration.
assumptions (5)
  • domain assumption Gradual shift bound rho(P_t, P_{t+1}) < epsilon and equal label marginals P(Y)=Q(Y)
    Appendix H imports Kumar et al.'s Theorem 3.2; if the shift is not gradual, the bound does not apply.
  • standard math The initial model has bounded ramp loss alpha_0 and lies in a hypothesis space of radius R
    Needed for Eq. (6) and Corollary 1 in Appendix H.
  • domain assumption Malware shifts more than benign samples, rho_m > rho_b
    Motivates separate thresholds; supported by Figure 3 but assumed in the Appendix H extension.
  • domain assumption Same-class feature replacement preserves labels and the model-consistency filter reduces noise
    Section IV-B uses this to justify augmentation; the authors note generated features may not be valid samples.
  • ad hoc to paper Mixup and augmentation tighten the generalization bound by reducing capacity R
    Appendix H-C asserts implicit regularization reduces R, but no derivation or empirical support is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ADAPT: A Pseudo-labeling Approach to Combat Concept Drift in Malware Detection." pith.science (2026). https://pith.science/paper/XYMANMVG

@misc{pith2026250708597,
  author       = {Pith},
  title        = {Pith review of: ADAPT: A Pseudo-labeling Approach to Combat Concept Drift in Malware Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XYMANMVG}},
  note         = {Machine review of arXiv:2507.08597}
}
read the original abstract

Machine learning models are commonly used for malware classification; however, they suffer from performance degradation over time due to concept drift. Adapting these models to changing data distributions requires frequent updates, which rely on costly ground truth annotations. While active learning can reduce the annotation burden, leveraging unlabeled data through semi-supervised learning remains a relatively underexplored approach in the context of malware detection. In this research, we introduce \texttt{ADAPT}, a novel pseudo-labeling semi-supervised algorithm for addressing concept drift. Our model-agnostic method can be applied to various machine learning models, including neural networks and tree-based algorithms. We conduct extensive experiments on five diverse malware detection datasets spanning Android, Windows, and PDF domains. The results demonstrate that our method consistently outperforms baseline models and competitive benchmarks. This work paves the way for more effective adaptation of machine learning models to concept drift in malware detection.

Figures

Figures reproduced from arXiv: 2507.08597 by the authors.

Figure 2
Figure 2. Adaptation to distribution shift using pseudo-labels. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Mean and standard deviation of predicted probabilities [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Percentage of Drebin and APIGraph samples where [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figures from the paper (9 more)
Figure 5
Figure 5. Figure 5: F1-score over test months on APIGraph dataset. [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Performance on the Drebin dataset: F1 score (left), [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 9
Figure 9. Figure 9: Performance on the PDF dataset: F1 score (left), FNR [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]
Figure 10
Figure 10. Figure 10: Exposure over test months on different datasets. [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 11
Figure 11. Figure 11: Pseudo-labeling errors during the test months on [PITH_FULL_IMAGE:figures/full_fig_p010_11.png]
Figure 12
Figure 12. Figure 12: Calibration plots for the XGBoost model on the [PITH_FULL_IMAGE:figures/full_fig_p011_12.png]
Figure 13
Figure 13. Figure 13: F1 score on Drebin (left) and APIGraph (right) [PITH_FULL_IMAGE:figures/full_fig_p017_13.png]
Figure 14
Figure 14. Figure 14: Impact of catastrophic forgetting on Drebin: XGBoost [PITH_FULL_IMAGE:figures/full_fig_p018_14.png]
Figure 15
Figure 15. Figure 15: Impact of catastrophic forgetting on the APIGraph [PITH_FULL_IMAGE:figures/full_fig_p018_15.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

92 extracted references · 67 canonical work pages

  1. [1]

    When malware is packin’heat; limits of machine learning classifiers based on static analysis features

    Hojjat Aghakhani, Fabio Gritti, Francesco Mecca, Martina Lindorfer, Stefano Ortolani, Davide Balzarotti, Giovanni Vigna, and Christopher Kruegel. When malware is packin’heat; limits of machine learning classifiers based on static analysis features. In NDSS, 2020

