Pith. sign in

REVIEW 4 major objections 6 minor 35 references

MADCAT: Combating Malware Detection Under Concept Drift with Test-Time Adaptation

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read MADCAT claims that test-time training with a masked autoencoder lets an Android malware detector keep higher F1 scores than a fixed supervised baseline across four years of concept drift.

desk verdict The paper applies a known test-time-training recipe to Android malware drift, but the main experiment quietly uses ground-truth labels for balancing, so the claimed label-free gain is not actually demonstrated. read the letter →

arxiv 2505.18734 v1 pith:VWAO4SLP submitted 2025-05-24 cs.CR cs.LG

Eunjin Roh , Yigitcan Kaya , Christopher Kruegel , Giovanni Vigna , Sanghyun Hong This is my paper
classification cs.CRcs.LG
keywords conceptdriftmalwaredetectiontest-timeadaptationtrainingmaskedautoencoderself-supervisedlearningAndroidpseudo-labeling
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a malware detector can survive years of concept drift by adapting at test time with self-supervised masked reconstruction, rather than by retraining on newly labeled data. On seven years of Android app features, the proposed MADCAT detector keeps F1 consistently above a fixed supervised baseline across monthly batches from 2015 to 2018. It also shows that combining this self-supervised adaptation with a pseudo-labeling approach yields better results than pseudo-labeling alone. A sympathetic reading is that the self-supervised reconstruction objective, not any labeled fine-tuning, is what preserves detection over time; the main experiments, however, balance the test-time adaptation set using ground-truth labels.

What carries the argument

The masked autoencoder (MAE) is the load-bearing object: an encoder-decoder trained initially to reconstruct binary feature vectors with a random subset of inputs masked, with a default masking ratio of 0.3 and best results in the 0.1-0.6 range. At test time, the encoder only is fine-tuned for a single step per sample via the same reconstruction loss on the incoming stream, and the frozen classification head then scores the updated representations. Pseudo-labeling with three balancing strategies (random, confidence-based top-N, and confidence-based bucket) is used to counter the 9:1 benign-to-malicious skew when ground-truth labels are unavailable.

What would settle it

Train MADCAT's encoder-decoder on the same monthly batches but replace the reconstruction loss with a supervised cross-entropy loss on the same ground-truth-balanced labels; if that supervised fine-tuning attains equal or better F1 than MADCAT, the claim that self-supervision drives the improvement is falsified. Conversely, if MADCAT's gain persists when the test-time batches are balanced with no labels at all, the claim is supported.

Watch

Extended reading notes

Core claim

MADCAT's central claim is that test-time training with a masked autoencoder provides the adaptation signal needed to resist concept drift in malware detection without human-annotated labels: the encoder is fine-tuned on a small balanced batch of incoming samples by minimizing reconstruction loss on randomly masked feature vectors, while the classification head stays fixed. In the authors' evaluation on Android malware features collected over 2012-2018, MADCAT reports consistently higher F1 scores than a fixed supervised BinaryMLP baseline across all monthly 2015-2018 test batches, and outperforms or complements pseudo-labeling approaches.

Load-bearing premise

The load-bearing premise is that the F1 gain comes from the masked-reconstruction objective rather than from the ground-truth labels used to balance the test-time adaptation set, a split the experiments never isolate.

Editorial extensions

If this is right

  • If MADCAT is right, a deployed Android malware detector can stay accurate across years of drift using only unlabeled incoming samples plus a small balanced adaptation set.
  • The synergy result implies that self-supervised test-time adaptation and pseudo-label-based adaptation are complementary, with pseudo-labels able to supply the balancing signal when ground-truth labels are absent.
  • Masking is necessary: with masking ratio 0.0 the reconstruction objective provides no measurable benefit, so the adaptive gain is tied to the masked-reconstruction task itself.
  • The authors expect the same recipe to generalize to other malware domains and alternative self-supervised objectives, and they explicitly identify broader evaluation as future work.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the main protocol balances test-time batches with ground-truth labels and includes no supervised fine-tuning control on the same labeled batches, the current evidence does not yet distinguish adaptation-by-reconstruction from adaptation-by-labels.
  • If the MAE objective is the true driver, MADCAT should also work when test-time balancing uses only pseudo-labels or random sampling in a fully label-free stream; the paper's pseudo-label results are suggestive but cover a shorter horizon than the four-year labeled evaluation.
  • The binary 1,159-dimensional API-presence features are a forgiving domain for reconstruction; testing on raw permission or opcode sequences with different masking structures could bound how much of the gain is specific to this feature representation.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper introduces MADCAT, a test-time adaptation method for Android malware detection under concept drift. MADCAT initially trains a masked autoencoder (MAE) alongside a classification head on 2012–2014 data, then adapts the encoder during inference on monthly 2015–2018 data by minimizing a masked-reconstruction loss. The authors evaluate on the APIGraph dataset with ground-truth-balanced and pseudo-labeled test-time data and report F1 improvements over a fixed detector, plus ablations over dataset balancing and masking ratio.

