🤖 machine learning

SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget

The paper proposes SEED, a semi-supervised continual learning framework that combines a tailored binary cross-entropy objective with active learning and singular value decomposition to effectively detect malware under concept drift with limited labeled data, significantly outperforming existing hierarchical contrastive learning methods on datasets with weak semantic structures.

Original authors: Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram murthy Chebiyam, Bheemarjuna Reddy Tamma, Sumohana S Channappayya

Published 2026-05-26

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram murthy Chebiyam, Bheemarjuna Reddy Tamma, Sumohana S Channappayya

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a security guard at a busy airport. Your job is to spot bad guys (malware) among thousands of innocent travelers (benign apps).

The Problem: The "Chameleon" Criminals
The trouble is, the bad guys are constantly changing their disguises. A month ago, a criminal might have worn a red hat; today, they wear a blue one. In the world of computers, this is called Concept Drift. If your security system was trained only on "red hats," it will miss the "blue hats" that show up later.

To keep up, you need to retrain your security system every month. But there's a catch: Labeling is expensive and slow. To teach the system what a "bad guy" looks like, a human expert has to manually inspect and label samples. You can't afford to hire enough experts to label every single traveler. You only have a tiny budget to label a few.

The Old Way: The "Pairing" Trap
Previous methods tried to solve this by using a technique called Contrastive Learning. Imagine this as a game of "Find the Twin." The system tries to group similar-looking people together.

The Flaw: This game works great if you have a photo album of everyone labeled correctly. But if you only have a few labeled photos (the limited budget), the system gets confused. It tries to find twins among strangers and ends up grouping innocent people with criminals, or vice versa. The paper shows that when you try to use this "pairing" method with limited labels, the security system's performance drops significantly.

The New Solution: SEED (The Smart Matchmaker)
The authors propose a new method called SEED. Think of SEED not as a game of twins, but as a Smart Matchmaker that uses a "Memory Bank."

Here is how SEED works in three simple steps:

1. The "Memory Bank" (Buffer)

SEED keeps a small, curated collection of past examples (both good and bad) in a special memory bank. It doesn't just store them randomly; it organizes them using a mathematical trick called SVD (Singular Value Decomposition).

The Analogy: Imagine the memory bank is a library. Instead of keeping every single book, the librarian (SVD) creates a "summary map" of the most important stories. This map is compact but captures the essence of everything that happened before. This helps SEED remember the past without getting overwhelmed by too much data.

2. The "Matchmaker" (For Seen Tasks)

When a new, unlabeled traveler arrives, SEED doesn't guess. Instead, it projects them onto the "summary map" from the Memory Bank.

The Analogy: It asks, "Who in our history does this person look most like?" It finds the closest match in the past. If the new person looks very similar to a known criminal from last month, SEED treats them as a criminal too. If they look like a known innocent person, it treats them as innocent.
The Benefit: This allows the system to learn from the unlabeled majority by connecting them to the labeled minority, without needing to force them into rigid "twin" pairs.

3. The "Uncertainty Detector" (For Unseen Tasks)

Sometimes, a completely new type of criminal appears that looks nothing like anyone in the Memory Bank.

The Analogy: SEED calculates how "confused" it is about this new person. If the person is very far away from everyone in the memory bank (high uncertainty), SEED flags them.
The Action: It says to the human expert, "I'm not sure about this one. Please take a look and tell me if they are good or bad." This ensures the human only spends their limited budget on the samples that actually need help.

4. The "Cool-Down" Period (Delayed Buffer Update)

One of the biggest risks in security is Noisy Labels. Sometimes, even experts make mistakes, or automated tools give the wrong label. If you immediately put a wrong label into your Memory Bank, the system learns the wrong lesson and spreads that error to future tasks.

The Analogy: SEED introduces a "Cool-Down" period. When a new label is received, it doesn't go straight into the Memory Bank. It waits for a few months (a delay).
Why? By waiting, the system allows time for the label to be verified or for the "truth" to stabilize. If a label was a mistake, it might be corrected before it ever gets stored. This prevents the system from "poisoning" its own memory with bad data.