    2020

  2. [2]

    Revisit- ing static feature-based android malware detection

    Md Tanvirul Alam, Dipkamal Bhusal, and Nidhi Rastogi. Revisit- ing static feature-based android malware detection. arXiv preprint arXiv:2409.07397, 2024

    work page arXiv 2024

  3. [3]

    Morph: Towards automated concept drift adaptation for malware detection

    Md Tanvirul Alam, Romy Fieblinger, Ashim Mahara, and Nidhi Ras- togi. Morph: Towards automated concept drift adaptation for malware detection. arXiv preprint arXiv:2401.12790 , 2024

    arXiv 2024

  4. [4]

    Random forest classification for detecting android malware

    Mohammed S Alam and Son T Vuong. Random forest classification for detecting android malware. In Proc. IEEE Int. Conf. Green Computing and Communications, pages 663–669, 2013

    2013

  5. [5]

    Geometric dataset distances via optimal transport

    David Alvarez-Melis and Nicolo Fusi. Geometric dataset distances via optimal transport. Advances in Neural Information Processing Systems , 33:21428–21439, 2020

    2020

  6. [6]

    Self-training: A survey

    Massih-Reza Amini, Vasilii Feofanov, Loic Pauletto, Lies Hadjadj, Emilie Devijver, and Yury Maximov. Self-training: A survey. arXiv preprint arXiv:2202.12040, 2022

    arXiv 2022

  7. [7]

    H. S. Anderson and P. Roth. EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models. ArXiv e-prints , April 2018

    2018

  8. [8]

    Learning to evade static pe machine learning malware models via reinforcement learning

    Hyrum S Anderson, Anant Kharkar, Bobby Filar, David Evans, and Phil Roth. Learning to evade static pe machine learning malware models via reinforcement learning. arXiv preprint arXiv:1801.08917 , 2018

    arXiv 2018

Show all 92 references
  1. [9]

    Insomnia: towards concept-drift robustness in network intrusion detection

    Giuseppina Andresini, Feargus Pendlebury, Fabio Pierazzi, Corrado Loglisci, Annalisa Appice, and Lorenzo Cavallaro. Insomnia: towards concept-drift robustness in network intrusion detection. In Proceedings of the 14th ACM workshop on artificial intelligence and security , 2021

    2021

  2. [10]

    Sok: The impact of unlabelled data in cyberthreat detection

    Giovanni Apruzzese, Pavel Laskov, and Aliya Tastemirova. Sok: The impact of unlabelled data in cyberthreat detection. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P) . IEEE, 2022

    2022

  3. [11]

    Pseudo-labeling and confirmation bias in deep semi- supervised learning

    Eric Arazo, Diego Ortego, Paul Albert, Noel E O’Connor, and Kevin McGuinness. Pseudo-labeling and confirmation bias in deep semi- supervised learning. In 2020 International joint conference on neural networks (IJCNN), pages 1–8. IEEE, 2020

    2020

  4. [12]

    Drebin: Effective and explainable detection of android malware in your pocket

    Daniel Arp, Michael Spreitzenbarth, Malte Hubner, Hugo Gascon, Konrad Rieck, and CERT Siemens. Drebin: Effective and explainable detection of android malware in your pocket. In NDSS, volume 14, pages 23–26, 2014

    2014

  5. [13]

    Recent advances in adversarial training for adversarial robustness

    Tao Bai, Jinqi Luo, Jun Zhao, Bihan Wen, and Qian Wang. Recent advances in adversarial training for adversarial robustness. arXiv preprint arXiv:2102.01356, 2021

    2021 arXiv

  6. [14]

    Transcending transcend: Revisiting malware classification in the presence of concept drift

    Federico Barbero, Feargus Pendlebury, Fabio Pierazzi, and Lorenzo Cavallaro. Transcending transcend: Revisiting malware classification in the presence of concept drift. In 2022 IEEE Symposium on Security and Privacy (SP) , pages 805–823. IEEE, 2022

    2022

  7. [15]

    End-to-end active learning for computer security experts

    Ana ¨el Beaugnon, Pierre Chifflier, and Francis R Bach. End-to-end active learning for computer security experts. In AAAI Workshops, pages 217– 224, 2018

