Pith. sign in

REVIEW 4 major objections 6 minor 50 references

Uncertainty-Driven Hierarchical Sampling for Unbalanced Continual Malware Detection with Time-Series Update-Based Retrieval

T0 review · 4 major / 6 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read One method sustains Android malware detection at 94% balanced accuracy with only 50 monthly analyst labels.

desk verdict Plausible idea with a serious evaluation-ordering ambiguity; the reported numbers could be inflated if month n labels are used before testing month n. read the letter →

arxiv 2509.07532 v1 pith:FVFJWEHE submitted 2025-09-09 cs.CE

Yi Xie , Ziyuan Yang , Yongqiang Huang , Yinyu Chen , Lei Zhang , Liang Liu , Yi Zhang This is my paper
classification cs.CE
keywords Androidmalwaredetectioncontinuallearninguncertaintysamplingclassimbalancevectorretrievalconceptdriftfew-shotcodebook
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that continual Android malware detection fails not because of concept drift alone, but because uncertainty-based sample selection is biased toward the abundant benign class. The authors claim that decoupling sample selection from the detector, using a hierarchical uncertainty scorer over both malware families and binary labels, repairs this bias. They add a similarity-retrieval module whose codebook is updated with representative embeddings that are pushed toward class centroids and orthogonalized away from the benign direction. Under a strict budget of 50 labeled samples per monthly phase, they report a malware true positive rate of 92.95 percent and balanced accuracy of 94.26 percent on the APIGraph dataset, and 80.56 percent TPR with 88.29 percent balanced accuracy on AndroZoo, beating the strongest prior continual-learning baseline by roughly 3 to 11 percent balanced accuracy. If correct, this would make sustained 'label-scarce' malware detection practical: a small daily analyst effort keeps detection accurate over years of drift.

What carries the argument

The load-bearing mechanism is the hierarchical uncertainty sampler paired with an ETF-influenced codebook. The sampler has a multi-class module trained with an evidential Dirichlet loss (to estimate family-wise uncertainty) and a binary module trained with supervised contrastive plus binary cross-entropy; their union with a minimum benign quota selects balanced, high-information samples for analyst labeling. The codebook stores fixed-size class-balanced feature vectors, refines them by centroid compaction and by subtracting the benign centroid component from malware vectors, then classifies test samples by top-k cosine matching with fallback to the neural classifier. Together the two parts p

What would settle it

Re-run the APIGraph experiment with the codebook update strictly moved after evaluation on each month's test set (i.e., update with D_n labels only after scoring D_n). If the reported TPR and mACC drop to the level of the baseline or lower, the retrieval module is leaking test labels. A simpler check: run the retrieval-only decision (without the neural classifier) on the test month using only codebooks from prior months; if its malware TPR exceeds the classifier's standalone TPR, the retrieval is exploiting temporally future information.

Watch

Extended reading notes

Core claim

The central claim is that the cause of poor continual malware detection under low-label budgets is the structural imbalance in which samples get selected for labeling, not merely model forgetting. The paper's UGSR framework separates the sampler from the detector: a two-stage sampler estimates uncertainty at the malware-family level and at the benign-versus-malicious boundary, selecting a confidence-balanced mix that enforces a minimum benign quota; a separate detector plus a vector codebook then detects by combining neural classification with retrieval. The retrieval codebook stores only 50 benign vectors and 3 per malware family, pulling stored vectors toward class centroids and making mal

Load-bearing premise

The paper's results depend on the evaluation order in Algorithm 1: the model must be tested on month n's data before it is updated with any labels from that same month. If instead the codebook and classifier are updated with month n's labels before testing month n, the retrieval module would have direct access to the test labels, inflating the reported TPR and mACC. The manuscript does not make this ordering unambiguous.