The Results: Why It Matters

The paper tested SEED on real-world data from Android and Windows systems.

The Win: Compared to the old "Pairing" methods, SEED was much better at catching new, unseen criminals, especially when the human experts could only label a small percentage (20%) of the data.
The Improvement: On one dataset, SEED improved detection by 40% compared to the old method when labels were scarce. On another, it improved by 14%.
The Robustness: Even when the labels were noisy (full of mistakes), SEED's "Cool-Down" strategy kept the system stable, whereas other methods crashed.

In Summary
SEED is a smarter way to train security guards. Instead of forcing them to memorize every single face (which is too expensive), it helps them connect new faces to a compact, organized memory of the past. It knows when to ask for help, and it waits to make sure the help is accurate before updating its memory. This keeps the security system sharp, even when the criminals keep changing their disguises.

Technical Summary: SEED - Semi-supervised Continual MalwarE Detection

1. Problem Statement

Machine learning-based malware detectors face significant obsolescence over time due to concept drift, where the statistical properties of both benign and malicious applications evolve. This phenomenon necessitates continuous adaptation (Open World Learning) while maintaining stability against catastrophic forgetting of previously learned knowledge.

A critical bottleneck in deploying such systems is the labeling budget. In the security domain, obtaining fully labeled data is arduous, expensive, and often unreliable due to labeling dynamics and verification delays. While recent state-of-the-art (SOTA) methods like HCL (Hierarchical Contrastive Learning) leverage semantic structures to handle drift, they rely heavily on fully labeled data. The authors observe that when HCL is adapted to semi-supervised settings (using only partial labels, denoted as HCL*), its performance degrades significantly, particularly on datasets lacking strong inherent semantic structures (e.g., BODMAS and AndroZoo). For instance, on the BODMAS dataset, HCL* drops from an AUT (Area Under the Time curve) of 0.795 to 0.613 compared to its fully supervised counterpart.

The paper addresses the challenge of maintaining robust malware detection under limited supervision and concept drift, specifically when strong semantic structures are absent or when labeling budgets are constrained.

2. Methodology: SEED

The proposed method, SEED (Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget), is a semi-supervised continual learning framework that integrates active learning and a delayed buffer update strategy. It operates in two distinct phases: training on "seen tasks" (partially labeled) and "unseen tasks" (fully unlabeled).

2.1 Training with Seen Tasks (Partially Labeled Data)

For tasks containing both labeled ( $D^l_t$ ) and unlabeled ( $D^u_t$ ) samples, SEED employs a two-step process to leverage unlabeled data without relying on contrastive loss:

Representation Space Construction via SVD: The method constructs a latent representation space using the labeled exemplars of past tasks. Instead of storing all raw representations, it applies Singular Value Decomposition (SVD) to the encoded latent vectors to extract orthonormal basis vectors. This reduces storage costs and captures the most salient features of the data.
Exemplar Selection and Pairwise Learning: For each unlabeled sample, SEED projects it into the SVD-based representation space. It then computes cosine distances to find the most suitable labeled exemplar (or a group of exemplars) from the buffer. An adaptive thresholding mechanism selects the best match based on the current labeled data ratio.
Loss Function: Instead of contrastive loss, SEED uses a tailored Binary Cross-Entropy (BCE) loss. It enforces representational similarity between an unlabeled sample and its selected labeled counterpart in the latent space.
Gradient Projection Memory (GPM): To mitigate catastrophic forgetting, SEED utilizes GPM. The gradients of the current task are projected orthogonal to the gradient directions of previous tasks (specifically for malware classes), ensuring that learning new features does not interfere with previously learned malware definitions.