    2018

  8. [16]

    Random search for hyper-parameter optimization

    James Bergstra and Yoshua Bengio. Random search for hyper-parameter optimization. Journal of machine learning research , 13(2), 2012

    2012

  9. [17]

    Mixmatch: A holistic approach to semi-supervised learning

    David Berthelot, Nicholas Carlini, Ian Goodfellow, Nicolas Papernot, Avital Oliver, and Colin A Raffel. Mixmatch: A holistic approach to semi-supervised learning. Advances in neural information processing systems, 32, 2019

    2019

  10. [18]

    Pattern recognition and machine learning , volume 4

    Christopher M Bishop and Nasser M Nasrabadi. Pattern recognition and machine learning , volume 4. Springer, 2006

    2006

  11. [19]

    Towards more realistic evaluations: The impact of label delays in malware detection pipelines

    Marcus Botacin and Heitor Gomes. Towards more realistic evaluations: The impact of label delays in malware detection pipelines. Computers & Security, 148:104122, 2025

    2025

  12. [20]

    Understanding the process of data labeling in cybersecurity

    Tobias Braun, Irdin Pekaric, and Giovanni Apruzzese. Understanding the process of data labeling in cybersecurity. In Proceedings of the 39th ACM/SIGAPP Symposium on Applied Computing , pages 1596– 1605, 2024

    2024

  13. [21]

    Random forests

    Leo Breiman. Random forests. Machine learning, 45:5–32, 2001

    2001

  14. [22]

    Support vector machines with the ramp loss and the hard margin loss

    J Paul Brooks. Support vector machines with the ramp loss and the hard margin loss. Operations research, 59(2):467–479, 2011

    2011

  15. [23]

    Xgboost: A scalable tree boosting system

    Tianqi Chen and Carlos Guestrin. Xgboost: A scalable tree boosting system. In Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining , pages 785–794, 2016

    2016

  16. [24]

    Continuous learning for android malware detection

    Yizheng Chen, Zhoujie Ding, and David Wagner. Continuous learning for android malware detection. In 32nd USENIX Security Symposium (USENIX Security 23) , pages 1127–1144, 2023

    2023

  17. [25]

    On training robust pdf malware classifiers

    Yizheng Chen, Shiqi Wang, Dongdong She, and Suman Jana. On training robust pdf malware classifiers. In Proceedings of the 29th USENIX Conference on Security Symposium , pages 2343–2360, 2020

    2020

  18. [26]

    Is it overkill? analyzing feature-space concept drift in malware detectors

    Zhi Chen, Zhenning Zhang, Zeliang Kan, Limin Yang, Jacopo Cortel- lazzi, Feargus Pendlebury, Fabio Pierazzi, Lorenzo Cavallaro, and Gang Wang. Is it overkill? analyzing feature-space concept drift in malware detectors. In IEEE Security and Privacy Workshops (SPW). IEEE, 2023

    2023

  19. [27]

    Drift forensics of malware classifiers

    Theo Chow, Zeliang Kan, Lorenz Linhardt, Lorenzo Cavallaro, Daniel Arp, and Fabio Pierazzi. Drift forensics of malware classifiers. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security, pages 197–207, 2023

    2023

  20. [28]

    Ran- daugment: Practical automated data augmentation with a reduced search space

    Ekin D Cubuk, Barret Zoph, Jonathon Shlens, and Quoc V Le. Ran- daugment: Practical automated data augmentation with a reduced search space. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops , pages 702–703, 2020

    2020

  21. [29]

    Decoding the secrets of machine learning in malware classification: A deep dive into datasets, feature extraction, and model performance

    Savino Dambra, Yufei Han, Simone Aonzo, Platon Kotzias, Antonino Vitale, Juan Caballero, Davide Balzarotti, and Leyla Bilge. Decoding the secrets of machine learning in malware classification: A deep dive into datasets, feature extraction, and model performance. In Proceedings...