Editorial extensions

If this is right

  • If the reported gains hold, real-world security teams could maintain effective Android malware detection with about 50 labels per month, roughly 1-2 analyst-hours per phase.
  • The hierarchical family-level uncertainty idea could transfer to other highly imbalanced continual-learning tasks (fraud, intrusion, medical screening) where the minority class is the one that matters.
  • Retrieval-plus-classifier fusion appears to stabilize performance across time, smoothing month-to-month spikes that current baselines suffer, implying a safer operational profile for deployed detectors.
  • Ablations indicate that dropping the family-level sampler causes catastrophic overfitting to the benign class, i.e., the 'accuracy' of past methods may partly reflect predicting everything benign.
  • With only 2 labels per phase, the method still improves TPR over the best baseline, suggesting that extremely scarce-label regimes remain usable in practice.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit a concrete deployment procedure: the 50 monthly labels should be drawn from the most uncertain family- and binary-level samples, but the paper does not state who labels them or how label turnaround time interacts with the monthly cadence; a testable extension is to measure performance when labels arrive with a one-month delay.
  • The retrieval codebook's ETF-style orthogonalization is a geometric post-processing on stored embeddings; an untested but natural extension is to apply the same orthogonalization to the classifier's decision function itself, which if effective would reduce dependence on the hand-tuned threshold parameters.
  • A further implicit consequence is that the method as presented assumes the analyst labels samples from the same month's distribution before that month's test is run; any real deployment must quarantine a month's test set before updating on its labels, which the algorithm description does not yet make explicit.
  • Connecting to drift-detection literature, the retrieval module could double as a drift alarm: a spike in retrieval fallback (when neither benign nor malware matches reach threshold) identifies months in which the encoder has met genuinely new behavior, a signal the paper does not exploit.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. UGSR is a continual-learning framework for Android malware detection under class imbalance and concept drift. It couples a hierarchical uncertainty sampler (family-level multi-class and binary modules) with a detector trained via contrastive and weighted BCE losses, and a vector codebook used for retrieval-based detection. Static training initializes sampler, detector, and codebook; each month, a fixed budget of samples is actively selected, labeled, stored in a memory bank, and used to fine-tune the sampler and detector and to update the codebook; test predictions fuse the classifier output with top-3 codebook matches. Experiments on APIGraph and AndroZoo report TPR 92.95% and mACC 94.26% under a 50-label monthly budget, with comparisons to MLP/SVM/GBDT, CADE, and USENIX23 baselines, plus ablations and few-shot budgets down to 2 samples/month.

Significance. If the results hold, UGSR addresses a practical problem: sustaining Android malware detection with a very small monthly analyst labeling budget. The hierarchical sampler is a sensible response to the known majority-class bias of uncertainty sampling, and the retrieval module is a plausible non-parametric complement to the classifier. The ablations (Tables V and VI) suggest that both the retrieval module and the multi-class selector contribute to performance. However, the manuscript's current rigor does not support the headline claims: the temporal evaluation/update protocol is ambiguous, all results are single runs with no variance or significance testing, and the claimed ETF component is asserted rather than implemented. The framework is potentially valuable, but the evidence as presented is not yet convincing. No code or data are released, which further limits verification.