Significance. If the central claim is supported, self-supervised test-time adaptation would be a useful label-efficient tool for malware concept drift, and the paper's use of a multi-year Android dataset and pseudo-label balancing is a practical step. The paper does not, however, provide the control needed to attribute the observed gains to the self-supervised MAE objective, because the main experiment uses ground-truth labels to balance the adaptation set and no supervised fine-tuning baseline is reported. The approach is plausible, but the current evidence is insufficient to establish the headline claim.

major comments (4)
  1. [Section 4.2, Figure 3] The main evaluation uses ground-truth labels to balance the test-time training set, as stated in Section 4.2 ('The dataset for both initial training ... is balanced based on the ground truth labels'), which contradicts the label-free premise in the abstract and Section 3.2. Because the only baseline is a fixed detector that is never updated, the observed F1 gain could come entirely from fine-tuning on a balanced future-data sample rather than from the self-supervised reconstruction objective. A supervised fine-tuning baseline on the same balanced test-time data is missing and is required to support the claim that self-supervision is the cause of the improvement.
  2. [Section 4.3, Figure 4] The pseudo-label experiments compare MADCAT variants only against a fixed no-adaptation baseline. They do not include a control that fine-tunes the same encoder on the same pseudo-labeled, balanced data with a supervised objective but without the MAE reconstruction loss. Without this control, the synergy claim for self-supervision and pseudo-labeling is not established, and the lower performance relative to the ground-truth-balanced version cannot be attributed to label noise rather than to the MAE objective.
  3. [Section 4.4] The ablation in Figure 5 shows that a masking ratio of 0.0 hurts performance relative to nonzero ratios, but this only demonstrates that some masking is needed for the reconstruction task; it does not compare MADCAT against supervised fine-tuning on the same test-time data. The ablation also omits error bars or multiple-seed results, so the reported F1 differences cannot be assessed for statistical significance.
  4. [Section 4.2 and Section 2] The evaluation compares MADCAT only with a fixed, never-updated detector. Prior drift-adaptation methods discussed in Section 2 (e.g., MORPH, continuous learning approaches) are not implemented or compared numerically, despite the paper's claim that prior pseudo-labeling 'remains ineffective' in Section 4.3. A comparison with such a supervised or pseudo-label adaptation baseline is needed to substantiate the claim that MADCAT 'consistently outperforms baseline methods' beyond the fixed detector.
minor comments (6)
  1. [Appendix B] Appendix B is titled 'Additional Evaluation Restuls'; 'Restuls' should be 'Results'.
  2. [Section 4.1 and Appendix A] In Section 4.1 the dataset is attributed to Zhang et al. (2020), while Appendix A cites it as Chen et al. (2023a); please use the original APIGraph citation consistently.
  3. [References] The reference to Gama et al. contains a corrupted author name ('ˇZliobaitundefined'); the encoding should be fixed.
  4. [All figures] No variance or repeated-run statistics are reported anywhere; please add error bars or seed-averaged F1 values to support the comparative claims.
  5. [Section 4.2] Please clarify whether test-time training is performed one step per sample with cumulative model updates, and how the validation split is used after adaptation.
  6. [Figures 1 and 3] Figures 1 and 3 appear to present the same overall performance curve; please clarify the relationship or remove the duplication.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the ground-truth balancing issue is an experimental confound, not a derivation-level reduction.

