arXiv:2605.24903v1 [cs.CR] 24 May 2026
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget SURESH KUMAR AMALAPURAM, Indian Institute of Technology Ropar, India BIKRAJ SHRESTA, Indian Institute of Technology Hyderabad, India SIVA RAM MURTHY CHEBIYAM, Indian Institute of Technology Hyderabad, India BHEEMARJUNA REDDY TAMMA, Indian Institute of Technology Hyderabad, India SUMOHANA CHANNAPPAYYA, Indian Institute of Technology Hyderabad, India Machine learning based malware detectors become obsolete over a period of time due to concept drift in the benign and malware apps. Recent method requires fully labeled data and combines hierarchical contrastive loss with active learning (HCL), leveraging the semantic structure of malware representations to improve robustness against drift. However, obtaining labeled data remains an arduous task in the security domain. Alternately, if training is performed using partially labeled data, HCL suffers a performance degradation in detecting unseen malware (in terms of area under the time (AUT) metric computed over precision recall area under the curve), particularly on datasets (such as BODMAS) where such semantic structures may not be present. Specifically, on the BODMAS dataset the reduction is from 0.795 to 0.613 and on AndroZoo, it is from 0.879 to 0.780. In this paper, we propose a semantic-structure-agnostic method for malware detection. The proposed method dubbed SEED is robust under limited supervision, outperforming contrastive learning in the absence of strong semantic structure while remaining competitive when such structure exists. Specifically SEED adopts a tailored binary cross-entropy, and integrates it with semi-supervised continual learning and active learning. The proposed method finds a suitable labeled sample for each unlabeled sample (from the seen tasks) by projecting it into the representation space constructed from the basis vectors of the previously seen data using singular value decomposition and encourages the malware detector to learn the same representation for these pairwise samples. On unseen tasks (fully unlabeled data), we quantify the uncertainty of the new sample using cosine distance in representation space and select the most uncertain samples for the security analyst to label. Later, we train the unseen tasks using seen tasks procedure. We evaluated the SEED using both Windows and Android malware datasets. Our experiments show that the proposed method, using 20% labeled data on seen tasks, achieves an average improvement (in terms of AUT) of 40% on the BODMAS dataset and 14% on the AndroZoo dataset for detecting unseen malware across varying labeling budgets, compared to HCL∗ (the semi-supervised adaptation of HCL). Further, its performance is competitive with HCL∗ on APIGraph dataset. Eventually, we introduce a delayed buffer update strategy to mitigate the effect of label noise in unseen tasks. This reduces noise propagation during replay and improves learning stability. CCS Concepts: • Security and privacy → Malware and its mitigation; • Computing methodologies → Machine learning; Semi-supervised learning; Learning paradigms. Additional Key Words and Phrases: Malware detection, Concept drift, Continual learning, Semi-supervised learning ACM Reference Format: Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana Channappayya. 2026. SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget . 1, 1 (May 2026), 42 pages. https://doi.org/10.1145/nnnnnnn.nnnnnnn
1
Introduction
Recently, sophisticated machine learning (ML) algorithms surpassed human intelligence in many cognitive tasks [1, 2]. Inspired by this success, many security researchers are adopting ML solutions for developing malware detectors. However, the progress of ML is slower in security applications as compared to other domains, due to the fixed closed world assumption, in which training and . , Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana Channappayya
1.2 1.0 0.8 0.6 0.4 0.2 0.0
PR-AUC
1.2 1.0 0.8 0.6 0.4 SEED 0.2 HCL* 0.0 5 6
PR-AUC
2
7
8
Month
9
10
11
SEED HCL*
15
20
25
Month
30
35
(a) PR-AUC on unseen malware on BODMAS dataset. (b) PR-AUC on unseen malware on AndroZoo dataset. (c) AUT over unseen malware on BODMAS and AndroZoo datasets AUT over unseen malware Dataset BODMAS [15] AndroZoo [14]
HCL [14]
HCL∗ [14]
SEED (proposed)
0.795 0.879
0.613 (↓) 0.780 (↓)
0.810 (↑) 0.855 (↑)
Fig. 1. Comparison of SEED with HCL∗ (HCL trained on partially labeled data) for unseen malware detection on the BODMAS and AndroZoo datasets. The BODMAS dataset spans twelve months; SEED and HCL∗ are trained on the first five months and evaluated on the remaining seven months. Similarly, AndroZoo spans three years (36 months); the malware detectors are trained on the first twelve months and evaluated on the remaining months. The top two figures (Fig. 1a and Fig. 1b) illustrate the performance decay of the respective methods using the precision–recall area under the curve (PR-AUC) metric. The x-axis (labeled as month) denotes the testing month for each dataset. The table in the bottom row summarizes performance degradation in detecting unseen malware across all evaluation months using a single aggregate metric, the Area Under the Time curve (AUT), computed over the PR-AUC trajectory. SEED, based on semi-supervised continual learning with active learning, improves AUT by 32% on BODMAS and 9% on AndroZoo under partially labeled settings.
testing data are drawn from the same probability distribution. On contrary, security applications are deployed in a hostile environment in which testing data distributions are different from training data (this phenomenon is known as concept drift), causing gradual performance decay in detection rate of the ML classifier. Concept drift: This may occur in both benign (often known as goodware) and malware executables. For example, thousands of software companies release new types of benign executables that are significantly different from those seen in train data [3]. On the other hand, adversaries such as malware authors constantly write novel malware or extend the functionality of existing malware by code obfuscation techniques/tools [4, 5] with an intent to evade detection by malware detectors. Concept drift in malware can also arise due to changes in the behavior of an application’s maliciousness. For instance, earlier mobile ransomware aimed at stealing personal information has shifted to collecting users’ expense consumption details [6]. To mitigate the effects of concept drift, malware classifiers must continuously evolve, maintaining both the stability of learned malware knowledge and the plasticity to identify and adapt to novel malware. The plasticity property is known as open world learning (OWL) [7, 8]. The classifier that fails to maintain stability property is said to exhibiting the catastrophic forgetting [9, 10] of the learned knowledge. We assume that the basic unit of training is a task in this setting [11, 12, 13]. In malware detection, a task contains a mix of benign and malware samples collected over a period of time (say a month). Catastrophic forgetting occurs when learning a new task hurts the performance of previously learned tasks [10]. Mitigating the catastrophic forgetting: Forgetting can occur when the balance between stability and plasticity is disrupted. This situation can primarily occur when learning novel malware (or , Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
3
benign) features interferes with the existing knowledge. Although individual malware samples may become obsolete within a short period, catastrophic forgetting remains a practical concern in learning-based malware detection, as malware families, feature patterns often persist, evolve, and reappear over time [16, 17, 18, 19]. Malware families evolve incrementally through polymorphism and code reuse, where new variants retain structural and behavioral similarities with historical samples [16, 18]. Forgetting prior representations can therefore impair detection performance. Moreover, drift in the benign samples have been shown to degrade long-term robustness of malware detectors [17, 19], reinforcing the need for stability–plasticity balance. Therefore, to mitigate the effects of catastrophic forgetting, our work uses the continual learning (CL) paradigm for sequential learning. The reason for selecting CL framework is two fold: to maintain the learned knowledge for a longer period the CL algorithms require limited access to the past data and CL algorithms are flexible to integrate novel knowledge. Despite its merits, the direct application of CL for malware detection is under explored [20]. Furthermore, the existing works in CL heavily focus on supervised settings and assume a closed-world setting. Labeling issues for security: CL algorithms require access to labeled data from the evolving distribution to remain effective in the OWL setting. Unlike other domains (computer vision), annotations in cybersecurity domain are influenced by many other factors such as labeling dynamics (flips), label unification, labeling budget, lack of correctness verification in label generation methods, among others. Labeling budget is the amount of money spend on human analyst to manually obtain the labels. A typical human analyst can review about 80 samples per day [21]. Consequently, a low budget limits the number of labeled samples, which are crucial for adapting to concept drift in OWL. Further, the correctness of the auto labeling process in case of cybersecurity domain is questionable [22]. Even when assuming access to relatively clean analyst-verified labels, constructing and maintaining a fully labeled dataset over time is prohibitively expensive and operationally unrealistic in open-world malware detection. The instability of VT-based labeling further increases the cost of obtaining consistent supervision, reinforcing the impracticality of relying on large-scale fully labeled continual training. Therefore, instead of explicitly modeling label noise, this work focuses on adapting to concept drift under limited but reliable labeled supervision, reducing dependency on exhaustive labeling while preserving robustness in evolving threat landscapes. Thus, we focus on the tackling labeling budget issue in concept drift adaptation under limited labeled samples. Existing state of the art (SOTA) approaches [14, 18] for handling concept drift in malware detection utilize contrastive representation learning. These methods work by minimizing intraclass distances while maximizing inter-class distances. The effectiveness of such representations heavily relies on the availability of fully labeled train data to construct positive and negative sample pairs. Further, our research also finds that using partial labeled data on contrastive methods result in suboptimal performance (refer to Figure 1). Motivated by our findings and labeling issues we propose a novel semi-supervised continual learning and active learning, dubbed SEED, that effectively leverages partially labeled data without using contrastive loss and a delayed buffer update strategy to mitigate the effects of noisy labels. Two-stage learning strategy in SEED: Semi-supervised learning (SSL) [23] leverages the unlabeled data as an additional source of knowledge to improve the performance of malware detectors. The traditional SSL setting assumes that classifier can accurately generate labels for unlabeled data after training on a partially labeled dataset, due to the closed world assumption (labeled and unlabeled data are drawn from the same distribution). However, this assumption may not hold for malware detection as the unlabeled data contains drifted and novel samples that are different from partially labeled data. To solve this, in this paper, we design training strategies to handle two scenarios when the partial labeled data is available (seen tasks) and unavailable (unseen tasks). , Vol. 1, No. 1, Article . Publication date: May 2026.