    2023

  22. [30]

    A time-interval-based active learning framework for enhanced pe malware acquisition and detection

    Ido Finder, Eitam Sheetrit, and Nir Nissim. A time-interval-based active learning framework for enhanced pe malware acquisition and detection. Computers & Security , 121:102838, 2022

    2022

  23. [31]

    A comprehensive study of learning-based android malware detectors under challenging environments

    Cuiying Gao, Gaozhun Huang, Heng Li, Bang Wu, Yueming Wu, and Wei Yuan. A comprehensive study of learning-based android malware detectors under challenging environments. In Proceedings of the 46th IEEE/ACM International Conference on Software Engineering , 2024

    2024

  24. [32]

    Davis, and Tomas Pfister

    Mingfei Gao, Zizhao Zhang, Guo Yu, Sercan ¨O Arık, Larry S. Davis, and Tomas Pfister. Consistency-based semi-supervised active learning: Towards minimizing labeling cost. In Proc. ECCV 2020 , 2020

    2020

  25. [33]

    Benchmarking distribution shift in tabular data with tableshift

    Josh Gardner, Zoran Popovic, and Ludwig Schmidt. Benchmarking distribution shift in tabular data with tableshift. Advances in Neural Information Processing Systems , 36, 2024

    2024

  26. [34]

    Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses

    Micah Goldblum, Dimitris Tsipras, Chulin Xie, Xinyun Chen, Avi Schwarzschild, Dawn Song, Aleksander Madry, Bo Li, and Tom Gold- stein. Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses. IEEE Transactions on Pattern Analysis and Machine Intel...

    2022

  27. [35]

    Adaptive random forests for evolving data stream classification.Machine Learning, 106:1469–1495, 2017

    Heitor M Gomes, Albert Bifet, Jesse Read, Jean Paul Barddal, Fabr ´ıcio Enembreck, Bernhard Pfharinger, Geoff Holmes, and Talel Abdessalem. Adaptive random forests for evolving data stream classification.Machine Learning, 106:1469–1495, 2017

    2017

  28. [36]

    Why do tree- based models still outperform deep learning on typical tabular data? Advances in neural information processing systems , 35:507–520, 2022

    L ´eo Grinsztajn, Edouard Oyallon, and Ga ¨el Varoquaux. Why do tree- based models still outperform deep learning on typical tabular data? Advances in neural information processing systems , 35:507–520, 2022

    2022

  29. [37]

    Adversarial perturbations against deep neural networks for malware classification

    Kathrin Grosse, Nicolas Papernot, Praveen Manoharan, Michael Backes, and Patrick McDaniel. Adversarial perturbations against deep neural networks for malware classification. arXiv preprint arXiv:1606.04435 , 2016

    2016 arXiv

  30. [38]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems , 30, 2017

    2017

  31. [39]

    Pdf malware detection based on stacking learning

    Maryam Issakhani, Princy Victor, Ali Tekeoglu, and Arash Habibi Lashkari. Pdf malware detection based on stacking learning. In ICISSP, pages 562–570, 2022

    2022

  32. [40]

    Transcend: Detecting concept drift in malware classification models

    Roberto Jordaney, Kumar Sharad, Santanu K Dash, Zhi Wang, Davide Papini, Ilia Nouretdinov, and Lorenzo Cavallaro. Transcend: Detecting concept drift in malware classification models. In 26th USENIX security symposium (USENIX security 17) , pages 625–642, 2017

    2017

  33. [41]

    Investigating labelless drift adaptation for malware detection

    Zeliang Kan, Feargus Pendlebury, Fabio Pierazzi, and Lorenzo Caval- laro. Investigating labelless drift adaptation for malware detection. In Proceedings of the 14th ACM Workshop on Artificial Intelligence and Security, pages 123–134, 2021

    2021

  34. [42]

    Adversarial concept drift de- tection under poisoning attacks for robust data stream mining

    Łukasz Korycki and Bartosz Krawczyk. Adversarial concept drift de- tection under poisoning attacks for robust data stream mining. Machine Learning, 112(10):4013–4048, 2023

    2023

  35. [43]

    Understanding self- training for gradual domain adaptation

    Ananya Kumar, Tengyu Ma, and Percy Liang. Understanding self- training for gradual domain adaptation. In International Conference on Machine Learning , pages 5468–5479. PMLR, 2020