full rationale

The paper contains no derivation chain in which a claimed prediction is equivalent to an input by construction. The central comparison (Figure 3) is between a fixed baseline and MADCAT, which applies test-time MAE reconstruction updates on a balanced subset; the balancing uses ground-truth labels, but the classification head is not trained on those labels, and the reported F1 is on held-out monthly splits. The absence of a supervised fine-tuning control is a genuine confound for attributing the gain to the self-supervised objective, but a missing control is not circularity: it does not make the output equal to the input or reduce a parameter to a fitted value. There are no self-citations that carry a load-bearing premise, no uniqueness theorem imported from the authors, and no known result merely renamed. The pseudo-labeling variant (Section 4.3) directly addresses the label-free setting. Accordingly, score 0.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the dataset being representative of concept drift, on the transferability of MAE representations to malware features, and on the validity of the balancing protocol. The main free parameters are hyperparameters; no new entities are introduced.

free parameters (4)
  • MAE masking ratio = 0.3 (default, best in 0.1-0.6 range)
    Chosen from a sweep over 0.0-0.9; affects reconstruction and downstream F1.
  • Test-time training steps per sample = 1
    Set by hand; no ablation of this value is shown.
  • Initial training epochs = 800
    Reports the training schedule, not swept.
  • Learning rate = 0.003
    Fixed for both MAE and classifier training; not swept.
assumptions (4)
  • domain assumption The APIGraph dataset with 1,159-dimensional Drebin features captures Android malware evolution from 2012-2018.
    The paper builds its temporal evaluation on this dataset without external validation that it represents real-world drift.
  • ad hoc to paper MAE reconstruction of masked binary features yields representations that remain useful for malware classification under drift.
    This is the core hypothesis; the paper does not provide a mechanism or proof beyond the empirical F1 results.
  • domain assumption Within each month, the 70% test-time training split and 30% validation split are independent enough to measure adaptation benefit.
    The split is temporal within the month; the paper does not analyze temporal ordering within the month.
  • domain assumption Pseudo-labels from the base model are reliable enough to balance the test-time data without introducing harmful bias.
    The pseudo-label balancing is evaluated, but no noise analysis of the pseudo-labels is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MADCAT: Combating Malware Detection Under Concept Drift with Test-Time Adaptation." pith.science (2026). https://pith.science/paper/VWAO4SLP

@misc{pith2026250518734,
  author       = {Pith},
  title        = {Pith review of: MADCAT: Combating Malware Detection Under Concept Drift with Test-Time Adaptation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VWAO4SLP}},
  note         = {Machine review of arXiv:2505.18734}
}
read the original abstract

We present MADCAT, a self-supervised approach designed to address the concept drift problem in malware detection. MADCAT employs an encoder-decoder architecture and works by test-time training of the encoder on a small, balanced subset of the test-time data using a self-supervised objective. During test-time training, the model learns features that are useful for detecting both previously seen (old) data and newly arriving samples. We demonstrate the effectiveness of MADCAT in continuous Android malware detection settings. MADCAT consistently outperforms baseline methods in detection performance at test time. We also show the synergy between MADCAT and prior approaches in addressing concept drift in malware detection

Figures

Figures reproduced from arXiv: 2505.18734 by the authors.

Figure 1
Figure 1. MADCAT Performance. MADCAT consistently outperforms the baselines across all evaluation periods, ad￾dressing the concept drift in ML-based malware detection. 2023a;b). Most prior work addresses this issue with su￾pervised learning techniques that allow models to learn new features useful for detecting emerging malware vari￾ants. This is typically achieved through re-training or fine￾tuning detection models on newly … view at source ↗
Figure 2
Figure 2. MADCAT Workflow. of both malware and benign samples that are robust to distri￾butional shifts over time. At test-time, MADCAT performs fine-tuning of its encoder on future data. We evaluate MADCAT on Android malware detection using a dataset consisting of malware and benign applications col￾lected over a 7-year period. As summarized in [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. MADCAT Performance. It maintains consistent F1 scores, while the baseline shows gradual degradation. Models. We utilize BinaryMLP, a classification model de￾signed for malware detection in recent work (Chen et al., 2023a). We integrate the MAE (Gandelsman et al., 2022) into BinaryMLP. For training, we use a learning rate of 0.003 and 800 epochs for the initial training of the MAE￾augmented BinaryMLP. Test-time train… view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: MADCAT performance with pseudo-labeling. All MADCATs achieve higher F1 scores vs. the baseline. tical in real-world scenarios. Alam et al. (2024) address this issue using pseudo-labeling—where the base model is used to label incoming data, and it is continuously fine￾t…
Figure 5
Figure 5. Figure 5: Impact of database balancing (upper) and masking ratios (lower) on MADCAT performance. observe that even when trained on an unbalanced dataset, MADCAT remains effective in addressing concept drift in malware detection. In both scenarios, MADCAT consis￾tently outperform…
Figure 6
Figure 6. Figure 6: shows the class-wise accuracy of MADCAT on benign and malicious samples. Throughout the evaluation period, the accuracy on benign samples consistently exceeds that of the baseline. For malicious samples, MADCAT occasionally shows slightly lower accuracy than the baseli…
Figure 7
Figure 7. Figure 7: Performance of MADCAT with different pseudo-labeling strategies. All methods show similar or higher benign accuracy than the baseline; malicious accuracy is slightly lower but comparable. 8 [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