4
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana Channappayya
Concretely, seen tasks contain partially labeled and unlabeled data, whereas unseen tasks contain only unlabeled data. Training with seen tasks: Given a task ‘𝑡’ with labeled exemplars 𝐷𝑙𝑡 and unlabeled set 𝐷𝑢𝑡 , our goal is to find a suitable labeled sample for each sample x ∈ 𝐷𝑢𝑡 . This is achieved by projecting samples into the latent space encoded by the classifier, using the partially labeled data. However, the effectiveness of this discrimination is limited by the absence of fully labeled data. Further, in the CL setting, the previously learned discriminative features can be hindered by interference from the learning of new tasks. So, to improve this we use orthogonal projections along with a novel buffer memory management method to minimize interference. Training with unseen tasks: Our second contribution is a novel training procedure for a task ′ involving solely unlabeled data. Given a unseen task ‘𝑡 ′ ’ with unlabeled data 𝐷𝑢𝑡 , our goal is to ′ ′ ′ ′ ′ 𝑡 𝑡 𝑡 transform the unlabeled data (𝐷𝑢 ) to a partially labeled data {𝐷𝑙 , 𝐷𝑢 ∗ }, where 𝐷𝑢𝑡 ∗ ⊂ 𝐷𝑢𝑡 . Later, ′ we train 𝐷𝑢𝑡 ∗ using training process of seen task. Delayed Buffer Update Strategy for Noisy Label Mitigation: To mitigate the adverse effects of noisy labels, we propose a simple delayed buffer update strategy that avoids immediately storing potentially unreliable samples in the replay buffer. Instead, samples are incorporated after a fixed delay, allowing labels to stabilize over time and thereby reducing noise propagation during replaybased learning. Through extensive experiments on both Windows and Android malware datasets , our method SEED, compared to HCL∗ , achieves an average (with different labeling budgets) improvement of 40% on the BODMAS dataset and a 14% improvement on the AndroZoo dataset in detecting unseen malware using the AUT metric. Furthermore, the proposed method demonstrates competitive performance on the APIGraph dataset. We also conduct comprehensive ablation studies and sensitivity analyses. Collectively, these experiments demonstrate that SEED is robust under limited supervision, outperforming contrastive learning when strong semantic structure is absent while remaining competitive when such structure is present. Accordingly, this paper makes the following contributions to the field of malware detection. • We shed light on the difficulty of maintaining higher detection performance of the contrastive learning-based malware detector under limited supervision (Figure 1). • We propose a novel method, dubbed SEED, is based on semi-supervised continual learning and active learning. SEED quantifies the uncertainty of an unknown sample by projecting it into a representation space constructed from the basis vectors using the available partially labeled data (Sections 5.1 and 5.2). • We introduce a simple delayed buffer update strategy (Section 5.3) to mitigate noisy label effects and evaluate its robustness under varying label noise levels (10%–80%). • With extensive evaluation (Section 6), we demonstrate that SEED achieves better performance on datasets where semantic structure is absent and remains competitive when such structure is present. To encourage reproducible research and promote open science, we publicly release our code. 2
Related Work
In this section, we describe the related work, covering the concept drift in malware detection, various approaches including contrastive learning and other incremental learning methods to address concept drift, and existing strategies for leveraging unlabeled data. In each of these, we clearly highlight how the proposed approach differs from the existing works. Concept drift in malware detection: Concept drift can arise in benign apps due to its natural evolution (e.g., introducing new functionality), whereas in malware this drift can be attributed to , Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
5
the novel malware variants introduced or modifying the existing malware using code obfuscation techniques. Traditionally, handling concept drift in security applications is a two-step process [18, 24, 25, 26, 16, 27]; drift detection and drift adaptation. One of the earliest works that attempts to find the drift in the samples is TRANSCENDENT [24, 26]. This method rejects the drifted samples using the non-conformity measure (NCM) based on algorithm confidence and credibility. Confidence is the likelihood of the given test object belonging to a particular class and credibility quantifies how relevant the training set is to the prediction. Contrastive learning for malware detection: Another set of recent works focuses on supervised contrastive loss to deal with concept drift for malware detection. Previously, the unsupervised version of this loss function has widely used for contemporary learning tasks (image classification, object detection) in the computer vision domain. It works by constructing positive and negative pairs for a given anchor sample using the label preserving data augmentation techniques. However, such augmentation techniques may not be effective under concept drift [19] for malware analysis. CADE uses contrastive auto encoder with a distance (median absolute deviation) based function to identify the drifted sample as an out of distribution (OOD) sample. The OOD samples labeled by a security analyst are incorporated into training for adapting the classifier to the drift. Inspired by CADE, recently [14] uses hierarchical contrastive loss along with cross entropy loss (pseudo-label confidence) to identify the uncertain test samples. These test samples are labeled by the analyst and incorporated in the training set. Another recent work [28] uses two techniques to detect sampling bias; one is based on domain discrimination (using logistic regression) and the other method is non-parametric (k-NN based bias detection combined with contrastive loss). Authors of [28] also proposed two methods to adapt to concept drift; the first approach is based on the contrastive loss function combined with generating pseudo labels for unseen test samples, whereas the other approach is uses cyclic consistency loss. Continuous/Incremental learning in malware detection: The authors of [20] investigated the suitability of CL for malware classification using various CL techniques spanning regularization, generative replay, and exemplar replay family of approaches over three malware datasets. Their findings suggest that partial replay of historical data will improve malware classification performance. Another set of works relies on the active learning scheme for identifying hard samples for labeling by an oracle (security analyst). For instance, [14] uses hierarchal contrastive loss value for identifying the most uncertain samples. BODMAS [15] compares the various active learning methods based sample selection schemes. There are other works that do not rely on a human oracle, but rather on a trained classifier providing labels for unseen test samples. INSOMNIA [29] is one of the earliest to auto generate labels for the unseen network traffic using a nearest centroid neighborhood classifier. Driodevolver [30] also generates pseudo labels for the new malware variant avoiding the manual labeling overhead. However, self labeling strategies are prone to contaminate the learning through self poisoning [31]. One way to mitigate this label contamination issue is to solve the malware detection problem in an unsupervised fashion. OWAD [25] formulates drift detection and adoption as an anomaly detection (AD) problem. This work has shown that adapting to distribution shift in benign applications is sufficient to handle various malware variants. Recently, [32] formulates the malware detection problem as AD to mitigate the effects of class imbalance and distribution shifts. However, methods formulated as AD may fail to distinguish whenever the novel malware variants bear similarity to the drifted benign samples. Orthogonal to these existing works, our proposed method focuses on semi-supervised continual learning and handles concept drift using partially labeled data. Leveraging unlabeled data in malware detection: Here, we discuss two popular ways of leveraging unlabeled data to improve performance of the malware detector. The first method is via , Vol. 1, No. 1, Article . Publication date: May 2026.
6
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana Channappayya
the self supervision with carefully designed pretext tasks. One such pretext task is to use consistency regularization loss that encourages the classifier to have the same distribution for the feature vector and its augmented version. These augmented operations involve masking the values of feature vectors and filling the masked values with using some empirical distribution [33]. The pretext task involves recovering original sample from corrupted sample by estimating mask vector and feature vector. Recently, [19] used this feature mask estimation for malware classification tasks and has shown that such a transformation is ineffective under concept drift. Further, such transformations may not preserve the original label [34, 28] as compared to domains such as computer vision. Another way of leveraging the unlabeled data is to use pseudo labeling in a teacher-student training paradigm. The working principle behind this strategy is knowledge distillation. The teacher model is expected to have more wisdom in generating the pseudo labels for the unlabeled data. The student model considers these labels as ground truth and reduces the entropy of its prediction using a supervised classification loss function (such as cross entropy). However, the generated pseudo labels may contain false positives, resulting in contaminating the learning of the student model. To mitigate this, often high confidence pseudo labels above a certain predefined threshold (𝜏) are considered for learning. In the CL setting, the classifier trained until the last task is used as a teacher model for the immediate next task. Meanwhile, the student model can be an entirely new classifier initialized with random weights or the teacher model continued to be trained on the new task [35, 36, 37]. In contrast to the existing methods, our approach finds the most suitable labeled example corresponding to each unlabeled example and encourages the classifier to learn similar representations in the latent space. 3
Preliminaries
This section provides the foundational definitions essential for a comprehensive understanding of the work, including the definition of a task in the context of malware detection, how tasks are created from datasets, and a description of the problem of malware detection within the framework of SSCL. Notion of a ‘task’: A task consists of a subset of training examples. The process of creating a task is sensitive to the application domain. For instance, in image classification on CIFAR-10 [38] dataset, a task contains one (or more) class(es) of images. For security applications, we find that two characteristics are meaningful while creating a task. • Class Imbalance (CI): It is the ratio of the number of benign to malware samples. In real-world scenarios, malware datasets exhibit higher CI with most of the samples being benign [14, 39, 40, 41, 15, 42]. • Granularity of data: It describes the temporal granularity of the task. Specifically, it describes the time span of the data used in task creation. For instance, whenever the granularity of the data is one month and a malware dataset is spreads over a one year, it will have a total of 12 tasks. Datasets: The training dataset is a sequence of 𝑇 temporally ordered tasks, where each task ‘𝑡’ ∈ {1, 2, . . . ,𝑇 }. Our work assumes a more general setting in which all seen tasks will appear prior to the encountering the first unseen task. Intuitively, this mean unseen tasks represent unlabeled data samples collected after training the classifier with seen tasks. Let us assume that initial {1, 2, . . . , 𝑡 } tasks are seen tasks. For simplicity, the data of each task is denoted by 𝐷 𝑡 . These tasks contain only partially labeled samples and unlabeled samples, represented as 𝐷 𝑡 = {𝐷𝑙𝑡 , 𝐷𝑢𝑡 }. Here, 𝐷𝑙𝑡 = {(x1, y1 ), (x2, y2 ), . . . , (x𝑛 , y𝑛 )} where x ∈ R𝑑 is a feature vector extracted from a benign/malware application and y ∈ {0, 1} is the label associated with , Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
7
the feature vector with 0 for benign and 1 for malware. 𝐷𝑢𝑡 = {x𝑛+1, . . . , x𝑛+𝑁 } such that 𝑛 ≪ 𝑁 . The remaining {𝑡 + 1, 𝑡 + 2, . . . ,𝑇 } are the unseen tasks, where each unseen task (𝑡 ′ ) contains only ′ ′ ′ unlabeled data. Specifically, 𝐷 𝑡 = {𝐷𝑢𝑡 } and 𝐷𝑢𝑡 = {x1, x2, . . . }. Problem description: Our goal is to continuously train a binary classifier 𝑓 (x; 𝜃 ) aiming to reduce the labeling budget while adapting to the concept drift. Towards this, we keep a human analyst in the loop to manually label a minimal number of training samples in the SSCL setting. On a technical note, our work follows the fundamental non-stationary assumption of CL [10], where the joint probability distribution 𝑃 (.) of each task is unique and distinct from others i.e., 𝑃 (𝑖) ≠ 𝑃 ( 𝑗) for 𝑖 ≠ 𝑗, where 𝑖, 𝑗 ∈ {1, 2, . . . ,𝑇 }. This will implicitly disqualify the need for additional methods detecting the presence of concept drift, unlike SOTA methods [18, 28]. This work operates in a domain incremental learning setting [43, 20], where each task has fixed label space (0 or 1) but varying data space (owing to concept drift in benign/malware apps). In other words, our work addresses domain-incremental concept drift, encompassing both changes in sample frequency (prior shift) and changes in feature distributions within existing classes (concept evolution), while maintaining a fixed label space (benign vs. malware). The framework is designed to adapt to evolving feature representations over time SSCL for malware detection: The training dataset is a collection of 𝑇 tasks. In our CL training setting, we denote a malware detector parameterized by 𝜃 as 𝑓 (x; 𝜃 ). The training is a two step process; training with seen tasks and unseen tasks. A seen task contains labeled data and the corpus of unlabeled data to improve the detection performance. Training with label data is a straight forward approach, where an objective function is used to train the detector and errors in predictions are corrected by adjusting the classifier parameters via back propagating the gradients computed over error vectors. The supervised objective function for the labeled data of the task ‘𝑡’ is as follows. 𝐿𝑠𝑢𝑝 (𝑡) = 𝐿(𝐷𝑙𝑡 ) =
1 |𝐷𝑙𝑡 |
∑︁
ℓ𝑐 (𝑓 (x𝑙𝑡 ), y𝑙𝑡 )
(1)
(x𝑙𝑡 ,y𝑙𝑡 )∼𝐷𝑙𝑡
where, ℓ𝑐 (.) is a per sample loss function such as cross entropy. For each unlabeled sample in seen task, we identify its most relevant labeled sample and enforce representational similarity between the them in the latent space. In the second step, for unseen tasks comprising entirely unlabeled data, labels for a small set of informative samples are obtained through human annotation and subsequently used to train the 𝑓 (x; 𝜃 ) following the procedure established for seen tasks. 4
Threat model and assumptions
In this section we describe our assumptions about the attacker’s knowledge, the environment, ML-based defense mechanism, the labeling procedure and drift in the apps. Attacker’s goals and knowledge: The attacker aims to steal sensitive information such as passwords and financial transactions details in android mobile phones, and encrypting the files of the victim to demand ransom payment for access restoration. The adversary does not know the datasets or algorithms used in the ML-based defense mechanism deployed. ML-based malware detector: The ML-based malware detector uses static features of applications to classify them as benign (goodware) or malware. However, such detectors can become obsolete due to drift in benign and malicious application characteristics over time. To mitigate performance degradation caused by this drift, the malware detector must be periodically updated, while access to historical training data is limited to only a partial subset of the original data. Labeling and labeling budget: We assume that the available partially labeled data from seen tasks. The proposed method considers the budget (money spent) for labeling efforts required by an human analyst. , Vol. 1, No. 1, Article . Publication date: May 2026.