major comments (4)
  1. [Algorithm 1, §III.C] The temporal ordering of evaluation and model update is load-bearing and ambiguous. Algorithm 1 places Testing (lines 8–18) and Continual Learning (lines 20–32) as two separate sequential loops over T_n. Under a literal reading, all months are tested with the initial model and codebook before any updates occur, which cannot produce the reported continual-learning gains. Under the intended interleaved reading, the pseudocode does not state that evaluation on D_n precedes sampling/updating with D'_n drawn from D_n. Section III.C's description, 'For each incoming monthly test batch D_n, F_S calculates uncertainty scores...,' reinforces this ambiguity. If V is updated with features from D'_n before the remainder of D_n is tested, the retrieval module has direct access to vectors derived from the current month's labels, inflating TPR and mACC. The paper must unambiguously specify the protocol
  2. [§IV.E, Tables I–IV and VII] All performance tables report a single run per configuration with no standard deviations, confidence intervals, or significance tests. The abstract's claim that the framework 'significantly outperforms state-of-the-art methods' is therefore unsupported statistically. For a continual-learning evaluation over multiple months, the natural unit of comparison is monthly performance; the authors should report mean ± std over seeds (or over monthly periods) and a paired significance test (e.g., Wilcoxon signed-rank) against each baseline. This is especially important because several few-shot improvements are small (e.g., AndroZoo Count=2: TPR 62.67 vs. 59.54, mACC 79.92 vs. 79.33 in Table IV) and could be within noise.
  3. [§III.B, Eqs. (12)–(14); Algorithm 1 line 31] The ETF (Equiangular Tight Frame) claim is not implemented. Equations (12)–(13) pull stored vectors toward their class centroids, and Eq. (14) subtracts a benign-centroid component from malware vectors. These operations do not construct or enforce an equiangular tight frame; no ETF loss, simplex constraint, or angle equalization is defined anywhere. Algorithm 1's line 31, 'Apply ETF principle to V,' is therefore vacuous, and the contribution list's 'ETF-based feature regularization' is not demonstrated. The authors should either remove the ETF terminology or provide the actual ETF construction/regularization and an ablation quantifying its effect.
  4. [§III.C Eq. (15) vs. §IV.B] The sampling procedure is internally inconsistent. Section III.C selects μB samples by multi-class uncertainty and (1−μ)B by binary uncertainty with μ=0.5, then enforces 'a minimum of 10% benign quota' by replacing low-scoring malware samples. Section IV.B states that continual learning 'maintaining a 40% benign sample ratio in incremental batches.' These two rules yield different class compositions for the 50-label budget, and the paper does not say which was used for Tables I and II. Since the headline result depends on the composition of the budget, the exact sampling rule and its hyperparameters must be stated without ambiguity.
minor comments (6)
  1. [Table VI] The mACC for 'w/o F_mul' is reported as 87.45, but (73.43+89.06)/2 = 81.25. Please correct this arithmetic inconsistency.
  2. [Eq. (4)] The summation index in the first term is garbled ('Σ_{k=c}^{C}'), and S_c is not defined. Please rewrite the evidential loss expression carefully.
  3. [§III.D and Algorithm 1] The matching threshold is variously denoted θ, τ, and k. In Eq. (17), θ is set equal to k, while §IV.B says 'matching thresholds set to τ=3.' Unify the notation.
  4. [§III.B] The paper says the codebook contains 'a total of 50 benign samples' and 'up to 3 samples per malware family,' but the total codebook size and family coverage are not stated. Please specify how many malware families are represented in the codebook.
  5. [Figures 4–6] The figures show monthly TPR trajectories, but the captions do not define the x-axis time range or the number of months. Please add a textual summary of the variability, since this is central to the robustness claims.
  6. [Index Terms] The phrase 'Continue Learning' should be 'Continual Learning.'

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; the reported performance is empirical and not derived from its inputs by construction.

full rationale

The paper reports empirical detection performance (TPR 92.95%, mACC 94.26%) from continual learning experiments on standard Android malware datasets. The method's components—the hierarchical sampler (F_mul, F_bin) and the retrieval codebook with centroid/orthogonalization operations—are defined through standard losses (cross-entropy, evidential loss, supervised contrastive loss, weighted BCE) and geometric heuristics. None of these definitions reference the evaluation metrics (TPR, mACC, F2, G-mean). The codebook update mechanism replaces low-confidence vectors with new labeled samples, which is a standard continual learning procedure. While the temporal ordering in Algorithm 1 is ambiguous (Testing loop precedes Continual Learning loop), this is a potential experiment-protocol risk rather than a logical circularity; the pseudocode as written evaluates on each month D_n before updating with that month's labels, and the textual description does not explicitly reverse that order. The paper includes self-citations ([39]-[41], and possibly dataset papers) for evidential learning and datasets, but these are not load-bearing: the evidential loss is from the independent work [38], and the datasets are public benchmarks. No equation or fitted parameter is renamed as a prediction, and no claimed derivation reduces to its own inputs. Therefore, the central empirical claim is self-contained in the sense that it is an experimental result, not a tautological construction.

Assumptions & free parameters 10 free parameters · 6 assumptions · 0 invented entities

The paper relies on a large number of hand-chosen hyperparameters, most unreported, and on domain assumptions about the feature representation, class ratio stability, and uncertainty calibration. No new physical or conceptual entities are introduced.