35 extracted references · 21 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    T., Fieblinger, R., Mahara, A., and Rastogi, N

    Alam, M. T., Fieblinger, R., Mahara, A., and Rastogi, N. Morph: Towards automated concept drift adaptation for malware detection, 2024. URL https://arxiv.org/abs/2401.12790. Accepted as a poster at NDSS 2024

    arXiv 2024

  3. [3]

    Drebin: Effective and explainable detection of android malware in your pocket

    Arp, D., Spreitzenbarth, M., Hübner, M., Gascon, H., and Rieck, K. Drebin: Effective and explainable detection of android malware in your pocket. 02 2014. doi:10.14722/ndss.2014.23247

    arXiv 2014

  4. [4]

    Transcending transcend: Revisiting malware classification in the presence of concept drift

    Barbero, F., Pendlebury, F., Pierazzi, F., and Cavallaro, L. Transcending transcend: Revisiting malware classification in the presence of concept drift. In 2022 IEEE Symposium on Security and Privacy (SP), pp.\ 805--823, 2022. doi:10.1109/SP46214.2022.9833659

    arXiv 2022

  5. [5]

    and Vapnik, V

    Bottou, L. and Vapnik, V. Local Learning Algorithms . Neural Computation , 4 0 (6): 0 888--900, 1992

    work page 1992

  6. [6]

    Hybrid analysis of android apps for security vetting using deep learning

    Chaulagain, D., Poudel, P., Pathak, P., Roy, S., Caragea, D., Liu, G., and Ou, X. Hybrid analysis of android apps for security vetting using deep learning. In 2020 IEEE Conference on Communications and Network Security (CNS), pp.\ 1--9, 2020. doi:10.1109/CNS48642.2020.9162341

    arXiv 2020

  7. [7]

    Continuous learning for android malware detection

    Chen, Y., Ding, Z., and Wagner, D. Continuous learning for android malware detection. In Proceedings of the 32nd USENIX Conference on Security Symposium, SEC '23, USA, 2023 a . USENIX Association. ISBN 978-1-939133-37-3

    work page 2023

  8. [8]

    Is it overkill? analyzing feature-space concept drift in malware detectors

    Chen, Z., Zhang, Z., Kan, Z., Yang, L., Cortellazzi, J., Pendlebury, F., Pierazzi, F., Cavallaro, L., and Wang, G. Is it overkill? analyzing feature-space concept drift in malware detectors. In 2023 IEEE Security and Privacy Workshops (SPW), pp.\ 21--28, 2023 b . doi:10.1109/SPW59333.2023.00007

    arXiv 2023

Show all 35 references
  1. [9]

    a., Z liobaitundefined, I., Bifet, A., Pechenizkiy, M., and Bouchachia, A

    Gama, J. a., Z liobaitundefined, I., Bifet, A., Pechenizkiy, M., and Bouchachia, A. ACM Comput. Surv., 46 0 (4), March 2014. ISSN 0360-0300. doi:10.1145/2523813. URL https://doi.org/10.1145/2523813

    2014 doi

  2. [10]

    Gandelsman, Y., Sun, Y., Chen, X., and Efros, A. A. Test-time training with masked autoencoders. In Oh, A. H., Agarwal, A., Belgrave, D., and Cho, K. (eds.), Advances in Neural Information Processing Systems, 2022. URL https://openreview.net/forum?id=SHMi1b7sjXk

    2022

  3. [11]

    and Sun, Y

    Hardt, M. and Sun, Y. Test-time training on nearest neighbors for large language models. In The Twelfth International Conference on Learning Representations, 2024. URL https://openreview.net/forum?id=CNL2bku4ra