8
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana Channappayya
Environment: This work focuses on general malware detection tasks under concept drift, so the proposed methods are applicable to Windows portable executable (PE) and android based malware. Drift in benign and malware apps: We assume that benign and malware apps evolve over time. This evolution in benign apps can be attributed to additional functionalities or new features added by the developers of the apps. The drift in malware apps can be due to the introduction of novel malware variants to evade detection. 5 Methodology In this section, we first describe the training process of the seen, unseen tasks, and the buffer memory organization policies. 5.1
Training with seen tasks
Training with seen tasks constitutes samples retrieved from the current task, including both labeled and unlabeled data, along with replay samples from the buffer memory. Analogous to semi-supervised learning, two types of losses are computed over each batch. The loss over labeled samples is computed using the cross-entropy objective. Our model consists of two sub-networks: an encoder and a classifier, where the encoder produces latent representations of the input samples. For unlabeled data, instead of relying on pseudo-labeling or augmentation strategies, our method identifies a suitable labeled exemplar for each sample. Specifically, the latent representation of an unlabeled sample is projected into a representation space constructed from labeled exemplars of previous tasks. Cosine distances are then computed between the projected sample and stored exemplars, and a soft thresholding mechanism is used to select the most appropriate match. The model is subsequently trained to align the representations of the unlabeled sample with its selected labeled exemplar. Figure 2 provides a graphical illustration of this process. In the following, we describe each component in detail. 5.1.1 Training samples from current-task and buffer memory (steps 1 and 2 ). The data of each seen task ‘𝑡’ is represented as 𝐷 𝑡 = {𝐷𝑙𝑡 , 𝐷𝑢𝑡 }. During training, each batch of samples is composed of three sources: buffer memory, labeled and unlabeled data from the current task: (𝐷𝑚 , 𝐷𝑙𝑡 , 𝐷𝑢𝑡 ). From these, we sample labeled instances 𝐵𝑙 from 𝐷𝑙𝑡 and unlabeled instances 𝐵𝑢 from 𝐷𝑢𝑡 for training, these constitute the primary inputs from the current task.The buffer memory contains the partial labeled data of the past seen tasks and 𝐵𝑚 samples from 𝐷𝑚 are retrieved from the buffer memory. The complete details of the buffer memory organization policies (storage, retrieval) are described in Section 5.4 5.1.2 Representation space construction and suitable exemplar selection (step 3 ). Representation space of all past tasks: We find the basis vectors of the labeled exemplars of all the past tasks. We begin by noting that while a key assumption of the CL paradigm is to avoid access to past task exemplars, our method follows the memory replay-based CL approach, which allows limited access to past task samples. These samples are a small, labeled subset of previous task data stored in a buffer memory (refer to Section 5.4 for more details). Initially, we obtain the latent representation (𝑍 𝑚 ) of the ‘n’ past task examples (𝑋 𝑚 ) from memory using the encoder sub-network. 𝑍 𝑚 = 𝑒𝑛𝑐 (𝑋 𝑚 ), (2) where 𝑒𝑛𝑐 (.) represents the encoder subnetwork, 𝑋 𝑚 ∈ 𝑅𝑛×𝑑1 , 𝑍 𝑚 ∈ 𝑅𝑛×𝑑2 . Motivation for using singular value decomposition: Although, the dimensionality of the encoded representation is smaller ( 𝑑 2 << 𝑑 1 ), we can further reduce its dimensionality by considering the basis vectors that span the encoded representation. By focusing on the basis vectors, we , Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
9
Unabeled training samples from current task Labeled training samples from current task Training samples from buffer memory Projection space
Task labeled data
Labeled samples from task t
4
Model
GPM
1
Unlabeled samples from task t
6
Task unlabeled data
2 Encoder network
Access Policy
SVD Pairwise similar samples
Encoder network
3
Accesse Policy
Common representation space
Memory replay samples
Orthogonal projections
5
Buffer memory
Latent representation of samples from memory
Fig. 2. Graphical illustration of the end-to-end training process of the proposed SSCL method for seen tasks.
effectively capture the most salient features of the encoded data, reducing storage costs associated with storing all the encoded representations (Eq 2) particularly for longer sequence of tasks. The basis vectors of the latent representation are derived using singular value decomposition (SVD). SVD decomposes 𝑍 𝑚 into the product of three matrices: 𝑍 𝑚 = 𝑈 Σ𝑉 𝑇 , where 𝑈 ∈ 𝑅𝑛×𝑛 , Σ ∈ 𝑅𝑛×𝑑2 , 𝑉 ∈ 𝑅𝑑2 ×𝑑2 , 𝑉 𝑇 is the transpose of 𝑉 , and Σ contains the singular values sorted along its diagonal. The column vectors of 𝑉 , which span the matrix 𝑍 𝑚 , serve as the basis vectors. For convenience, we denote these basis vectors as 𝑉 ′ . 𝑉 ′ = span{v1, v2, · · · , v𝑘 },
(3)
where 𝑘 is the number of basis vectors. The number of basis vectors (𝑘) is determined by analyzing the singular values obtained from the decomposition. The squared singular values are normalized to compute their cumulative ratio. The basis vectors are then selected based on a threshold (95%) applied onto the cumulative ratios of the singular values to ensure that the chosen vectors retain the most important information from the original data. We also empirically validate the effectiveness of using SVD approach through ablation study, showing that detection performance benefit from using the orthonormal basis constructed from SVD over the original feature space. Table 1. Ablation study demonstrating the sensitivity of the proposed method using SVD in constructing the representation space. The best values are marked in bold.
unseen-AUT (A) SVD
BODMAS
AndroZoo
API Graph
✗ ✓
0.752 ± 0.061 0.821 ± 0.045 0.919 ± 0.003 0.810 ± 0.027 0.855 ± 0.018 0.930 ± 0.002
The ablation study results are presented in Table 1, and we make the following observations. First, the inclusion of SVD consistently improves detection performance on unseen tasks across all datasets, as the orthonormal basis vectors capture more salient features than the original encoded , Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 10 Channappayya
features. Second, the use of SVD reduces variance in malware detection. Finally, we empirically observe that its impact is more pronounced on datasets with higher dimensionality. Specifically, compared to AndroZoo (2,381 dimensions) and APIGraph (1,150 dimensions), the absence of SVD has a greater negative impact on the BODMAS dataset, which has a dimensionality (16,978 dimensions) and does not inherently preserve structural semantic representations (unlike APIGraph). Finding the suitable labeled exemplar: After finding the the basis vectors, the latent vector of each unlabeled sample (z𝑢 ) is projected into representation space. This projection step can be 𝑝 interpreted as finding a point (z𝑢 ) within space 𝑉 ′ that is closest to z𝑢 . 𝑝
z𝑢 = arg min′ ∥z𝑢 − z∥ 2 z∈𝑉
(4)
𝑝
Now, the distances between z𝑢 and 𝑍 𝑚 are computed to find the suitable labeled example for x𝑢 . Specifically, we find cosine distance is particularly well-suited to our setting because the projected representations reside in a continuous, ℓ2 -normalized latent space where relational information is encoded through angular alignment rather than magnitude. By measuring angular dissimilarity, cosine distance remains scale-invariant and robust to variations in feature magnitude introduced by projection or drift. In high-dimensional embedding spaces, angular metrics are generally more stable and discriminative than magnitude-based distances. In contrast, set-based similarity measures (e.g., Jaccard) disregard geometric structure and are not designed to capture relationships in dense continuous representations, making them less appropriate for our framework. Adaptive thresholding strategy: To identify the most suitable labeled example we use an adaptive (soft) thresholding technique that has an initial threshold value (𝜏𝑖𝑛𝑖𝑡 ) and a maximum threshold value (𝜏𝑚𝑎𝑥 ). Starting with 𝜏𝑖𝑛𝑖𝑡 , we increase the threshold by a specified step size until it reaches a 𝑝 defined 𝜏𝑚𝑎𝑥 . For each z𝑢 , we find a list of samples in 𝑍 𝑚 that have cosine distance values below the current threshold. We group these list of samples using their labels and select a target group with most number of samples. From the target group, a sample with small cosine distance is selected. If such a sample (x̂𝑙 ) is found, the search operation is halted to improve efficiency. Otherwise, we reject the unlabeled sample x𝑢 . Similarly, we also find a suitable example for each labeled sample as well. This step intuitively clusters the samples with similar latent structure. However, choosing a fixed 𝜏𝑚𝑎𝑥 may result in the selection of samples that are very distant potentially leading to false positives. To address this issue, we adaptively choose the maximum threshold based on the labeled ratio (𝑟 ). Intuitively, a higher 𝑟 indicates the availability of more labeled data in memory, allowing the maximum threshold to shrink quickly; otherwise, it decreases more gradually. Mathematically, ′ the dynamic threshold (𝜏𝑚𝑎𝑥 ) is defined as follows: ′ 𝜏𝑚𝑎𝑥 = 𝜏𝑚𝑎𝑥 ∗ exp(−𝑟 ∗ 𝛽),
(5)
where ‘𝛽’ is the temperature factor. Let the latent representation (encoder output) of x̂𝑙 be zˆ𝑙 which is an input to the classifier subnetwork 𝑓𝑐 (.). 5.1.3 Pairwise similarity learning for unlabeled data (step 4 and 5 ). Now, our goal is to bring x̂𝑙 and x𝑢 (or x𝑙 ) closer together in the latent space. To achieve this (without relying on contrastive loss), we modify the binary cross entropy (BCE) loss. We define the similarity score (𝑠𝑠) as follows: 𝑠𝑠 = ⟨𝜎 (𝑓𝑐 ( zˆ𝑙 )), 𝜎 (𝑓𝑐 (z′ ))⟩,
(6) where 𝜎 (.) is the softmax function that translates the latent space vectors into probability distributions, ⟨., .⟩ is the dot product, and z′ is the latent vector of x𝑢 or x𝑙 . The BCE loss is used to predict whether two instances are similar (𝑦 = 1) or dissimilar (𝑦 = 0), which is given by the following equation. BCE Loss = − [𝑦 log(𝑝) + (1 − 𝑦) log(1 − 𝑝)] , (7) , Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
11
where 𝑝 is the predicted similarity score. For the task of positive pair learning (only considering 𝑦 = 1), the loss simplifies to the following: BCE Loss = − log(𝑝),
(8)
Intuitively, our goal of bringing samples with lower cosine distance becomes positive pair learning, so 𝑝 = 𝑠𝑠. Therefore, the modified BCE loss for a given task ‘𝑡’ is defined by 𝐿𝑏𝑐𝑒 (𝑡) =
1 |𝐷 𝑡 |
∑︁
− log⟨𝜎 (𝑓𝑐 ( zˆ𝑙 )), 𝜎 (𝑓𝑐 (z′ ))⟩.
ẑ𝑙 ∈𝑒𝑛𝑐 (𝑋 𝑚 ) z′ ∈𝑒𝑛𝑐 (x′ ),x′ ∼𝐷 𝑡
(9)
The overall objective of the seen tasks is a combination of cross-entropy loss over labeled exemplars and BCE over the all exemplars of the task ‘𝑡’, and it is given by: 𝐿(𝑡) = 𝐿𝑠𝑢𝑝 (𝑡) + 𝐿𝑏𝑐𝑒 (𝑡).