free parameters (10)
  • loss weight lambda_1 = not reported
    Balances evidential loss and cross-entropy in the multi-class module, Eq. (5). Chosen by hand; no value given.
  • loss weight lambda_2 = not reported
    Balances supervised contrastive loss and BCE in the binary module, Eq. (7).
  • loss weight lambda_3 = not reported
    Balances contrastive and weighted BCE losses in the detector, Eq. (10).
  • contrastive temperature tau = not reported
    Sharpness of the similarity distribution in the supervised contrastive loss, Eq. (9).
  • sampling balance mu = 0.5
    Determines the split of the sample budget between multi-class and binary uncertainty scores, Eq. (15).
  • benign minimum quota = 10%
    Post-hoc replacement of low-scoring malware samples when benign samples are underrepresented; introduces selection bias.
  • codebook sizes N_benign, N_mal = 50 benign, 3 per malware family
    Capacity constraints for the codebook; chosen by hand and directly affect retrieval behavior.
  • matching threshold k = 3
    Number of nearest neighbors and decision threshold in the retrieval fusion rule, Eq. (17).
  • codebook pull strengths theta_1, theta_2, theta_3 = not reported
    Control centroid pull and orthogonalization in Eqs. (13) and (14); no values are reported.
  • benign ratio in incremental batches = 40%
    Maintains class balance during fine-tuning, stated in Section IV.B.
assumptions (6)
  • domain assumption API call graph features of the APIGraph dataset are a sufficient and stable representation of malicious behavior across 2012-2018.
    The entire detection framework operates on these features; no feature drift or feature quality analysis is provided.
  • domain assumption The benign-to-malicious class ratio is approximately 9:1 and remains so across time.
    The imbalance ratio motivates the sampling and weighting design; if the ratio changes, the 10% quota and weighted losses may not transfer.
  • domain assumption Uncertainty scores from the evidential multi-class network are well-calibrated and informative for selecting samples that improve future detection.
    The sampler selects samples based on these scores, but no calibration analysis is presented.
  • domain assumption The first 12 months of data constitute a representative static training set for subsequent months.
    Static training set D_s is fixed from months 1-12; all later drift must be handled by continual learning.
  • domain assumption Cosine similarity in the learned embedding space is a valid similarity measure for malware variant detection.
    Retrieval uses cosine similarity in Eq. (16) without validation of embedding geometry for this purpose.
  • domain assumption The MLP architectures and training settings (200 static epochs, 50 continual epochs) are sufficient to learn the required representations.
    No architecture search or comparison is reported.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Uncertainty-Driven Hierarchical Sampling for Unbalanced Continual Malware Detection with Time-Series Update-Based Retrieval." pith.science (2026). https://pith.science/paper/FVFJWEHE

@misc{pith2026250907532,
  author       = {Pith},
  title        = {Pith review of: Uncertainty-Driven Hierarchical Sampling for Unbalanced Continual Malware Detection with Time-Series Update-Based Retrieval},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FVFJWEHE}},
  note         = {Machine review of arXiv:2509.07532}
}
read the original abstract

Android malware detection continues to face persistent challenges stemming from long-term concept drift and class imbalance, as evolving malicious behaviors and shifting usage patterns dynamically reshape feature distributions. Although continual learning (CL) mitigates drift, existing replay-based methods suffer from inherent bias. Specifically, their reliance on classifier uncertainty for sample selection disproportionately prioritizes the dominant benign class, causing overfitting and reduced generalization to evolving malware. To address these limitations, we propose a novel uncertainty-guided CL framework. First, we introduce a hierarchical balanced sampler that employs a dual-phase uncertainty strategy to dynamically balance benign and malicious samples while simultaneously selecting high-information, high-uncertainty instances within each class. This mechanism ensures class equilibrium across both replay and incremental data, thereby enhancing adaptability to emerging threats. Second, we augment the framework with a vector retrieval mechanism that exploits historical malware embeddings to identify evolved variants via similarity-based retrieval, thereby complementing classifier updates. Extensive experiments demonstrate that our framework significantly outperforms state-of-the-art methods under strict low-label conditions (50 labels per phase). It achieves a true positive rate (TPR) of 92.95\% and a mean accuracy (mACC) of 94.26\%, which validates its efficacy for sustainable Android malware detection.

Figures

Figures reproduced from arXiv: 2509.07532 by the authors.

Figure 1
Figure 1. The overall pipeline of our proposed method. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. The pipeline of the retrieval framework. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. The introduction of datasets: (a) represents the API [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Performance comparison between our method and [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Ablation study about the retrieval module. The hori [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Ablation study of sampler’s multi-class module [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

50 extracted references · 46 canonical work pages

  1. [1]

    Continuous learning for Android malware detection

    Chen Y , Ding Z, Wagner D. Continuous learning for Android malware detection. In:32nd USENIX Security Symposium (USENIX Security 23). 2023: 1127-1144

    work page 2023

  2. [2]

    Automated, reliable zero- day malware detection based on autoencoding architecture

    Kim C, Chang S Y , Kim J, Lee D, Kim J. Automated, reliable zero- day malware detection based on autoencoding architecture. In:IEEE Transactions on Network and Service Management. 2023; 20(3): 3900- 3914

    work page 2023

  3. [3]