    2024

  4. [12]

    Masked autoencoders are scalable vision learners

    He, K., Chen, X., Xie, S., Li, Y., Dollár, P., and Girshick, R. Masked autoencoders are scalable vision learners. In 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp.\ 15979--15988, 2022. doi:10.1109/CVPR52688.2022.01553

    2022

  5. [13]

    Using self-supervised learning can improve model robustness and uncertainty

    Hendrycks, D., Mazeika, M., Kadavath, S., and Song, D. Using self-supervised learning can improve model robustness and uncertainty. Curran Associates Inc., Red Hook, NY, USA, 2019

    2019

  6. [14]

    K., Wang, Z., Papini, D., Nouretdinov, I., and Cavallaro, L

    Jordaney, R., Sharad, K., Dash, S. K., Wang, Z., Papini, D., Nouretdinov, I., and Cavallaro, L. Transcend: detecting concept drift in malware classification models. In Proceedings of the 26th USENIX Conference on Security Symposium, SEC'17, pp.\ 625–642, USA, 2017. USENIX Asso...

    2017

  7. [15]

    J., Amlani, D., Nicholas, C., and Raff, E

    Joyce, R. J., Amlani, D., Nicholas, C., and Raff, E. Motif: A malware reference dataset with ground truth family labels. Comput. Secur., 124 0 (C), January 2023. ISSN 0167-4048. doi:10.1016/j.cose.2022.102921. URL https://doi.org/10.1016/j.cose.2022.102921

    2023

  8. [16]

    Data exfiltration: Methods and detection countermeasures

    King, J., Bendiab, G., Savage, N., and Shiaeles, S. Data exfiltration: Methods and detection countermeasures. In 2021 IEEE International Conference on Cyber Security and Resilience (CSR), pp.\ 442--447, 2021. doi:10.1109/CSR51186.2021.9527962

    2021

  9. [17]

    S., Iyengar, A., Kundu, A., and Bertino, E

    Li, A. S., Iyengar, A., Kundu, A., and Bertino, E. Revisiting concept drift in windows malware detection: Adaptation to real drifted malware with minimal samples. In Proceedings 2025 Network and Distributed System Security Symposium. In Network and Distributed System Security ...

    2025

  10. [18]

    A comprehensive survey on test-time adaptation under distribution shifts

    Liang, J., He, R., and Tan, T. A comprehensive survey on test-time adaptation under distribution shifts. International Journal of Computer Vision, 133 0 (1): 0 31--64, 2025. ISSN 1573-1405. doi:10.1007/s11263-024-02181-w. URL https://doi.org/10.1007/s11263-024-02181-w

    2025 doi

  11. [19]

    F., Awang, S., Tuan Mat, S

    Mohamad Arif, J., Ab Razak, M. F., Awang, S., Tuan Mat, S. R., Ismail, N. S. N., and Firdaus, A. A static analysis approach for android permission-based malware detection systems. PLOS ONE, 16 0 (9): 0 e0257968, 2021. doi:10.1371/journal.pone.0257968

    2021 doi

  12. [20]

    Efficient concept drift handling for batch android malware detection models

    Molina-Coronado, B., Mori, U., Mendiburu, A., and Miguel-Alonso, J. Efficient concept drift handling for batch android malware detection models. Pervasive Mob. Comput., 96 0 (C), December 2023. ISSN 1574-1192. doi:10.1016/j.pmcj.2023.101849. URL https://doi.org/10.1016/j.pmcj....

    2023

  13. [21]

    G., Raeder, T., Alaiz-Rodríguez, R., Chawla, N

    Moreno-Torres, J. G., Raeder, T., Alaiz-Rodríguez, R., Chawla, N. V., and Herrera, F. A unifying view on dataset shift in classification. Pattern Recognition, 45 0 (1): 0 521--530, 2012. ISSN 0031-3203. doi:https://doi.org/10.1016/j.patcog.2011.06.019. URL https://www.scienced...

    2012 doi

  14. [22]

    Nataraj, L., Karthikeyan, S., Jacob, G., and Manjunath, B. S. Malware images: visualization and automatic classification. In Proceedings of the 8th International Symposium on Visualization for Cyber Security, VizSec '11, New York, NY, USA, 2011. Association for Computing Machi...