(10)
The gradients computed for Eq. 10 may be noisy due to the smaller intra-class variance in labeled data compared to unlabeled data[8]. This discrepancy leads to faster convergence for labeled data (especially the majority class i.e., benign) compared to unlabeled data and subsequent unseen tasks. Class imbalance further negatively affects the minority class (malware) learning due to skewed gradients [44, 45]. Additionally, interference from past tasks, along with the aforementioned issues, jointly hinders the learned representation of malware samples. 5.1.4 Improved representation through orthogonal projections (Step 6 ). Inspired by the prior works to improve the performance of the representations by minimizing the interference from past tasks [46, 47, 48], the gradients of the current task are projected in the direction orthogonal to the past tasks gradients. Specifically, our method uses gradient projection memory (GPM) [47] that contains the basis vectors that span the gradient directions of the past tasks. span{∇𝜃 𝐿1, ∇𝜃 𝐿2, .., ∇𝜃 𝐿𝑘 , ..∇𝜃 𝐿𝑡 −1 } = 𝑀𝑔𝑝𝑚
(11)
where ∇𝜃 𝐿𝑘 is the gradient of 𝑘 𝑡ℎ task. Here, we store the gradient directions of malware class samples in GPM. Thus, all the previously learned definitions of malware are preserved in GPM. The orthogonal gradient direction (to GPM) will also minimize the effects of the drifted malware sample on previously learned definitions. Eventually, the overall training objective function of the seen task is given by the following equation. 𝜃 ∗ = arg min 𝐿(𝑡) (12)
𝜃
subject to ∇𝜃 𝐿𝑡 ⊥ 𝑀𝑔𝑝𝑚 Note that, although GPM is an existing framework incorporated into our pipeline, our contribution lies in strategically utilizing it to enhance malware detection performance by leveraging limited labeled data. Additionally, we utilized the partial labeled data to its optimal capacity in three ways: to construct the representation space for GPM, for sample replay during training, and to identify the most suitable sample for each unlabeled sample in the unseen task training process. The way we use GPM is also a critical factor in improving malware detection performance. Experimentally, we demonstrated the importance of this exploration through an ablation study, as presented in the Table 15. The pseudo code for training the seen task is presented in Algorithm 1. , Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 12 Channappayya
Algorithm 1 Training with Seen Tasks 1: Input: the sequence of seen tasks {1, 2, · · · ,𝑇 − 1,𝑇 }, data of task ‘t’ 𝐷 𝑡 = {𝐷𝑙𝑡 , 𝐷𝑢𝑡 }, batch size 𝑏, model 𝑓𝜃 , buffer memory 𝑀 (initially empty), pair set 𝑃 (initially empty), gradient projection memory 𝑀𝑔𝑝𝑚 (initially empty) 2: Output: 𝑓𝜃 model trained on all 𝑇 seen tasks 3: for each task ’𝑡 ’ do 4: copy 𝐷𝑙𝑡 to 𝑀 5: while 𝐷 𝑡 is non-empty do 6: sample labeled data of size 𝑏𝑙 ∼ 𝐷𝑙𝑡 , call it 𝐵𝑙 7: sample labeled data from M of size 𝑏𝑚 ∼ 𝑀, call it 𝐵𝑚 8: sample unlabeled data of size 𝑏𝑢 ∼ 𝐷𝑢𝑡 , call it 𝐵𝑢 9: for each labeled sample x𝑙 in 𝐵𝑙 do 10: find another labeled sample x𝑙′ with same label as x𝑙 11: add x𝑙′ to 𝑃 12: end for 13: for each unlabeled sample x𝑢 in 𝐵𝑢 do 14: find a suitable labeled sample x𝑢′ using Eqs. 2, 3, and 4 15: add x𝑢′ to 𝑃 16: end for 17: compute 𝐿𝑠𝑢𝑝 on 𝐵𝑙 and 𝐵𝑚 using the Eq 1 18: compute 𝐿𝑏𝑐𝑒 on 𝐵𝑙 ,𝐵𝑚 ,𝐵𝑢 and 𝑃 using the Eq. 9 19: compute total loss 𝐿 using Eq. 10 20: compute gradient ∇𝜃 𝐿 of classification loss 21: if ‘t’ > 1 then 22: project ∇𝜃 𝐿 orthogonal to 𝑀𝑔𝑝𝑚 23: end if 24: end while 25: using 𝐷𝑙𝑡 , compute basis vectors of gradients and add them to 𝑀𝑔𝑝𝑚 26: end for 27: return 𝑓𝜃
5.2
Training with unseen tasks
The training mechanism here operates on the fully unlabeled exemplars in an open world learning ′ (OWL) setting. Given an unlabeled task 𝑡 ′ , our goal is to transform it from 𝐷𝑢𝑡 to partially labeled ′ ′ ′ ′ task {𝐷𝑙𝑡 , 𝐷𝑢𝑡 ∗ }, where 𝐷𝑢𝑡 ∗ ⊂ 𝐷𝑢𝑡 . To achieve this, unlabeled exemplars are ranked and a few of them are chosen for labeling (by the security analyst) under the allowable budget constraints. A SOTA approach [14] uses the hierarchical contrastive loss values to rank the samples, chooses the samples based on higher loss values for labeling. Later, it augments the existing fully labeled dataset with new exemplars to retrain the classifier and repeats this for every new task. However, this requires fully labeled data. In stark contrast, our method works with partial labeled data. In the following, we describe our method. Distance based metric in latent space: The BCE loss defined in Eq. 9 encourages samples with similar structures (i.e., lower cosine distances) to align closely in the latent space. Building on this intuition, our method utilizes the latent space to estimate the uncertainty of unlabeled exemplars. Specifically, for each unlabeled sample, we compute its distances to two groups of labeled samples (benign and malware) stored in the buffer memory. Initially, we partition 𝑀 into two groups based on their class labels: 𝑔𝑟𝑜𝑢𝑝0 (class 0) and 𝑔𝑟𝑜𝑢𝑝1 (class 1). Let 𝑛 0 and 𝑛 1 denote the number of samples in 𝑔𝑟𝑜𝑢𝑝0 and 𝑔𝑟𝑜𝑢𝑝1, respectively. For each unlabeled sample, we calculate its cosine distances to all exemplars in 𝑔𝑟𝑜𝑢𝑝0 and 𝑔𝑟𝑜𝑢𝑝1, resulting in 𝑛 0 distance values for 𝑔𝑟𝑜𝑢𝑝0 and 𝑛 1 values for 𝑔𝑟𝑜𝑢𝑝1. To simplify the comparison, we take the mean of these distance values for each group. These mean values are then used as unified measures to evaluate the similarity between the unlabeled exemplar and each group. , Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
13
Ranking the samples: Once the mean cosine distance is computed for each unlabeled sample from 𝑔𝑟𝑜𝑢𝑝0 and 𝑔𝑟𝑜𝑢𝑝1, the next step is to rank these samples for selection by the analyst for labeling. A common strategy is to select samples that are farthest from the groups for labeling. However, during validation on the seen tasks (where ground truth labels are available), we observe a peculiar behavior with this approach. Specifically, when using the farthest distance criterion, most samples selected for labeling belong to the benign class (label 0). As a result, the classifier becomes increasingly biased, leading to degraded performance on unseen tasks. A plausible explanation for this behavior is the combined effect of class imbalance and drift in the data. While drift is observed in both benign and malware classes, the class imbalance results in a higher number of benign samples compared to malware. Consequently, selecting the farthest samples disproportionately targets benign samples. In contrast, choosing samples with the closest distances helps mitigate this issue and rejuvenates the classifier’s performance on unseen tasks. Transition from unseen to seen task: After ranking the samples, we select the appropriate ones for labeling based on the ranking mechanism and the monthly labeling budget (i.e., the number of samples to be labeled). Specifically, half of the monthly labeling budget samples are selected based on their ranking relative to 𝑔𝑟𝑜𝑢𝑝0, and the remaining half are selected from 𝑔𝑟𝑜𝑢𝑝1. The intuition behind this selection strategy is rooted in the motivation of our work—to adapt to distribution shifts in both benign and malware exemplars. By ensuring a balanced selection, we account for potential shifts in both groups. Once the selected samples are labeled, the unseen task now has a few labeled examples. At this point, we can apply the training procedure for seen tasks, as described in Algorithm 1, to continue the training process. 5.3
Delayed buffer update for noisy label mitigation in unseen tasks
To mitigate the adverse impact of noisy labels, we introduce a simple yet effective delayed buffer update heuristic. Based on our empirical observations, storing noisy labeled samples in the replay buffer significantly degrades performance, as replay-based training repeatedly revisits buffer samples, thereby amplifying the effect of label noise across tasks. To address this, we avoid immediately storing newly observed samples in the buffer when their labels are likely to be unreliable. Instead, we delay their inclusion and incorporate them only after a certain time period, under the assumption that their labels become more accurate. Building on this intuition, we determine the delay duration based on insights from prior studies [49, 50, 51], which show that labels obtained from multi-engine platforms (e.g., VirusTotal) are inherently dynamic and may stabilize over weeks to several months. Motivated by these findings, we consider multiple delay intervals (1 month, 3 months, and 11 months) to capture different stages of label refinement. The shorter delay (1 month) accounts for early corrections in rapidly evolving threat landscapes, while longer delays (3 and 11 months) allow sufficient time for labels to converge toward more reliable ground truth. In our setting, samples from task ‘SEED+Δ months’ are thus incorporated into the replay buffer at a future time step, where Δ corresponds to the chosen delay interval. This design enables the buffer to preferentially retain higher-quality labels, thereby reducing noise propagation during replay. 5.4
Reorganizing buffer memory
Buffer memory (𝑀) is an additional memory used to save the subset of the past tasks labeled training samples. Besides data replay usage, prior works [11] also used memory to revise the gradient directions. Thus, the organization of memory is driven by its usage. The buffer memory organization policy defines how to store and retrieve samples in memory. The visual mechanism of this approach is illustrated in Figure 3. , Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 14 Channappayya
Buffer memory sample retrieval policy
After training with the second task After training with the third task
Buffer memory sample storage policy
Fig. 3. Illustration of buffer memory sample storage and retrieval policy. At the beginning, memory is partitioned into two chunks and initialized with train data (𝑏 1 − 𝑏𝑒𝑛𝑖𝑔𝑛 and 𝑚 1 − 𝑚𝑎𝑙𝑤𝑎𝑟𝑒 from the first task) whose size equals the number of labeled benign and malware samples. Prior to training with the second task, buffer memory (𝑀) is augmented with two additional chunks containing the labeled data of this task (𝑏 2 and 𝑚 2 ). This memory augmentation process is repeated for all the next tasks. During the sample selection, the sample retrieval policy views the entire memory as two partitions, irrespective of the number of smaller chunks.
Initially, the memory is populated with the labeled data from the first task. For this task, we store benign and malware samples in two separate chunks of different sizes. When a new task arrives, two additional chunks are allocated, bringing the total number of chunks to four. It is important to note that, upon the arrival of each new task, existing memory is allocated two new chunks. The sizes of these chunks are proportional to the number of labeled benign and malware training samples in that task. This ensures that all future tasks are always guaranteed to have their labeled exemplars stored in 𝑀. During the training process, a subset of samples is retrieved for replay along with the current task training exemplars. The replay samples will help revise the knowledge of the past tasks. In each retrieval operation, the number of benign and malware samples to be selected is to be regularized to handle the effect of class imbalance on the classifier. Besides organization policies, the detection performance may also depend on the size of the memory (the maximum number of samples allowed to be stored). The size is constrained by many factors, such as storage cost incurred per sample, memory constraints of the deployed environment, size of each sample, and data privacy issues. As, our work operates in a constrained setting (open world SSCL), we relax the assumption on the availability of finite size of 𝑀 until the training of the seen tasks. After that, from the unseen tasks 𝑀 grows slowly and constantly as the availability of the number of labeled samples is regularized by the labeling budget constraint. 6
Experiments and Analysis
In this section, we describe the experimental setup, including details of the dataset, preprocessing, task splitting for training, baseline selections, evaluation metrics, and protocol. We also discuss comparisons between the proposed method and baseline methods, the sensitivity of the proposed method to different labeling budgets and false positives, ablation studies, and, finally, the limitations. , Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
6.1
15
Experimental setup
Datasets: We use three Malware datasets in our experiments. Specifically, APIGraph [40, 14] and AndroZoo [14, 41] are Android malware based datasets containing evolved malware, and BODMAS [15] is a windows PE based malware dataset. APIGraph contains Android apps spread over seven years, from 2012 to 2018, and nearly 90% of them are benign Android apps. AndroZoo data spans over three years from 2019 to 2021, and the ratio of benign to malicious apps is 9:1 for each month of the data. The BODMAS dataset has a PE based malware samples collected from August 2019 to September 2020 and benign apps collected from January 2007 to September 2020 from the real world security company Blue Hexagon. Thus, it is one of most up-to-date datasets for validation, containing nearly 57% of benign apps with dynamically evolving malware. The details of the datasets are presented in Table 2. Table 2. Details of the various Android and Windows PE malware benchmark datasets used in our experiments. These details include the time span and the number of benign and malicious apps per dataset. Note that k is for thousand.
Dataset
Timespan
#Benign
#Malware
#Total
BODMAS AndroZoo APIGraph
1.1 year 3 years 7 years
77142 89853 289511
57,293 10200 30804
134.4 k 100 k 320.3 k
Feature extraction and preprocessing: For APIGraph and AndroZoo datasets, we used DREBIN features for training that contain eight sets of features related to permission access and different API calls of the Android apps. The preprocessed DREBIN features are available in [14] and are used for our experimentation. The number of features of the APIGraph and AndroZoo datasets are 1159 and 16978, respectively. The raw features of windows PE malware dataset (BODMAS) contain parsed features, format agnostic histograms, and count of strings. These raw features are translated into model features using the LIEF project; strings and exported names, etc are captured using feature hashing trick. Thus, each object is converted into a vector of 2381 dimensions. Tasks creation: For the APIGraph and AndroZoo datasets, tasks are created at the granularity of a month. This results in 84 tasks for APIGraph and 36 tasks for AndroZoo, each with a class imbalance ratio of 9:1. Similarly, for BODMAS, twelve tasks are created, each with a class imbalance ratio of 10:7. Tasks split for training: For BODMAS, we consider the first five tasks as seen tasks and next seven tasks as unseen tasks. For AndroZoo, the first twelve tasks are used as seen tasks, and next twenty-four tasks as unseen tasks. Similarly, for APIGraph, thirty-five tasks are used as seen tasks, with the remaining thirty-five tasks as unseen tasks. In fully supervised training, each task is split into 70% for training, 5% for validation, and 25% for testing. In the semi-supervised setting, the labeled ratio determines the amount of data used as labeled examples, while the remaining data is treated as unlabeled. However, the validation (5%) and testing (25%) percentages remain the same as in the fully supervised setting. Baselines selection: We consider classical supervised methods from different families of CL as baselines. These methods include elastic weight consolidation (EWC [52]) from regularization based CL methods, average-gradient episodic memory (A-GEM [11]) from projection based methods, maximal interfered retrieval (MIR [53]) and class-balanced reservoir sampling (CBRS [13]) from memory replay based methods. These methods are trained under full supervision. , Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 16 Channappayya
We also consider two recent approaches CADE [18] and HCL [14] that use contrastive learning loss functions to handle concept drift in malware classification tasks. These methods are initially not designed for continual learning setting. We took the implementations available in the code repository of [14] and tailored them for our CL setting. These methods require fully labeled exemplars to operate in seen tasks. Evaluation metrics: In our experiments, we use the precision-recall area under the curve (PR-AUC) as the base evaluation metric and area under the time (AUT) [17] as derived metric. Unlike the F1-score, which is sensitive to threshold selection, PR-AUC does not rely on any threshold. Further, PR-AUC reflects both false positive and false negative rates through precision and recall, making it suitable for imbalanced tasks [54]. To evaluate the effectiveness of the proposed method against continuous concept drift adaptation in both closed world and open world setting, we measure malware detector’s performance decay over time. Towards this, we compute AUT using base metric PR-AUC, as shown in Eq. 13. 𝑁 −1
𝐴𝑈𝑇 (𝑓 , 𝑁 ) =
1 ∑︁ [𝑓 (𝑥𝑘+1 ) + 𝑓 (𝑥𝑘 )] 𝑁 −1 2
(13)
𝑘=1
where 𝑓 (𝑥𝑘 ) is the point estimate computed using the performance metric 𝑓 at the time period 𝑘, 𝑁 is the number of time slots used to test performance degradation, and 1/(𝑁 − 1) is the normalization constant. Computing AUT over PR-AUC value: We used a strategy similar to that in [55, 43] to compute the PR-AUC for the benign and malware class. For the malware class (positive class), we use the predicted probabilities (𝑙𝑟 _𝑝𝑟𝑜𝑏𝑠) and set the 𝑝𝑜𝑠_𝑙𝑎𝑏𝑒𝑙 (of the 𝑝𝑟𝑒𝑐𝑖𝑠𝑖𝑜𝑛_𝑟𝑒𝑐𝑎𝑙𝑙_𝑐𝑢𝑟𝑣𝑒 function from 𝑠𝑘𝑙𝑒𝑎𝑟𝑛.𝑚𝑒𝑡𝑟𝑖𝑐𝑠) to 1 in order to compute the precision and recall values. We then calculate the AUC from these precision and recall values using the 𝑎𝑢𝑐 function. Similarly, for the benign class (negative class), we compute the Precision-Recall curve using 1 − 𝑙𝑟 _𝑝𝑟𝑜𝑏𝑠 and set 𝑝𝑜𝑠_𝑙𝑎𝑏𝑒𝑙 = 0 to evaluate the AUC for the negative class. Once the PR-AUC values for each class in each task are computed, we calculate the AUT values on the PR-AUC values for the benign and malware classes across seen, unseen, and overall tasks. Evaluation protocol: The goal of our work is to evaluate performance on unseen malware with a limited monthly labeling budget, aligning with the evaluation strategy commonly used in related work [14]. However, our approach is based on a CL framework, whose primary evaluation focuses on measuring the effectiveness of preserving the previously learned distributions of the benign and malware samples. To bridge these differences and maximize the insights gained from both evaluation approaches, we measure three key quantities: • Closed world evaluation: We evaluate the detection performance of the proposed approach on known benign and malware samples encountered in seen tasks, which have partially labeled data. Notationally, we use seen-AUT (B) for benign samples and seen-AUT (A) for malware samples. • Open-world evaluation: We evaluate the detection performance of the proposed approach on unknown benign and malware samples encountered in unseen tasks, for which no labels are available (unlabeled). Notationally, we use unseen-AUT (B) for benign samples and unseenAUT (A) for malware samples. • Overall evaluation: This combines the joint evaluation of both seen and unseen tasks. For overall tasks, overall-AUT (B) is used for benign samples and overall-AUT (A) for malware samples.
, Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
17
Table 3. Comparing the performance results of the proposed method with baselines on BODMAS, AndroZoo, and APIGraph datasets. We report AUT values for benign and malware classes on seen and unseen tasks and also overall tasks. The proposed method (SEED) and HCL∗ use 20% labeled data (selected randomly)on seen tasks across all the experiments on all the datasets. Each experiment is repeated for three times and the mean values along standard deviations are reported and best values are marked in bold. If the best values are not found among CADE, HCL∗ , and our method, then the best values among these are marked in blue. BODMAS Baseline Methods
seen-AUT (B)
seen-AUT (A)
unseen-AUT (B)
unseen-AUT (A)
overall-AUT (B)
overall-AUT (A)
EWC [52] AGEM [11] CBRS [13] MIR [53]
0.911 ± 0.010 0.910 ± 0.008 0.898 ± 0.002 0.898 ± 0.005
0.528 ± 0.014 0.527 ± 0.009 0.621 ± 0.037 0.599 ± 0.056
0.935 ± 0.013 0.933 ± 0.011 0.908 ± 0.009 0.904 ± 0.004
0.674 ± 0.021 0.670 ± 0.011 0.680 ± 0.034 0.668 ± 0.022
0.925 ± 0.011 0.924 ± 0.009 0.900 ± 0.005 0.899 ± 0.004
0.616 ± 0.018 0.612 ± 0.009 0.648 ± 0.003 0.635 ± 0.022
CADE [18] HCL [14] HCL∗ [14]
0.845 ± 0.000 0.924 ± 0.007 0.891 ± 0.018 (↓)
0.654 ± 0.000 0.845 ± 0.000 0.699 ± 0.044 0.949 ± 0.006 0.580 ± 0.050(↓) 0.888 ± 0.032 (↓)
0.654 ± 0.000 0.795 ± 0.010 0.613 ± 0.045(↓)
0.845 ± 0.000 0.936 ± 0.003 0.885 ± 0.028 (↓)
0.654 ± 0.000 0.746 ± 0.017 0.589 ± 0.037 (↓)
SEED
0.930 ± 0.002
0.701 ± 0.017
0.810 ± 0.027
0.942 ± 0.000
0.755 ± 0.018
0.956 ± 0.002
AndroZoo Baseline Methods
seen-AUT (B)
seen-AUT (A)
unseen-AUT (B)
unseen-AUT (A)
overall-AUT (B)
overall-AUT (A)
EWC AGEM CBRS MIR
0.997 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.996 ± 0.000
0.868 ± 0.018 0.901 ± 0.005 0.925 ± 0.007 0.849 ± 0.026
0.998 ± 0.000 0.998 ± 0.000 0.995 ± 0.001 0.996 ± 0.000
0.930 ± 0.003 0.938 ± 0.003 0.781 ± 0.032 0.905 ± 0.005
0.998 ± 0.000 0.998 ± 0.000 0.996 ± 0.000 0.996 ± 0.000
0.910 ± 0.008 0.926 ± 0.002 0.831 ± 0.019 0.887 ± 0.008
CADE HCL HCL∗
0.956 ± 0.038 0.997 ± 0.000 0.996 ± 0.000(↓)
0.664 ± 0.088 0.971 ± 0.013 0.877 ± 0.058 0.995 ± 0.000 0.812 ± 0.052 (↓) 0.994 ± 0.000(↓)
0.667 ± 0.085 0.879 ± 0.010 0.780 ± 0.004 (↓)
0.966 ± 0.016 0.996 ± 0.000 0.995 ± 0.000(↓)
0.667 ± 0.086 0.880 ± 0.017 0.791 ± 0.021 (↓)
SEED
0.994 ± 0.002
0.878 ± 0.002
0.855 ± 0.018
0.993 ± 0.001
0.863 ± 0.011
0.993 ± 0.000
APIGraph Baseline Methods
seen-AUT (B)
EWC AGEM CBRS MIR
0.999 ± 0.000 0.922 ± 0.002 0.999 ± 0.000 0.939 ± 0.003 0.999 ± 0.000 0.923 ± 0.010 0.999 ± 0.000 0.916 ± 0.006
CADE HCL HCL∗ SEED
6.2
seen-AUT (A)
unseen-AUT (B)
unseen-AUT (A)
overall-AUT (B)
overall-AUT (A)
0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.960 ± 0.001 0.965 ± 0.000 0.931 ± 0.006 0.959 ± 0.001
0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.944 ± 0.000 0.954 ± 0.001 0.928 ± 0.006 0.941 ± 0.001
0.962 ± 0.043 0.999 ± 0.000 0.998 ± 0.000
0.874 ± 0.022 0.971 ± 0.021 0.955 ± 0.003 0.998 ± 0.000 0.925 ± 0.002(↓) 0.998 ± 0.000
0.894 ± 0.005 0.958 ± 0.004 0.948 ± 0.003(↓)
0.968 ± 0.029 0.999 ± 0.000 0.998 ± 0.000
0.886 ± 0.008 0.957 ± 0.004 0.938 ± 0.002(↓)
0.999 ± 0.000
0.953 ± 0.009
0.930 ± 0.002
0.999 ± 0.000
0.940 ± 0.004
0.998 ± 0.000
Comparing with the baseline methods
The performance of the proposed method is compared with that of classical CL baselines and two recent methods CADE [18], HCL [14] for malware detection and the results are presented in Table 3. First, we discuss the difference between the training strategies of the different methods and later present the performance comparison between different methods. Training CL baselines. Classical CL baseline methods operate under a fully supervised training mechanism across all tasks, both seen and unseen. In other words, full labeled data is used for training CL baselines when trained on seen and unseen tasks. The rationale behind this is rooted in the primary evaluation focus of the CL setting: maintaining the good performance on the (mitigate the catastrophic forgetting on) learned tasks. Training contrastive learning based baselines. Contrastive learning baselines, such as CADE and HCL, utilize a fully supervised approach for seen tasks. For unseen tasks, within the constraints , Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 18 Channappayya
of a labeling budget, analysts label selected samples along with their family label information, which is then used for training in a CL framework. Training the proposed approach. In stark contrast to these approaches, our method employs a semi-supervised strategy for seen tasks, where only partial label information is available. This approach necessitates generating labels for the unlabeled data within the seen tasks. For unseen tasks (fully unlabeled data), analysts generate labels for selected samples. These labeled samples from unseen tasks are then utilized to train the model following the same procedure applied to seen tasks. Results. The performance results of the baseline methods CADE, HCL and our proposed method are presented in Table 3. Here, a fixed labeling budget of 100 samples per month is set. The results on CL baselines (EWC, AGEM, CBRS, and AGEM) serve as the most competitive values, as they operate under full supervision. However, they may not reliably be considered as upper-bound AUT values. For instance, on the AndroZoo and APIGraph datasets, the AGEM method achieves the best AUT values. In contrast, the AGEM’s AUT values on the BODMAS dataset are lower compared to the proposed approach and the CADE. Our method on all the datasets uses a fixed labeled data ratio of 20% (selected randomly) on seen tasks in all the experiments. The proposed method consistently outperforms CADE on all benchmark datasets (on evaluation metrics), HCL on BODMAS dataset and on par with HCL on AndroZoo dataset. On APIGraph, the difference between the proposed method and HCL (unseenAUT (A)) is 0.028, thus it becomes the competitive baseline on unseen task. However, our method is competitive to HCL on seen tasks AUT and unseen-AUT (B) on APIGraph dataset. To understand the effectiveness of HCL in semi-supervised setting, we trained it with 20% labeled data (similar to our method) on seen tasks, called it HCL∗ . The performance of HCL∗ is lower compared to HCL on BODMAS and AndroZoo (marked this situation with ↓ in Table 3). We notice, our method outperforms HCL∗ on BODMAS and AndroZoo. The HCL∗ is competitive with our method on the APIGraph dataset. Specifically, this is due to the curation process of the APIGraph dataset and contrastive loss function of the HCL. We briefly describe this in the following. The data curation process of APIGraph dataset inherently focuses on improving the performance of existing malware classifiers for tackling concept drift by bringing the common semantic structure among malware families using the API calls. Thus this dataset inherently maintains the semantic structure between the evolved malware samples. Further, contrastive learning loss used in HCL captures the semantic structure for constructing the positive and negative pair examples. Thus, HCL is competitive on the APIGraph dataset. On contrary, on other datasets which may not have such semantic structure, HCL∗ performance is degraded. In other words, HCL∗ performance on
7
8
Task ID
9
10
11
1.2 1.0 0.8 0.6 0.4 0.2 0.0
PR-AUC
1.2 1.0 0.8 0.6 0.4 0.2 0.0
PR-AUC
PR-AUC
1.2 1.0 0.8 0.6 0.4 Ours HCL* 0.2 CADE 0.0 5 6
Ours HCL* CADE
15
(a) BODMAS
20
25
Task ID
(b) AndroZoo
30
35
Ours HCL* CADE
40
50
60
Task ID
70
80
(c) APIGraph
Fig. 4. Comparing the proposed method (Ours/SEED with labeling budget of 100 samples per month) with the CADE and HCL∗ using the PR-AUC metric on the detection capability of unseen tasks malware. Each experiment is repeated for three different seed values and mean PR-AUC values are used for demonstration. Our method consistently outperforms CADE and HCL∗ on BODMAS and AndroZoo on PR-AUC metric, stays competitive on APIGraph dataset. , Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
19
unseen-AUT (A) is dropped from 0.795 to 0.613 on BODMAS dataset (lower than that of CADE) and on AndroZoo dataset it is dropped from 0.879 to 0.780. Thus, HCL∗ fails to stay competitive on other datasets, which do not necessarily have any semantic structure. It is also interesting to note that, on APIGraph difference in the performance between HCL∗ and our method on unseen-AUT (A) metric is 0.02 which is lower than the average performance difference loss between HCL and HCL∗ (0.1405) compared to our method on other datasets. We further analyzed this situation in greater depth over a time horizon using the PR-AUC metric. This experiment also serves to validate the reliability of the single-value metric AUT used across our experiments, as the same AUT score can sometimes arise from different detection behaviors (e.g., consistent moderate performance vs. a decline from very good to poor). To this end, we compare the efficacy of the proposed approach with CADE and HCL∗ in detecting unseen-task malware across all datasets, as presented in Figure 8. Our approach consistently outperforms CADE and HCL∗ on the BODMAS and AndroZoo datasets, and remains competitive on APIGraph. On the other hand, our hypothesis—that the presence of API semantic structure in APIGraph benefits HCL—is robustly validated using the PR-AUC metric. In other words, while CADE, another contrastive learning-based method, performs poorly compared to our approach on other datasets, it becomes competitive on APIGraph (refer to Figure 9i). Furthermore, HCL’s use of multi-level (hierarchical) contrastive loss likely contributes to its strong performance, even with partially labeled data (HCL∗ ), on APIGraph. Thus, unlike existing methods, our approach is more versatile in handling situations, even in the absence of semantic structure. Further, curating a dataset like APIGraph requires a lot of effort to parse the available API documentations to find such common semantic structure. In many real-world settings, creating such structured dataset using millions of samples from an anti-virus company at a scale is challenging in terms of cost and effort.