    2020

  36. [44]

    Pseudo-label: The simple and efficient semi- supervised learning method for deep neural networks

    Dong-Hyun Lee et al. Pseudo-label: The simple and efficient semi- supervised learning method for deep neural networks. In Workshop on challenges in representation learning, ICML , volume 3, 2013

    2013

  37. [45]

    The good, the bad and the ugly sides of data augmentation: An implicit spectral regularization perspective

    Chi-Heng Lin, Chiraag Kaushik, Eva L Dyer, and Vidya Muthukumar. The good, the bad and the ugly sides of data augmentation: An implicit spectral regularization perspective. Journal of Machine Learning Research, 25(91):1–85, 2024

    2024

  38. [46]

    Marvin: Efficient and comprehensive mobile app classification through static and dynamic analysis

    Martina Lindorfer, Matthias Neugschwandtner, and Christian Platzer. Marvin: Efficient and comprehensive mobile app classification through static and dynamic analysis. In 2015 IEEE 39th annual computer software and applications conference . IEEE, 2015

    2015

  39. [47]

    Learning under concept drift: A review

    Jie Lu, Anjin Liu, Fan Dong, Feng Gu, Joao Gama, and Guangquan Zhang. Learning under concept drift: A review. IEEE transactions on knowledge and data engineering , 31(12):2346–2363, 2018

    2018

  40. [48]

    Ghorbani

    Samaneh Mahdavifar, Andi Fitriah Abdul Kadir, Rasool Fatemi, Dima Alhadidi, and Ali A. Ghorbani. Dynamic android malware category classification using semi-supervised deep learning. In Proc. IEEE DASC/PiCom/CBDCom/CyberSciTech, pages 515–522, 2020

    2020

  41. [49]

    Reviewer integration and performance measurement for malware detection

    Brad Miller, Alex Kantchelian, Michael Carl Tschantz, Sadia Afroz, Rekha Bachwani, Riyaz Faizullabhoy, Ling Huang, Vaishaal Shankar, Tony Wu, George Yiu, et al. Reviewer integration and performance measurement for malware detection. In DIMVA 2016, San Sebasti ´an, Spain, July ...

    2016

  42. [50]

    Context-aware, adaptive, and scalable android malware detection through online learning

    Annamalai Narayanan, Mahinthan Chandramohan, Lihui Chen, and Yang Liu. Context-aware, adaptive, and scalable android malware detection through online learning. IEEE Transactions on Emerging Topics in Computational Intelligence , 1(3):157–175, 2017

    2017

  43. [51]

    Novel active learning methods for enhanced pc malware detection in windows os

    Nir Nissim, Robert Moskovitch, Lior Rokach, and Yuval Elovici. Novel active learning methods for enhanced pc malware detection in windows os. Expert Systems with Applications , 41(13):5843–5857, 2014

    2014

  44. [52]

    Ransomware de- tection with semi-supervised learning

    Fakhroddin Noorbehbahani and Mohammad Saberi. Ransomware de- tection with semi-supervised learning. In 2020 10th International Conference on Computer and Knowledge Engineering (ICCKE) , pages 024–029. IEEE, 2020

    2020

  45. [53]

    Research computing services, 2025

    Rochester Institute of Technology. Research computing services, 2025. Accessed: 2025-07-31

    2025

  46. [54]

    Ross, and Gianluca Stringhini

    Lucky Onwuzurike, Enrico Mariconti, Panagiotis Andriotis, Emiliano De Cristofaro, Gordon J. Ross, and Gianluca Stringhini. Mamadroid: Detecting android malware by building markov chains of behavioral models (extended version). ACM Trans. Priv. Secur., 22(2), 2019

    2019

  47. [55]

    Tesseract: Eliminating experimental bias in malware classification across space and time

    Feargus Pendlebury, Fabio Pierazzi, Roberto Jordaney, Johannes Kinder, Lorenzo Cavallaro, et al. Tesseract: Eliminating experimental bias in malware classification across space and time. In Proceedings of the 28th USENIX Security Symposium . USENIX Association, 2019