    2011

  15. [23]

    \ TESSERACT \ : Eliminating experimental bias in malware classification across space and time

    Pendlebury, F., Pierazzi, F., Jordaney, R., Kinder, J., and Cavallaro, L. \ TESSERACT \ : Eliminating experimental bias in malware classification across space and time. In 28th USENIX security symposium (USENIX Security 19), pp.\ 729--746, 2019

    2019

  16. [24]

    and Bahtiyar, S

    Sahin, M. and Bahtiyar, S. A survey on malware detection with deep learning. In 13th International Conference on Security of Information and Networks, SIN 2020, New York, NY, USA, 2021. Association for Computing Machinery. ISBN 9781450387514. doi:10.1145/3433174.3433609. URL h...

    2020

  17. [25]

    Schlimmer, J. C. and Granger, R. H. Beyond incremental processing: tracking concept drift. In Proceedings of the Fifth AAAI National Conference on Artificial Intelligence, AAAI'86, pp.\ 502–507. AAAI Press, 1986

    1986

  18. [26]

    Explanation-Guided backdoor poisoning attacks against malware classifiers

    Severi, G., Meyer, J., Coull, S., and Oprea, A. Explanation-Guided backdoor poisoning attacks against malware classifiers. In 30th USENIX Security Symposium (USENIX Security 21), pp.\ 1487--1504. USENIX Association, August 2021. ISBN 978-1-939133-24-3. URL https://www.usenix.o...

    2021

  19. [27]

    and Honig, A

    Sikorski, M. and Honig, A. Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press, USA, 1st edition, 2012. ISBN 1593272901

    2012

  20. [28]

    A., and Hardt, M

    Sun, Y., Wang, X., Liu, Z., Miller, J., Efros, A. A., and Hardt, M. Test-time training with self-supervision for generalization under distribution shifts. In Proceedings of the 37th International Conference on Machine Learning, ICML'20. JMLR.org, 2020

    2020

  21. [29]

    The problem of concept drift: definitions and related work

    Tsymbal, A. The problem of concept drift: definitions and related work. 2004. URL https://api.semanticscholar.org/CorpusID:8335940

    2004

  22. [30]

    A., and Wang, X

    Wang, R., Sun, Y., Tandon, A., Gandelsman, Y., Chen, X., Efros, A. A., and Wang, X. Test-time training on video streams. JMLR, 2023

    2023

  23. [31]

    From grim reality to practical solution: Malware classification in real-world noise

    Wu, X., Guo, W., Yan, J., Coskun, B., and Xing, X. From grim reality to practical solution: Malware classification in real-world noise. In 2023 IEEE Symposium on Security and Privacy (SP), pp.\ 2602--2619, 2023. doi:10.1109/SP46215.2023.10179453

    2023

  24. [32]

    Byte-level malware classification based on markov images and deep learning

    Yuan, B., Wang, J., Liu, D., Guo, W., Wu, P., and Bao, X. Byte-level malware classification based on markov images and deep learning. Computers & Security, 92: 0 101740, 2020. ISSN 0167-4048. doi:https://doi.org/10.1016/j.cose.2020.101740. URL https://www.sciencedirect.com/sci...

    2020

  25. [33]

    Enhancing state-of-the-art classifiers with api semantics to detect evolved android malware

    Zhang, X., Zhang, Y., Zhong, M., Ding, D., Cao, Y., Zhang, Y., Zhang, M., and Yang, M. Enhancing state-of-the-art classifiers with api semantics to detect evolved android malware. In Proceedings of the 2020 ACM SIGSAC conference on computer and communications security, pp.\ 75...

    2020

  26. [34]

    A method for analyzing the performance impact of imbalanced binary data on machine learning models

    Zheng, M., Wang, F., Hu, X., Miao, Y., Cao, H., and Tang, M. A method for analyzing the performance impact of imbalanced binary data on machine learning models. Axioms, 11 0 (11): 0 607, 2022. doi:10.3390/axioms11110607. URL https://doi.org/10.3390/axioms11110607

    2022 doi

  27. [35]

    Measuring and modeling the label dynamics of online anti-malware engines

    Zhu, S., Shi, J., Yang, L., Qin, B., Zhang, Z., Song, L., and Wang, G. Measuring and modeling the label dynamics of online anti-malware engines. In Proceedings of the 29th USENIX Conference on Security Symposium, SEC'20, USA, 2020. USENIX Association. ISBN 978-1-939133-17-5

    2020

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.