7
8
Task ID
9
(a) BODMAS
10
11
1.2 1.0 0.8 0.6 0.4 0.2 0.0
PR-AUC
1.2 1.0 0.8 0.6 0.4 0.2 0.0
PR-AUC
PR-AUC
1.2 1.0 0.8 0.6 0.4 Ours HCL* 0.2 CADE 0.0 5 6
Ours HCL* CADE
15
20
25
Task ID
(b) AndroZoo
30
35
Ours HCL* CADE
40
50
60
Task ID
70
80
(c) APIGraph
Fig. 5. Comparing the proposed method (Ours/SEED with labeling budget 100) with the CADE and HCL∗ using the PR-AUC metric on the detection capability of unseen tasks benign samples. Each experiment is repeated for three different seed values and mean PR-AUC values are used for demonstration. Our method stays competitive/outperforms CADE and HCL∗ on BODMAS, AndroZoo and APIGraph on PR-AUC metric, except on couple of tasks in AndroZoo dataset.
Our method consistently outperforms (refer to Figure 5) CADE and HCL∗ in detecting benign samples from unseen tasks (open-world setting) on the BODMAS and APIGraph datasets. On the AndroZoo dataset, it remains competitive with the baselines, except on six tasks. However, in the context of a longer task sequence (thirty-six tasks), such low performance on only two tasks has minimal impact on the overall detection capability. Our method consistently outperforms (refer to Figure 6) CADE and HCL∗ in detecting malware samples from seen tasks (closed-world setting) across all datasets. On the BODMAS and AndroZoo datasets, it outperforms the baselines by a significant margin. On the APIGraph dataset, the margin is smaller—this, as discussed earlier, can be attributed to the contrastive loss in CADE and HCL∗ effectively leveraging the API semantic structure present in the dataset. , Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 20 Channappayya
1.0
1.5
2.0
Task ID
2.5
3.0
3.5
4.0
(a) BODMAS
1.2 1.0 0.8 0.6 0.4 Ours HCL* 0.2 CADE 0.0 0 5
PR-AUC
1.2 1.0 0.8 0.6 0.4 Ours HCL* 0.2 CADE 0.0 0 2
PR-AUC
PR-AUC
1.2 1.0 0.8 0.6 0.4 Ours HCL* 0.2 CADE 0.0 0.0 0.5
4
6
Task ID
8
10
(b) AndroZoo
10
15
20
Task ID
25
30
35
(c) APIGraph
Fig. 6. Comparing the proposed method (Ours with labeling budget 100) with the CADE and HCL∗ using the PR-AUC metric on the detection capability of seen tasks malware. Each experiment is repeated for three different seed values and mean PR-AUC values are used for demonstration. Our method consistently outperforms CADE and HCL∗ on BODMAS and AndroZoo on PR-AUC metric, stays competitive on APIGraph dataset.
1.0
1.5
2.0
Task ID
2.5
3.0
3.5
4.0
(a) BODMAS
1.2 1.0 0.8 0.6 0.4 Ours HCL* 0.2 CADE 0.0 0 5
PR-AUC
1.2 1.0 0.8 0.6 0.4 Ours HCL* 0.2 CADE 0.0 0 2
PR-AUC
PR-AUC
1.2 1.0 0.8 0.6 0.4 Ours HCL* 0.2 CADE 0.0 0.0 0.5
4
6
Task ID
(b) AndroZoo
8
10
10
15
20
Task ID
25
30
35
(c) APIGraph
Fig. 7. Comparing the proposed method (Ours/SEED with labeling budget 100) with the CADE and HCL∗ using the PR-AUC metric on the detection capability of seen tasks benign samples. Each experiment is repeated for three different seed values and mean PR-AUC values are used for demonstration. Our method consistently outperforms CADE and HCL∗ on BODMAS and APIGraph on PR-AUC metric, stays competitive on AndroZoo dataset.
Our method consistently outperforms (refer to Figure 7) CADE and HCL∗ in detecting benign samples from seen tasks (closed-world setting) on the BODMAS and AndroZoo dataset. On the APIGraph dataset, it outperforms CADE and performs on par with HCL∗ , achieving the maximum possible PR-AUC value (PR-AUC = 1). Ultimately, we observed that our findings remain consistent across all experiments with varying labeling budgets on all datasets, when comparing the proposed method with CADE and HCL∗ . 6.3
Statistical analysis of detection performance
Across the datasets, we observe that the proposed SEED demonstrates strong performance on unseen attack detection under limited labeled data, with statistical testing further supporting these observations. For significance analysis, we perform paired t-tests on seed-wise unseen-AUT values, where each seed forms a paired observation across methods. On BODMAS, which lacks strong inherent semantic structure, SEED significantly outperforms CADE (p = 0.015) and shows improvements over HCL∗ with marginal significance (p = 0.054), highlighting its effectiveness when semantic signals are weak. On AndroZoo, SEED achieves statistically significant gains over HCL* (p = 0.044) and also outperforms CADE across all seeds; however, the difference is not statistically significant (p = 0.127), likely due to the limited number of seeds and variability in the magnitude of improvement. On APIGraph, which exhibits richer semantic structure, SEED remains competitive, significantly outperforming CADE (p = 0.008) while performing comparably to HCL∗ (p = 0.011). Overall, these results indicate that SEED performs robustly across varying degrees of semantic , Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
21
structure, achieving strong results in its absence under limited supervision while maintaining competitive performance when such structure is present. 6.4
Sensitivity to varying the labeling budgets
In this section, we study the effectiveness of the proposed method under various labeling budgets. Specifically, we compare our method with CADE, HCL, and HCL∗ on the labeling budgets of 50, 150, 200, and 250. The results are presented in Table 4, 5 and 6, while the results on the budget of 100 are present in Table 3. We made the following observations from these results. Table 4. Performance comparison of the proposed method with baselines on BODMAS dataset by varying the monthly labeling budget (MB). We report AUT values for benign and malware classes on seen and unseen tasks, and also on the overall tasks. HCL∗ represents the case where experiments are conducted with 20% labeled data on seen tasks. The proposed method (SEED) uses 20% labeled data on seen tasks across all the experiments on all the datasets. Each experiment is repeated for three times and mean value along with standard deviation are reported. Best values are marked in bold and second best values are marked in blue. BODMAS MB 50
150
200
250
Method seen-AUT (B)
seen-AUT (A)
unseen-AUT (B)
unseen-AUT (A)
overall-AUT (B)
overall-AUT (A)
CADE HCL HCL∗ SEED
0.845 ± 0.000 0.920 ± 0.006 0.864 ± 0.006 (↓) 0.928 ± 0.011
0.654 ± 0.000 0.845 ± 0.000 0.636 ± 0.055 0.955 ± 0.001 0.530 ± 0.043 (↓) 0.847 ±0.006(↓) 0.736 ± 0.013 0.940 ± 0.018
0.654 ± 0.000 0.784± 0.034 0.532 ± 0.021 (↓) 0.793 ± 0.038
0.845 ± 0.000 0.940 ± 0.001 0.849 ± 0.006(↓) 0.933 ± 0.014
0.654 ± 0.000 0.719 ± 0.04 0.518 ± 0.029 (↓) 0.764 ± 0.023
CADE HCL HCL∗ SEED
0.845 ± 0.000 0.922 ± 0.005 0.861 ±0.005 (↓) 0.917 ± 0.002
0.654 ± 0.000 0.845 ± 0.000 0.684 ± 0.011 0.953 ± 0.014 0.513 ± 0.037 (↓) 0.842 ± 0.010(↓) 0.719 ± 0.006 0.934 ± 0.012
0.654 ± 0.000 0.804 ± 0.030 0.521 ± 0.030 (↓) 0.782 ± 0.038
0.845 ± 0.000 0.938 ± 0.011 0.844 ± 0.008(↓) 0.925 ± 0.006
0.654 ± 0.000 0.745 ± 0.018 0.505 ± 0.031 (↓) 0.747 ± 0.020
CADE HCL HCL∗ SEED
0.844 ± 0.003 0.523 ± 0.014 0.923 ± 0.008 0.693 ± 0.029 0.865 ± 0.013 (↓) 0.526 ± 0.061(↓) 0.926 ± 0.010 0.664 ± 0.074
0.828 ± 0.041 0.951 ± 0.016 0.855 ± 0.016(↓) 0.953 ± 0.006
0.521 ± 0.037 0.802 ± 0.033 0.552 ± 0.044 (↓) 0.777 ± 0.057
0.833 ± 0.027 0.938 ± 0.013 0.854 ± 0.015(↓) 0.940 ± 0.007
0.520 ± 0.034 0.748 ± 0.027 0.530 ± 0.051 (↓) 0.727 ± 0.060
CADE HCL HCL∗ SEED
0.845 ± 0.000 0.924 ± 0.010 0.881 ± 0.027 (↓) 0.931 ± 0.003
0.654 ± 0.000 0.845 ± 0.000 0.635 ± 0.088 0.955 ± 0.003 0.529 ± 0.025 (↓) 0.872± 0.046(↓) 0.709 ± 0.017 0.957 ± 0.001
0.654 ± 0.000 0.772 ± 0.027 0.571 ± 0.071(↓) 0.810 ± 0.009
0.845 ± 0.000 0.654 ± 0.000 0.941 ± 0.003 0.711 ± 0.047 0.872 ± 0.040 (↓) 0.544 ± 0.051 (↓) 0.944 ± 0.001 0.761 ± 0.011
First, the proposed method consistently outperforms CADE on all the benchmarks on all the labeling budgets. Our hypothesis on reductions in performance (on all evaluation metrics) of HCL with partial labeled data (HCL∗ ) remains valid on the BODMAS and AndroZoo benchmarks with varying labeling budgets. On APIGraph dataset, with partial labeled data, the performance of seen tasks malware (seen-AUT (A)) is consistently reduced across all the labeling budgets. HCL∗ consistency on all the labeling budgets on APIGraph confirms our finding that semantic structure of the dataset combined with bias of contrastive loss that inherently leverages this structure can be a powerful mechanism to work even under the partial labeled data. On BODMAS dataset (refer to Table 4), CADE outperforms HCL∗ in terms of unseen tasks AUT (A) metric with labeling budgets of 50, 150, and 250. With reduced labeled data, HCL∗ experiences performance degradation when compared to HCL on unseen AUT (A), with an average reduction of 0.246. This is the highest reduction observed across all other evaluation metrics. Our method continues to achieve higher malware detection on seen tasks (seen-AUT (A)) compared to HCL on all labeling budgets and unseen tasks (unseen-AUT (A)) on HCL on labeling budgets of 50, 100, and 250. The average performance gains achieved using our method compared to HCL∗ on unseen AUT (A) metric is 0.236 on partial labeled data. , Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 22 Channappayya
Table 5. Performance comparison of the proposed method with baselines on AndroZoo dataset by varying the monthly labeling budget (MB). We report AUT values for benign and malware classes on seen and unseen tasks, and also on the overall tasks. HCL∗ represents the case where experiments are conducted with 20% labeled data on seen tasks. The proposed method (SEED) uses 20% labeled data on seen tasks across all the experiments on all the datasets. Each experiment is repeated for three times and mean value along with standard deviation are reported. Best values are marked in bold and second best values are marked in blue. Andro Zoo MB 50