    2019

  48. [56]

    Dataset shift in machine learning

    Joaquin Qui ˜nonero-Candela, Masashi Sugiyama, Anton Schwaighofer, and Neil D Lawrence. Dataset shift in machine learning . Mit Press, 2022

    2022

  49. [57]

    Advanced windows methods on malware detection and classification

    Dima Rabadi and Sin G Teo. Advanced windows methods on malware detection and classification. In Proceedings of the 36th Annual Computer Security Applications Conference , pages 54–68, 2020

    2020

  50. [58]

    On the limitations of continual learning for malware classification

    Mohammad Saidur Rahman, Scott Coull, and Matthew Wright. On the limitations of continual learning for malware classification. In Conference on Lifelong Learning Agents , pages 564–582. PMLR, 2022

    2022

  51. [59]

    Experience replay for continual learning

    David Rolnick, Arun Ahuja, Jonathan Schwarz, Timothy Lillicrap, and Gregory Wayne. Experience replay for continual learning. Advances in neural information processing systems , 32, 2019

    2019

  52. [60]

    Learn- ing representations by back-propagating errors

    David E Rumelhart, Geoffrey E Hinton, and Ronald J Williams. Learn- ing representations by back-propagating errors. nature, 323(6088), 1986

    1986

  53. [61]

    Semi-supervised learning for unknown malware detection

    Igor Santos, Javier Nieves, and Pablo G Bringas. Semi-supervised learning for unknown malware detection. In International Symposium on Distributed Computing and Artificial Intelligence , pages 415–422. Springer, 2011

    2011

  54. [62]

    Transductive semi-supervised deep learning using min- max features

    Weiwei Shi, Yihong Gong, Chris Ding, Zhiheng MaXiaoyu Tao, and Nanning Zheng. Transductive semi-supervised deep learning using min- max features. In ECCV, pages 299–315, 2018

    2018

  55. [63]

    Evolving cybersecurity frontiers: A comprehensive survey on concept drift and feature dynam- ics aware machine and deep learning in intrusion detection systems

    Methaq A Shyaa, Noor Farizah Ibrahim, Zurinahni Zainol, Rosni Ab- dullah, Mohammed Anbar, and Laith Alzubaidi. Evolving cybersecurity frontiers: A comprehensive survey on concept drift and feature dynam- ics aware machine and deep learning in intrusion detection systems. Engin...

    2024

  56. [64]

    A survey on malware analysis techniques: Static, dynamic, hybrid and memory analysis

    Rami Sihwail, Khairuddin Omar, and KA Zainol Ariffin. A survey on malware analysis techniques: Static, dynamic, hybrid and memory analysis. Int. J. Adv. Sci. Eng. Inf. Technol , 8(4-2):1662–1671, 2018

    2018

  57. [65]

    Fixmatch: Simplifying semi-supervised learning with consistency and confidence

    Kihyuk Sohn, David Berthelot, Nicholas Carlini, Zizhao Zhang, Han Zhang, Colin A Raffel, Ekin Dogus Cubuk, Alexey Kurakin, and Chun-Liang Li. Fixmatch: Simplifying semi-supervised learning with consistency and confidence. Advances in neural information processing systems, 33:5...

    2020

  58. [66]

    Hidost: a static machine-learning-based detector of malicious files

    Nedim ˇSrndi´c and Pavel Laskov. Hidost: a static machine-learning-based detector of malicious files. EURASIP Journal on Information Security , 2016:1–20, 2016

    2016

  59. [67]

    On defending against label flipping attacks on malware detection systems

    Rahim Taheri, Reza Javidan, Mohammad Shojafar, Zahra Pooranian, Ali Miri, and Mauro Conti. On defending against label flipping attacks on malware detection systems. Neural Computing and Applications , 32:14781–14800, 2020

    2020

  60. [68]

    The evolution of android malware and android analysis techniques

    Kimberly Tam, Ali Feizollah, Nor Badrul Anuar, Rosli Salleh, and Lorenzo Cavallaro. The evolution of android malware and android analysis techniques. ACM Computing Surveys (CSUR) , 49(4), 2017