    ArchSentry: Enhanced Android Malware Detection via Hierarchical Semantic Ex- traction

    Wang T, Liu M, Li H, Zhao L, Jiang C, Xia C, Cui B. ArchSentry: Enhanced Android Malware Detection via Hierarchical Semantic Ex- traction. In:IEEE Transactions on Network and Service Management. 2025

    work page 2025

  4. [4]

    Entropy-based sample selection for online contin- ual learning

    Wiewel F, Yang B. Entropy-based sample selection for online contin- ual learning. In:2020 28th European Signal Processing Conference (EUSIPCO). IEEE, 2021: 1477-1481

    work page 2020

  5. [5]

    Active learning literature survey

    Settles B. Active learning literature survey. 2009

    2009

  6. [6]

    Uncertainty in deep learning

    Gal Y . Uncertainty in deep learning. 2016

    work page 2016

  7. [7]

    The power of ensembles for active learning in image classification

    Beluch WH, Genewein T, N ¨urnberger A, et al. The power of ensembles for active learning in image classification. In:Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. 2018: 9368- 9377

    work page 2018

  8. [8]

    Discriminative active learning

    Gissin D, Shalev-Shwartz S. Discriminative active learning. arXiv preprint arXiv:1907.06347, 2019

    arXiv 1907

Show all 50 references
  1. [9]

    Semi-supervised learning with variational Bayesian inference and maximum uncertainty regularization

    Do K, Tran T, Venkatesh S. Semi-supervised learning with variational Bayesian inference and maximum uncertainty regularization. In:Pro- ceedings of the AAAI Conference on Artificial Intelligence. 2021, 35(8): 7236-7244

    2021

  2. [10]

    Uncertainty-based continual learning with adaptive regularization.Advances in Neural Information Processing Systems, 2019, 32

    Ahn H, Cha S, Lee D, et al. Uncertainty-based continual learning with adaptive regularization.Advances in Neural Information Processing Systems, 2019, 32

    2019

  3. [11]

    Transcending TRANSCEND: Revisiting malware classification in the presence of concept drift.2022 IEEE Symposium on Security and Privacy (SP), 2022: 805-823

    Barbero F, Pendlebury F, Pierazzi F, et al. Transcending TRANSCEND: Revisiting malware classification in the presence of concept drift.2022 IEEE Symposium on Security and Privacy (SP), 2022: 805-823

    2022

  4. [12]

    Overcoming catastrophic forgetting in neural networks.Proceedings of the National Academy of Sciences, 2017, 114(13): 3521-3526

    Kirkpatrick J, Pascanu R, Rabinowitz N, et al. Overcoming catastrophic forgetting in neural networks.Proceedings of the National Academy of Sciences, 2017, 114(13): 3521-3526

    2017

  5. [13]

    Progressive neural networks

    Rusu AA, Rabinowitz NC, Desjardins G, et al. Progressive neural networks. arXiv preprint arXiv:1606.04671, 2016

    2016 arXiv

  6. [14]

    iCaRL: Incremental classifier and representation learning

    Rebuffi SA, Kolesnikov A, Sperl G, et al. iCaRL: Incremental classifier and representation learning. In:Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. 2017: 2001-2010

    2017

  7. [15]

    DER: Dynamically expandable representation for class incremental learning

    Yan S, Xie J, He X. DER: Dynamically expandable representation for class incremental learning. In:Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2021: 3014-3023

    2021

  8. [16]

    PODNet: Pooled outputs distil- lation for small-tasks incremental learning

    Douillard A, Cord M, Ollion C, et al. PODNet: Pooled outputs distil- lation for small-tasks incremental learning. In:Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XX 16. Springer International Publishing, 2020: 86- 102

    2020

  9. [17]

    Toward deep super- vised anomaly detection: Reinforcement learning from partially labeled anomaly data

    Pang G, van den Hengel A, Shen C, et al. Toward deep super- vised anomaly detection: Reinforcement learning from partially labeled anomaly data. In:Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining. 2021: 1298-1308

    2021

  10. [18]

    Towards Building Generalizable Models for Malware Detection

    Shin J, Rivas E, Lucio D, et al. Towards Building Generalizable Models for Malware Detection. In:2024 IEEE International Conference on Big Data (BigData). IEEE, 2024: 5656-5663

    2024

  11. [19]

    Improving adversarial robustness using knowledge distillation guided by attention information bottleneck