2.2 Training with Unseen Tasks (Fully Unlabeled Data)

When encountering tasks with no labels, SEED employs an active learning strategy to transform the task into a partially labeled one:

Uncertainty Quantification: The model calculates the uncertainty of unlabeled samples by measuring their mean cosine distance to the benign and malware groups stored in the buffer.
Balanced Selection: To avoid bias toward the majority class (benign), the method selects samples for analyst labeling based on a balanced ranking strategy (selecting samples far from or close to specific groups to ensure representation from both classes).
Transition: Once a subset of samples is labeled by a security analyst, the task is treated as a "seen task" and processed using the methodology described in Section 2.1.

2.3 Delayed Buffer Update Strategy

To address the issue of label noise (common in security labeling where initial verdicts may be incorrect or unstable), SEED introduces a delayed buffer update. Newly labeled samples are not immediately added to the replay buffer. Instead, they are held for a fixed delay period (e.g., 1, 3, or 11 months) to allow labels to stabilize (mimicking the convergence of multi-engine antivirus verdicts). This prevents noisy labels from propagating during the replay-based learning process.

3. Key Contributions

Identification of Limitations in Contrastive Learning: The paper demonstrates that contrastive learning methods (like HCL) suffer significant performance degradation in semi-supervised settings when strong semantic structures are absent, highlighting the need for alternative approaches.
SEED Framework: A novel semi-supervised continual learning method that:
- Utilizes SVD to construct a robust representation space from limited labeled data.
- Replaces contrastive loss with a pairwise similarity learning approach using tailored BCE loss.
- Integrates active learning to select informative samples from fully unlabeled tasks.
Noise Mitigation: The introduction of a delayed buffer update strategy to mitigate the adverse effects of label noise, showing robustness even with high noise ratios (up to 80%).
Comprehensive Evaluation: Extensive experiments on Windows (BODMAS) and Android (AndroZoo, APIGraph) datasets demonstrating the method's effectiveness under varying labeling budgets and noise levels.

4. Experimental Results

The authors evaluated SEED against classical continual learning baselines (EWC, A-GEM, MIR, CBRS) and contrastive learning methods (CADE, HCL, HCL*).

Performance on BODMAS (Windows): SEED achieved a 40% average improvement in AUT (unseen malware detection) compared to HCL* across varying labeling budgets. It significantly outperformed HCL* (0.810 vs. 0.613) and CADE.
Performance on AndroZoo (Android): SEED showed a 14% average improvement over HCL* (0.855 vs. 0.780).
Performance on APIGraph (Android): On this dataset, which possesses strong semantic structures (API calls), SEED remained competitive with HCL*, achieving an AUT of 0.930 compared to HCL*'s 0.948. This suggests SEED is versatile, performing well even when semantic structures exist, though it shines most where they are absent.
Robustness to Label Noise: Under high label noise (up to 80%), SEED with the delayed buffer strategy maintained stable performance (e.g., unseen-AUT(A) around 0.85–0.90 on AndroZoo), whereas models trained directly on noisy labels degraded drastically.
Sensitivity Analysis: The method showed consistent improvements with higher labeling ratios, particularly on BODMAS, and demonstrated that the 95% SVD threshold and cosine distance metrics provided the most stable performance.

5. Significance and Claims

The paper claims that SEED provides a practical solution for malware detection in resource-constrained, open-world environments where fully labeled data is unavailable. Its primary significance lies in:

Decoupling from Semantic Structure: Unlike contrastive methods that require strong semantic relationships to form positive/negative pairs, SEED relies on projection into a basis-vector space, making it effective on diverse datasets regardless of inherent structure.
Budget Efficiency: It effectively leverages a small fraction of labeled data (e.g., 20%) to adapt to concept drift, reducing the dependency on exhaustive manual labeling.
Stability against Noise: By acknowledging the dynamic nature of security labels, the delayed buffer strategy offers a realistic mechanism to handle label noise without complex noise modeling.

The authors conclude that SEED is robust under limited supervision, outperforming contrastive learning in the absence of strong semantic structure while remaining competitive when such structure is present, thereby offering a balanced approach for continual malware detection.