    2017

  61. [69]

    Lief - library to instrument executable formats

    Romain Thomas. Lief - library to instrument executable formats. https://lief.quarkslab.com/, apr 2017

    2017

  62. [70]

    On mixup training: Improved calibration and predictive uncertainty for deep neural networks

    Sunil Thulasidasan, Gopinath Chennupati, Jeff A Bilmes, Tanmoy Bhat- tacharya, and Sarah Michalak. On mixup training: Improved calibration and predictive uncertainty for deep neural networks. Advances in neural information processing systems , 32, 2019

    2019

  63. [71]

    Semi-supervised active learning for sequence labeling

    Katrin Tomanek and Udo Hahn. Semi-supervised active learning for sequence labeling. In Proceedings of the Joint Conference of the 47th Annual Meeting of the ACL and the 4th International Joint Conference on Natural Language Processing of the AFNLP, pages 1039–1047, 2009

    2009

  64. [72]

    Optimal transport: old and new , volume 338

    C ´edric Villani et al. Optimal transport: old and new , volume 338. Springer, 2008

    2008

  65. [73]

    Evasion attack and defense on machine learn- ing models in cyber-physical systems: A survey

    Shunyao Wang, Ryan KL Ko, Guangdong Bai, Naipeng Dong, Taejun Choi, and Yanjun Zhang. Evasion attack and defense on machine learn- ing models in cyber-physical systems: A survey. IEEE communications surveys & tutorials , 26(2):930–966, 2023

    2023

  66. [74]

    Continual test-time domain adaptation via dynamic sample selection

    Yanshuo Wang, Jie Hong, Ali Cheraghian, Shafin Rahman, David Ahmedt-Aristizabal, Lars Petersson, and Mehrtash Harandi. Continual test-time domain adaptation via dynamic sample selection. In Proceed- ings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pag...

    2024

  67. [75]

    Individual comparisons by ranking methods

    Frank Wilcoxon. Individual comparisons by ranking methods. In Breakthroughs in statistics: Methodology and distribution , pages 196–

  68. [76]

    From grim reality to practical solution: Malware classification in real-world noise

    Xian Wu, Wenbo Guo, Jia Yan, Baris Coskun, and Xinyu Xing. From grim reality to practical solution: Malware classification in real-world noise. In 2023 IEEE Symposium on Security and Privacy (SP) , pages 2602–2619. IEEE Computer Society, 2023

    2023

  69. [77]

    Droide- volver: Self-evolving android malware detection system

    Ke Xu, Yingjiu Li, Robert Deng, Kai Chen, and Jiayun Xu. Droide- volver: Self-evolving android malware detection system. In 2019 IEEE European Symposium on Security and Privacy (EuroS&P) . IEEE, 2019

    2019

  70. [78]

    Generalized out-of-distribution detection: A survey

    Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized out-of-distribution detection: A survey. International Journal of Com- puter Vision, 132(12):5635–5662, 2024

    2024

  71. [79]

    Bodmas: An open dataset for learning based temporal analysis of pe malware

    Limin Yang, Arridhana Ciptadi, Ihar Laziuk, Ali Ahmadzadeh, and Gang Wang. Bodmas: An open dataset for learning based temporal analysis of pe malware. In 2021 IEEE Security and Privacy Workshops (SPW) , pages 78–84. IEEE, 2021

    2021

  72. [80]

    Cade: Detecting and explaining concept drift samples for security applications

    Limin Yang, Wenbo Guo, Qingying Hao, Arridhana Ciptadi, Ali Ah- madzadeh, Xinyu Xing, and Gang Wang. Cade: Detecting and explaining concept drift samples for security applications. In USENIX security symposium, pages 2327–2344, 2021

    2021

  73. [81]

    Dauphin, and David Lopez- Paz

    Hongyi Zhang, Moustapha Ciss ´e, Yann N. Dauphin, and David Lopez- Paz. mixup: Beyond empirical risk minimization. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings . OpenReview.net, 2018

    2018

  74. [82]

    How does mixup help with robustness and generalization? arXiv preprint arXiv:2010.04819 , 2020