    Gong Y , Wang S, Yu T, et al. Improving adversarial robustness using knowledge distillation guided by attention information bottleneck. Information Sciences, 2024, 665: 120401

    2024

  12. [20]

    Model-agnostic meta-learning for fast adaptation of deep networks

    Finn C, Abbeel P, Levine S. Model-agnostic meta-learning for fast adaptation of deep networks. In:International Conference on Machine Learning. PMLR, 2017: 1126-1135. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 10

    2017

  13. [21]

    Prototypical networks for few-shot learning.Advances in Neural Information Processing Systems, 2017, 30

    Snell J, Swersky K, Zemel R. Prototypical networks for few-shot learning.Advances in Neural Information Processing Systems, 2017, 30

    2017

  14. [22]

    Learning to compare: Relation network for few-shot learning

    Sung F, Yang Y , Zhang L, et al. Learning to compare: Relation network for few-shot learning. In:Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. 2018: 1199-1208

    2018

  15. [23]

    Meta-baseline: Exploring simple meta- learning for few-shot learning

    Chen Y , Liu Z, Xu H, et al. Meta-baseline: Exploring simple meta- learning for few-shot learning. In:Proceedings of the IEEE/CVF International Conference on Computer Vision. 2021: 9062-9071

    2021

  16. [24]

    A baseline for few-shot image classification

    Dhillon GS, Chaudhari P, Ravichandran A, et al. A baseline for few-shot image classification. arXiv preprint arXiv:1909.02729, 2019

    1909 arXiv

  17. [25]

    Meta-learning for multi-family android malware classification.ACM Transactions on Software Engineering and Methodology, 2024, 33(7): 1-27

    Li Y , Yuan D, Zhang T, et al. Meta-learning for multi-family android malware classification.ACM Transactions on Software Engineering and Methodology, 2024, 33(7): 1-27

    2024

  18. [26]

    NF-GNN: Network flow graph neural networks for malware detection and classification

    Busch J, Kocheturov A, Tresp V , et al. NF-GNN: Network flow graph neural networks for malware detection and classification. In: Proceedings of the 33rd International Conference on Scientific and Statistical Database Management. 2021: 121-132

    2021

  19. [27]

    FewM-HGCL: Few-shot malware variants de- tection via heterogeneous graph contrastive learning.IEEE Transactions on Dependable and Secure Computing, 2022

    Liu C, Li B, Zhao J, et al. FewM-HGCL: Few-shot malware variants de- tection via heterogeneous graph contrastive learning.IEEE Transactions on Dependable and Secure Computing, 2022

    2022

  20. [28]

    Few-shot class-incremental learning

    Tao X, Hong X, Chang X, et al. Few-shot class-incremental learning. In:Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR). Jun. 2020: 12183-12192

    2020

  21. [29]

    Incremental few-shot learning with attention attractor networks.Adv

    Ren M, Liao R, Fetaya E, et al. Incremental few-shot learning with attention attractor networks.Adv. Neural Inform. Process. Syst. (NeurIPS), 2019, 32: 5275-5285

    2019

  22. [30]

    Few-shot lifelong learning.Proc

    Mazumder P, Singh P, Rai P. Few-shot lifelong learning.Proc. AAAI Conf. Artif. Intell., 2021, 35(3): 2337-2345

    2021

  23. [31]

    Self-promoted prototype refinement for few-shot class-incremental learning

    Zhu K, Cao Y , Zhai W, et al. Self-promoted prototype refinement for few-shot class-incremental learning. In:Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR). Jun. 2021: 6801-6810

    2021

  24. [32]

    Semantic-aware knowledge distillation for few-shot class incremental learning

    Cheraghian A, Rahman S, Fang P, et al. Semantic-aware knowledge distillation for few-shot class incremental learning. In:Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR). Jun. 2021: 2534-2543

    2021

  25. [33]

    An incremental malware classification approach based on few-shot learning

    Qiang Q, et al. An incremental malware classification approach based on few-shot learning. In:Proc. IEEE Int. Conf. Commun., May 2022: 2682-2687

    2022

  26. [34]

    Forward compatible few-shot class- incremental learning

    Zhou DW, Wang FY , Ye HJ, et al. Forward compatible few-shot class- incremental learning. In:Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR). Jun. 2022: 9046-9056

    2022

  27. [35]