150
200
250
Method
seen-AUT (B)
seen-AUT (A)
unseen-AUT (B)
unseen-AUT (A)
overall-AUT (B)
overall-AUT (A)
CADE HCL HCL∗ SEED
0.981 ± 0.003 0.676 ± 0.054 0.997 ± 0.000 0.881 ± 0.024 0.996 ± 0.000(↓) 0.850 ± 0.054(↓) 0.995 ± 0.001 0.875 ± 0.016
0.974 ± 0.01 0.994 ± 0.001 0.978 ± 0.009(↓) 0.994 ± 0.000
0.593 ± 0.059 0.807 ± 0.017 0.536 ± 0.086 (↓) 0.839 ± 0.010
0.976 ± 0.007 0.995 ± 0.000 0.985 ± 0.006(↓) 0.994 ± 0.000
0.619 ± 0.043 0.833 ± 0.019 0.644± 0.039 (↓) 0.851 ± 0.004
CADE HCL HCL∗ SEED
0.976 ± 0.008 0.542 ± 0.263 0.998 ± 0.000 0.907 ± 0.024 0.997 ± 0.000(↓) 0.813 ± 0.025(↓) 0.992 ± 0.001 0.860 ± 0.010
0.951 ± 0.033 0.614 ± 0.134 0.959 ± 0.018 0.590 ± 0.179 0.996 ± 0.000 0.872 ± 0.025 0.997 ± 0.000 0.885 ± 0.023 0.994 ± 0.001(↓) 0.821 ± 0.023 (↓) 0.995 ± 0.001(↓) 0.819 ± 0.024 (↓) 0.994 ± 0.000 0.855 ± 0.034 0.993 ± 0.000 0.857 ± 0.026
CADE HCL HCL∗ SEED
0.987 ± 0.000 0.671 ± 0.035 0.998 ± 0.000 0.915 ± 0.012 0.996 ± 0.000(↓) 0.812 ± 0.052(↓) 0.992 ± 0.001 0.869 ± 0.014
0.987 ± 0.002 0.664 ± 0.108 0.997 ± 0.000 0.882 ± 0.031 0.994 ± 0.000(↓) 0.780 ± 0.004 (↓) 0.994 ± 0.000 0.879 ± 0.002
0.987 ± 0.001 0.668 ± 0.064 0.997 ± 0.000 0.894 ± 0.018 0.995 ± 0.000(↓) 0.791 ± 0.021 (↓) 0.993 ± 0.000 0.876 ± 0.002
CADE HCL HCL∗ SEED
0.957 ± 0.037 0.672 ± 0.082 0.977 ± 0.009 0.715 ± 0.092 0.998 ± 0.000 0.914 ± 0.003 0.997 ± 0.000 0.907 ± 0.004 0.996 ± 0.000(↓) 0.829 ± 0.026 (↓) 0.996 ± 0.000(↓) 0.847 ± 0.012 (↓) 0.993 ± 0.001 0.880 ± 0.004 0.994 ± 0.001 0.878 ± 0.018
0.971 ± 0.018 0.704 ± 0.047 0.997 ± 0.000 0.910 ± 0.003 0.996 ± 0.000(↓) 0.843 ± 0.009 (↓) 0.994 ± 0.001 0.879 ± 0.012
On AndroZoo dataset (refer to Table 5), our proposed method outperforms HCL∗ and CADE on unseen-AUT (A) values on all the labeling budgets. The average performance gain our method achieved compared to HCL∗ on unseen AUT (A) metric is 0.108. On APIGraph dataset (refer to Table 6), our method outperforms HCL∗ on seen-AUT (A) and seen-AUT (B) while it is competitive on unseen-AUT (B), overall-AUT (B), and overall-AUT (A). with increasing labeling budget, the performance difference between HCL∗ and our method on unseen AUT (A) continues to reduce. Specifically, the difference is 0.031 for the labeling budget of 50, 0.018 for 100, 0.018 for 150, 0.024 for 200, and 0.019 for 250. Overall, our method consistently outperforms HCL∗ across datasets, particularly on unseen AUT (A) tasks under limited labeling budgets. The gains are most pronounced on BODMAS, AndroZoo, and competitive on APIGraph. 6.5
sensitivity to varying labeled data ratios
We compare the performance of SEED on unseen malware detection with varying label ratios across different labeling budgets. Across all datasets, increasing the label ratio consistently improves unseen-AUT (A). BODMAS. For BODMAS, increasing the label ratio leads to clear improvements in unseen-AUT (A) across all budgets (refer to Table 7). At a budget of 50, the score increases from 0.718 (5%) to 0.793 (20%) and further to 0.809 (40%). A similar pattern is observed at a budget of 100, where performance improves from 0.754 to 0.810 and 0.821. Even at higher budgets (e.g., 250), the gains persist, rising from 0.764 to 0.810 and 0.822. Overall, this corresponds to relative improvements in the range of approximately 6%–12%, indicating a strong dependence on labeled data for generalization. AndroZoo. On AndroZoo, the effect of increasing the label ratio is more subtle (refer to Table 8). At a budget of 50, performance changes marginally from 0.843 (5%) to 0.846 (40%), and at 100, from , Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
23
Table 6. Performance comparison of the proposed method with baselines on APIGraph datasets by varying the monthly labeling budget (MB). We report AUT values for benign and malware classes on seen and unseen tasks, and also on the overall tasks. HCL∗ represents the case where experiments are conducted with 20% labeled data on seen tasks. The proposed method (SEED) uses 20% labeled data on seen tasks across all the experiments on all the datasets. Each experiment is repeated for three times and mean value along with standard deviation are reported. Best values are marked in bold and second best values are marked in blue. APIGraph MB 50
150
200
250
Method
seen-AUT (B)
seen-AUT (A)
unseen-AUT (B)
unseen-AUT (A)
overall-AUT (B)
overall-AUT (A)
CADE HCL HCL∗ Ours
0.933 ± 0.062 0.881± 0.024 0.999 ± 0.000 0.962 ± 0.003 0.998 ± 0.000(↓) 0.929 ± 0.007(↓) 0.999 ± 0.000 0.957 ± 0.003
0.987 ± 0.006 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.86 ± 0.023 0.950 ± 0.000 0.946 ± 0.001 (↓) 0.915 ± 0.002
0.965 ± 0.027 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.868 ± 0.004 0.955 ± 0.001 0.939± 0.002 (↓) 0.932 ± 0.000
CADE HCL HCL∗ Ours
0.887 ± 0.081 0.888 ± 0.016 0.999 ± 0.000 0.961 ± 0.001 0.998 ± 0.000(↓) 0.930 ± 0.01 (↓) 0.999 ± 0.000 0.959 ± 0.003
0.931 ± 0.058 0.999 ± 0.000 0.999 ± 0.000 0.998 ± 0.000
0.898 ± 0.011 0.911 ± 0.068 0.893 ± 0.011 0.961 ± 0.003 0.999 ± 0.000 0.961 ± 0.001 0.952 ± 0.003 (↓) 0.998 ± 0.000(↓) 0.943 ± 0.006 (↓) 0.934 ± 0.000 0.999 ± 0.000 0.945 ± 0.001
CADE HCL HCL∗ Ours
0.864 ± 0.068 0.881 ± 0.023 0.999 ± 0.000 0.950 ± 0.01 0.998 ± 0.000(↓) 0.928 ± 0.003(↓) 0.999 ± 0.000 0.961 ± 0.002
0.907 ± 0.047 0.999 ± 0.000 0.999 ± 0.000 0.998 ± 0.000
0.892 ± 0.006 0.960 ± 0.005 0.962 ± 0.001(↑) 0.938 ± 0.001
0.888 ± 0.052 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.887 ± 0.012 0.956 ± 0.006 0.948 ± 0.001(↓) 0.948 ± 0.000
CADE HCL HCL∗ Ours
0.981 ± 0.009 0.897 ± 0.031 0.999 ± 0.000 0.948 ± 0.006 0.998 ± 0.000(↓) 0.920 ± 0.007 (↓) 0.999 ± 0.000 0.961 ± 0.000
0.959 ± 0.029 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.909 ± 0.021 0.965 ± 0.006 0.963 ± 0.002(↓) 0.944 ± 0.001
0.968 ± 0.018 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.904 ± 0.025 0.958 ± 0.005 0.946 ± 0.003(↓) 0.951 ± 0.000
Table 7. Detection performance of SEED on the BODMAS dataset under varying labeled data ratios and labeling budgets. Each experiment is repeated for three times and mean value along with standard deviation are reported. BODMAS Label budget 50
100
150
200
250
Label ratio
seen-AUT (B)
seen-AUT (A)
unseen-AUT (B) unseen-AUT (A) overall-AUT (B) overall-AUT (A)
5% 10% 20% 30% 40%
0.916 ± 0.009 0.924 ± 0.005 0.928 ± 0.011 0.927 ± 0.011 0.930 ± 0.005
0.637 ± 0.079 0.724 ± 0.009 0.736 ± 0.013 0.718 ± 0.037 0.745 ± 0.001
0.926 ± 0.033 0.933 ± 0.005 0.940 ± 0.018 0.942 ± 0.006 0.947 ± 0.009
0.718 ± 0.023 0.760 ± 0.011 0.793 ± 0.038 0.776 ± 0.022 0.809 ± 0.025
0.921 ± 0.018 0.926 ± 0.004 0.933 ± 0.014 0.933 ± 0.008 0.938 ± 0.007
0.684 ± 0.023 0.734 ± 0.009 0.764 ± 0.023 0.743 ± 0.027 0.774 ± 0.013
5% 10% 20% 30% 40%
0.920 ± 0.002 0.911 ± 0.020 0.930 ± 0.002 0.929 ± 0.009 0.935 ± 0.008
0.672 ± 0.009 0.674 ± 0.065 0.701 ± 0.017 0.703 ± 0.032 0.721 ± 0.016
0.929 ± 0.031 0.921 ± 0.022 0.956 ± 0.002 0.946 ± 0.011 0.959 ± 0.007
0.754 ± 0.023 0.719 ± 0.071 0.810 ± 0.027 0.779 ± 0.010 0.821 ± 0.009
0.925 ± 0.017 0.913 ± 0.021 0.942 ± 0.000 0.934 ± 0.007 0.947 ± 0.007
0.717 ± 0.009 0.689 ± 0.070 0.755 ± 0.018 0.739 ± 0.011 0.772 ± 0.010
5% 10% 20% 30% 40%
0.916 ± 0.004 0.927 ± 0.004 0.917 ± 0.002 0.924 ± 0.003 0.930 ± 0.007
0.634 ± 0.084 0.715 ± 0.012 0.719 ± 0.006 0.714 ± 0.010 0.716 ± 0.058
0.936 ± 0.016 0.948 ± 0.010 0.934 ± 0.012 0.945 ± 0.003 0.942 ± 0.013
0.732 ± 0.003 0.788 ± 0.024 0.782 ± 0.038 0.795 ± 0.019 0.782 ± 0.027
0.927 ± 0.008 0.937 ± 0.005 0.925 ± 0.006 0.934 ± 0.003 0.936 ± 0.005
0.690 ± 0.031 0.750 ± 0.012 0.747 ± 0.020 0.752 ± 0.019 0.750 ± 0.029
5% 10% 20% 30% 40%
0.920 ± 0.007 0.923 ± 0.003 0.926 ± 0.010 0.922 ± 0.014 0.923 ± 0.005
0.634 ± 0.083 0.701 ± 0.028 0.664 ± 0.074 0.665 ± 0.029 0.671 ± 0.079
0.943 ± 0.019 0.942 ± 0.016 0.953 ± 0.006 0.950 ± 0.007 0.938 ± 0.015
0.738 ± 0.013 0.773 ± 0.026 0.777 ± 0.057 0.773 ± 0.014 0.766 ± 0.017
0.932 ± 0.011 0.932 ± 0.011 0.940 ± 0.007 0.936 ± 0.010 0.930 ± 0.010
0.693 ± 0.035 0.735 ± 0.005 0.727 ± 0.060 0.719 ± 0.022 0.720 ± 0.034
5% 10% 20% 30% 40%
0.922 ± 0.010 0.924 ± 0.005 0.931 ± 0.003 0.936 ± 0.002 0.935 ± 0.002
0.662 ± 0.093 0.672 ± 0.060 0.709 ± 0.017 0.736 ± 0.008 0.734 ± 0.020
0.945 ± 0.014 0.944 ± 0.011 0.957 ± 0.001 0.951 ± 0.008 0.955 ± 0.013
0.764 ± 0.054 0.756 ± 0.042 0.810 ± 0.009 0.806 ± 0.011 0.822 ± 0.024
0.934 ± 0.008 0.935 ± 0.009 0.944 ± 0.001 0.942 ± 0.005 0.944 ± 0.007
0.718 ± 0.065 0.717 ± 0.044 0.761 ± 0.011 0.766 ± 0.004 0.777 ± 0.016
, Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 24 Channappayya
Table 8. Detection performance of SEED on the AndroZoo dataset under varying labeled data ratios and labeling budgets. Each experiment is repeated for three times and mean value along with standard deviation are reported. AndroZoo Label budget 50
100
150
200
250
Label ratio
seen-AUT (B)
seen-AUT (A)
unseen-AUT (B) unseen-AUT (A) overall-AUT (B) overall-AUT (A)
5% 10% 20% 30% 40%
0.995 ± 0.001 0.996 ± 0.001 0.995 ± 0.001 0.995 ± 0.000 0.995 ± 0.001
0.885 ± 0.013 0.872 ± 0.028 0.875 ± 0.016 0.869 ± 0.025 0.886 ± 0.009
0.994 ± 0.001 0.994 ± 0.000 0.994 ± 0.001 0.993 ± 0.000 0.994 ± 0.001
0.843 ± 0.015 0.824 ± 0.009 0.839 ± 0.010 0.844 ± 0.011 0.846 ± 0.008