    Linjun Zhang, Zhun Deng, Kenji Kawaguchi, Amirata Ghorbani, and James Zou. How does mixup help with robustness and generalization? arXiv preprint arXiv:2010.04819 , 2020

    2010 arXiv

  75. [83]

    Enhancing state-of-the-art classifiers with api semantics to detect evolved android malware

    Xiaohan Zhang, Yuan Zhang, Ming Zhong, Daizong Ding, Yinzhi Cao, Yukun Zhang, Mi Zhang, and Min Yang. Enhancing state-of-the-art classifiers with api semantics to detect evolved android malware. In Proceedings of the 2020 ACM SIGSAC conference on computer and communications se...

    2020

  76. [84]

    On the impact of sample duplication in machine-learning-based android malware detection

    Yanjie Zhao, Li Li, Haoyu Wang, Haipeng Cai, Tegawend ´e F Bissyand´e, Jacques Klein, and John Grundy. On the impact of sample duplication in machine-learning-based android malware detection. ACM Transactions on Software Engineering and Methodology (TOSEM), 30(3):1–38, 2021. A...

    2021

  77. [85]

    Adaptive Random Forest (ARF) [35]: ARF is an online ensemble method for concept drift adaptation. To enable self-training, we introduce a threshold parameter for pseudo-label selection, which is tuned in conjunction with other tree hyperparameters, allowing ARF to update using...

  78. [86]

    It uses an ensemble of five linear models to generate pseudo-labels and tracks model aging with a buffer of recent samples

    DroidEvolver++ (DE++) [41] : DE++ improves upon DroidEvolver [77] for malware drift adaptation without requiring ongoing ground truth. It uses an ensemble of five linear models to generate pseudo-labels and tracks model aging with a buffer of recent samples. When pre- diction ...

  79. [87]

    Both models are updated using pseudo-labeled data

    Insomnia [9] : Insomnia adapts to concept drift in net- work intrusion detection via co-training between a Near- est Centroid (NC) classifier and an MLP, with the NC providing pseudo-labels for uncertain MLP predictions. Both models are updated using pseudo-labeled data. For m...

  80. [88]

    MORSE [76]: MORSE is a state-of-the-art semi- supervised method for malware family classification with noisy labels. It uses the FixMatch [65] framework, incor- porating an augmentation strategy that enforces consis- tency between weakly and strongly augmented versions of each...

  81. [89]

    The classification error on the target distribution Q for malware and benign classes is bounded by: Errm(θ, Q) ≤ 1 1 − ρmR Lm r (θ, P), Errb(θ, Q) ≤ 1 1 − ρbR Lb r(θ, P)

    Asymmetric Error: Following Lemma A.2 from [43], we analyze class-specific error bounds under different shift magnitudes. The classification error on the target distribution Q for malware and benign classes is bounded by: Errm(θ, Q) ≤ 1 1 − ρmR Lm r (θ, P), Errb(θ, Q) ≤ 1 1 − ...

  82. [90]

    Instead of classifying all samples, we only classify those for which the model’s confidence exceeds the respective threshold

    Impact of Class-Specific Thresholding: To mitigate the imbalance between false negative and false positive rates, we introduce separate thresholds τm and τb for malware and benign classifications, respectively. Instead of classifying all samples, we only classify those for whi...

  83. [91]

    Given that qm and qb represent the proportions of malware and benign samples in Q (i.e., qm + qb = 1 ), we replace the expectation in the bound with an explicit weighted sum

    Modified Error Bound: Following Lemma A.3 from [43], we account for the fact that the total error depends on the mixture of malware and benign samples in Q. Given that qm and qb represent the proportions of malware and benign samples in Q (i.e., qm + qb = 1 ), we replace the e...

  84. [92]

    In our theoretical framework, this regularization implicitly reduces the norm of the learned weight vector w, leading to a smaller capacity parameter R (i.e., ∥w∥2 ≤ R)

    Impact of Augmentation & Mixup: Data augmentation and mixup serve as effective regularizers during training [45], [82], helping to reduce overfitting and improve generalization. In our theoretical framework, this regularization implicitly reduces the norm of the learned weight...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.