    Few-shot class-incremental learning via relation knowledge distillation

    Dong S, Hong X, Tao X, et al. Few-shot class-incremental learning via relation knowledge distillation. In:Proc. AAAI, 2021: 1255-1263

    2021

  28. [36]

    GPTree: A Gaussian process classifier for few-shot incremental learning

    Achituve I, Navon A, Yemini Y , et al. GPTree: A Gaussian process classifier for few-shot incremental learning. In:Proc. Int. Conf. Mach. Learn., 2021: 54-65

    2021

  29. [37]

    Few-shot class-incremental learning via compact and separable features for fine-grained vehicle recognition.IEEE Trans

    Li DW, Huang H. Few-shot class-incremental learning via compact and separable features for fine-grained vehicle recognition.IEEE Trans. Intell. Transp. Syst., 2022, 23(11): 21418-21429

    2022

  30. [38]

    Evidential deep learning to quantify classification uncertainty.Advances in Neural Information Processing Systems, 2018, 31

    Sensoy M, Kaplan L, Kandemir M. Evidential deep learning to quantify classification uncertainty.Advances in Neural Information Processing Systems, 2018, 31

    2018

  31. [39]

    In:Computers in Biology and Medicine

    Chen Y , Yang Z, Shen C, Wang Z, Zhang Z, Qin Y ,et al.Evidence- based uncertainty-aware semi-supervised medical image segmentation. In:Computers in Biology and Medicine. 2024; 170: 108004

    2024

  32. [40]

    EVIL: Evidential inference learning for trustworthy semi-supervised medical image seg- mentation

    Chen Y , Yang Z, Shen C, Wang Z, Qin Y , Zhang Y . EVIL: Evidential inference learning for trustworthy semi-supervised medical image seg- mentation. In:2023 IEEE 20th International Symposium on Biomedical Imaging (ISBI). 2023: 1–5

    2023

  33. [41]

    Patient-level anatomy meets scanning-level physics: Personalized federated low-dose ct denoising empowered by large language model

    Yang, Z., Chen, Y ., Wang, Z., Shan, H., Chen, Y ., Zhang, Y . Patient-level anatomy meets scanning-level physics: Personalized federated low-dose ct denoising empowered by large language model. In:Proceedings of the Computer Vision and Pattern Recognition Conference. 2025: 5154– 5163

    2025

  34. [42]

    Enhancing state-of-the-art classifiers with API semantics to detect evolved Android malware

    Zhang X, Zhang Y , Zhong M, et al. Enhancing state-of-the-art classifiers with API semantics to detect evolved Android malware. In:Proc. 2020 ACM SIGSAC Conf. Comput. Commun. Secur., 2020: 757-770

    2020

  35. [43]

    https://androzoo.uni.lu/

    AndroZoo. https://androzoo.uni.lu/

  36. [44]

    https://www.virustotal.com/

    VirusTotal. https://www.virustotal.com/

  37. [45]

    https://virusshare.com/

    VirusShare. https://virusshare.com/

  38. [46]

    Dos and don’ts of machine learning in computer security

    Arp D, Quiring E, Pendlebury F, et al. Dos and don’ts of machine learning in computer security. In:31th USENIX Security Symposium (USENIX Security 22), 2022: 3971-3988

    2022

  39. [47]

    AndroZoo: Collecting millions of Android apps for the research community

    Allix K, Bissyand ´e TF, Klein J, et al. AndroZoo: Collecting millions of Android apps for the research community. In:Proc. 13th Int. Conf. Mining Softw. Repositories, 2016: 468-471

    2016

  40. [48]

    Deep ground truth analysis of current Android malware

    Wei F, Li Y , Roy S, et al. Deep ground truth analysis of current Android malware. In:Detection of Intrusions and Malware, and Vulnerability Assessment, 2017: 252-276

    2017

  41. [49]

    BODMAS: An open dataset for learning based temporal analysis of PE malware

    Yang L, Ciptadi A, Laziuk I, et al. BODMAS: An open dataset for learning based temporal analysis of PE malware. In:2021 IEEE Security and Privacy Workshops (SPW), 2021: 78-84

    2021

  42. [50]

    CADE: Detecting and explaining concept drift samples for security applications

    Yang L, Guo W, Hao Q, et al. CADE: Detecting and explaining concept drift samples for security applications. In:30th USENIX Security Symposium (USENIX Security 21), 2021: 2327-2344. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 11 VI. BIOGRAPHYSECTION Yi Xiereceive...

    2021

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.