0.994 ± 0.001 0.995 ± 0.000 0.994 ± 0.001 0.994 ± 0.000 0.994 ± 0.001
0.857 ± 0.014 0.841 ± 0.012 0.851 ± 0.004 0.852 ± 0.014 0.859 ± 009
5% 10% 20% 30% 40%
0.995 ± 0.001 0.996 ± 0.001 0.994 ± 0.002 0.995 ± 0.000 0.864 ± 0.186
0.863 ± 0.014 0.893 ± 0.010 0.878 ± 0.002 0.850 ± 0.018 0.868 ± 0.012
0.995 ± 0.000 0.996 ± 0.000 0.993 ± 0.000 0.994 ± 0.000 0.966 ± 0.040
0.855 ± 0.014 0.859 ± 0.004 0.855 ± 0.018 0.846 ± 0.026 0.832 ± 0.021
0.995 ± 0.000 0.996 ± 0.000 0.993 ± 0.001 0.994 ± 0.000 0.933 ± 0.088
0.858 ± 0.013 0.871 ± 0.002 0.863 ± 0.011 0.848 ± 0.023 0.844 ± 0.017
5% 10% 20% 30% 40%
0.996 ± 0.001 0.995 ± 0.001 0.992 ± 0.001 0.996 ± 0.001 0.995 ± 0.001
0.865 ± 0.049 0.871 ± 0.030 0.860 ± 0.010 0.857 ± 0.012 0.847 ± 0.018
0.996 ± 0.001 0.995 ± 0.001 0.994 ± 0.000 0.995 ± 0.000 0.994 ± 0.000
0.866 ± 0.020 0.857 ± 0.004 0.855 ± 0.034 0.862 ± 0.016 0.855 ± 0.029
0.996 ± 0.001 0.995 ± 0.001 0.993 ± 0.000 0.995 ± 0.000 0.994 ± 0.000
0.866 ± 0.020 0.862 ± 0.010 0.857 ± 0.026 0.861 ± 0.015 0.853 ± 0.013
5% 10% 20% 30% 40%
0.996 ± 0.000 0.996 ± 0.001 0.992 ± 0.001 0.995 ± 0.002 0.994 ± 0.000
0.855 ± 0.018 0.896 ± 0.006 0.869 ± 0.014 0.883 ± 0.015 0.859 ± 0.026
0.994 ± 0.001 0.996 ± 0.000 0.994 ± 0.001 0.994 ± 0.001 0.993 ± 0.001
0.860 ± 0.039 0.851 ± 0.022 0.879 ± 0.002 0.861 ± 0.033 0.840 ± 0.003
0.995 ± 0.001 0.996 ± 0.000 0.993 ± 0.001 0.995 ± 0.001 0.993 ± 0.000
0.869 ± 0.031 0.866 ± 0.017 0.876 ± 0.005 0.869 ± 0.027 0.847 ± 0.024
5% 10% 20% 30% 40%
0.996 ± 0.001 0.995 ± 0.001 0.993 ± 0.001 0.995 ± 0.001 0.893 ± 0.144
0.877 ± 0.011 0.891 ± 0.010 0.880 ± 0.004 0.866 ± 0.019 0.874 ± 0.008
0.996 ± 0.000 0.996 ± 0.000 0.994 ± 0.001 0.994 ± 0.000 0.965 ± 0.039
0.882 ± 0.015 0.875 ± 0.009 0.878 ± 0.018 0.863 ± 0.011 0.870 ± 0.003
0.996 ± 0.000 0.996 ± 0.000 0.994 ± 0.001 0.993 ± 0.002 0.941 ± 0.074
0.881 ± 0.006 0.880 ± 0.009 0.879 ± 0.012 0.864 ± 0.008 0.872 ± 0.022
0.855 to 0.859. Larger budgets show slightly more noticeable gains, such as an increase from 0.860 to 0.879 at 200, although fluctuations appear at higher ratios (e.g., 250). In general, the improvements remain modest, typically around 0.5%–2.5%, suggesting diminishing returns with additional labeled data. APIGraph. In contrast, APIGraph exhibits steady and consistent improvements with higher label ratios (refer to Table 9). At a budget of 50, unseen-AUT (A) increases from 0.888 (5%) to 0.920 (40%), and at 100, from 0.910 to 0.931. This upward trend continues at larger budgets, with values improving from 0.923 to 0.941 (150), 0.926 to 0.942 (200), and 0.932 to 0.948 (250). These gains correspond to relative improvements of approximately 1.5%–3.5%, reflecting better generalization as more labeled data becomes available. 6.6
Handling false positives
In this section, we study how the performance of the proposed method is impacted by the threshold 𝜏𝑚𝑎𝑥 on the false positive samples, which are used to find the most suitable labeled example for each unlabeled example. 𝜏𝑚𝑎𝑥 indicates the maximum cosine distance between the unlabeled sample and labeled samples to find the most suitable labeled example. Towards this, we compare the performance in terms of unseen AUT (A), average number of samples rejected during training on seen (Avg. #Rej in seen) and unseen tasks (Avg. #Rej in unseen) by varying 𝜏𝑚𝑎𝑥 values. The rejected samples are the unlabeled samples that are rejected whenever the suitable labeled example is not found. This rejection process is controlled by the dynamic threshold 𝜏𝑚𝑎𝑥 that decides number of labeled samples to be considered while finding the most suitable example. Intuitively, larger , Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
25
Table 9. Detection performance of SEED on the APIGraph dataset under varying labeled data ratios and labeling budgets. Each experiment is repeated for three times and mean value along with standard deviation are reported. APIGraph Label budget 50
100
150
200
250
Label ratio
seen-AUT (B)
seen-AUT (A)
unseen-AUT (B) unseen-AUT (A) overall-AUT (B) overall-AUT (A)
5% 10% 20% 30% 40%
0.998 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.939 ± 0.001 0.946 ± 0.007 0.957 ± 0.003 0.956 ± 0.003 0.961 ± 0.001
0.997 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.888 ± 0.015 0.898 ± 0.009 0.915 ± 0.002 0.912 ± 0.009 0.920 ± 0.008
0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.999 ± 0.000
0.910 ± 0.009 0.918 ± 0.007 0.932 ± 0.000 0.931 ± 0.005 0.937 ± 0.005
5% 10% 20% 30% 40%
0.998 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.940 ± 0.001 0.945 ± 0.000 0.953 ± 0.009 0.956 ± 0.001 0.958 ± 0.002
0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.910 ± 0.007 0.917 ± 0.002 0.930 ± 0.004 0.924 ± 0.004 0.931 ± 0.002
0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.999 ± 0.000
0.923 ± 0.004 0.929 ± 0.001 0.940 ± 0.004 0.937 ± 0.003 0.942 ± 0.001
5% 10% 20% 30% 40%
0.998 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.942 ± 0.001 0.948 ± 0.005 0.959 ± 0.003 0.959 ± 0.003 0.959 ± 0.001
0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.999 ± 0.000
0.923 ± 0.007 0.921 ± 0.003 0.934 ± 0.000 0.933 ± 0.005 0.941 ± 0.001
0.998 ± 0.000 0.998 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.931 ± 0.004 0.933 ± 0.000 0.945 ± 0.001 0.944 ± 0.002 0.948 ± 0.001
5% 10% 20% 30% 40%
0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.945 ± 0.002 0.953 ± 0.001 0.961 ± 0.002 0.957 ± 0.001 0.959 ± 0.001
0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.999 ± 0.000
0.926 ± 0.005 0.929 ± 0.001 0.938 ± 0.001 0.939 ± 0.006 0.942 ± 0.002
0.998 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.934 ± 0.003 0.939 ± 0.001 0.948 ± 0.000 0.946 ± 0.003 0.942 ± 0.000
5% 10% 20% 30% 40%
0.998 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.947 ± 0.002 0.950 ± 0.001 0.961 ± 0.000 0.959 ± 0.002 0.960 ± 0.002
0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.999 ± 0.000
0.932 ± 0.005 0.937 ± 0.001 0.944 ± 0.001 0.942 ± 0.004 0.948 ± 0.000
0.998 ± 0.000 0.998 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.938 ± 0.003 0.942 ± 0.001 0.951 ± 0.000 0.949 ± 0.002 0.953 ± 0.001
Table 10. Ablation study demonstrating effect of various maximum threshold 𝜏𝑚𝑎𝑥 values on the unseen-AUT (A) of the proposed method, which serves as a proxy for understanding the effect of false positives samples incurred during the finding of the suitable example corresponding to each unlabeled example. The best values are marked in bold.
𝜏𝑚𝑎𝑥 Dataset
Metrics
0.01
0.03
0.05
0.09
BODMAS
Unseen-AUT (A) Avg. #Rej in seen Avg. #Rej in unseen
0.810 ± 0.027 1543 ± 34 2511 ± 593
0.798 ± 0.053 557 ± 190 852 ± 433
0.790 ± 0.037 435 ± 55 521 ± 165
0.780 ± 0.023 121 ± 25 126 ± 42
AndroZoo
Unseen-AUT (A) Avg. #Rej in seen Avg. #Rej in unseen
0.821 ± 0.014 1426 ± 22 1146 ± 60
0.811 ± 0.012 849 ± 110 682 ± 111
0.855 ± 0.018 578 ± 69 498 ± 95
0.844 ± 0.010 184 ± 33 125 ± 31
API Graph
Unseen-AUT (A) Avg. #Rej in seen Avg. #Rej in unseen
0.921 ± 0.002 2058 ± 228 2626 ± 6
0.930 ± 0.002 1934 ± 292 2508 ± 138
0.927 ± 0.007 1629 ± 212 2221 ± 301
0.919 ± 0.010 1303 ± 52 1650 ± 80
the threshold, more unrelated labeled samples (false positives) may participate in suitable sample selection process. Lower the threshold, related samples may not participate. Thus, we decided to study its impact and these results are presented in Table 10. We made the following observations from these results. , Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 26 Channappayya
The best 𝜏𝑚𝑎𝑥 value, across all the datasets, in the range of 0.01 and 0.05 indicates the selected suitable labeled example is always lying near the unlabeled sample in the latent space. As 𝜏𝑚𝑎𝑥 approaches zero, finding the suitable labeled samples becomes finding the most similar sample. As a result, more suitable samples are rejected. This increased rejection rate with lowering 𝜏𝑚𝑎𝑥 is consistently observed on all the datasets, with an exception that rate of rejection is slower on APIGraph. Increasing 𝜏𝑚𝑎𝑥 brings the most distant samples, thus increases the number of false positive labeled samples for consideration. Due to this, we observe a drop on unseen-AUT (A) on BODMAS dataset from 0.810 to 0.798, from 0.855 to 0.844 on AndroZoo dataset, and from 0.930 to 0.927 on APIGraph dataset. Similarly, the reduction in number of rejected samples is also consistently observed with increasing threshold on all the datasets. Practitioner note on choosing the value of 𝜏𝑚𝑎𝑥 : Based on the experimental results, we observe that a suitable range for 𝜏𝑚𝑎𝑥 (which serves as a proxy for cosine distance) lies between 0.01 and 0.05. This corresponds to selecting labeled samples whose cosine similarity with an unlabeled novel sample lies approximately in the range of 95% to 99% in the latent representation space. Intuitively, this ensures that each unlabeled sample is associated with a highly similar labeled instance. In practice, we recommend tuning the cosine similarity threshold within a slightly broader range of 90% to 99% as a safer choice. 0.8
0.6 0.4
0.6
5% labeled data 10% labeled data 20% labeled data
0.4
SEED (Flipped) SEED +1 Month SEED +3 Months SEED +11 Months
0.2 0.0
Unseen-AUT (A)
1.0
0.8
Unseen-AUT (A)
1.0
0.8
Unseen-AUT (A)
1.0
10%
20%
0.6
5% labeled data 10% labeled data 20% labeled data
30%
40%
50%
60%
Label Noise Ratio (AndroZoo)
70%
80%
0.0
0.4
SEED (Flipped) SEED +1 Month SEED +3 Months SEED +11 Months
0.2 10%
20%
(a) AndroZoo
5% labeled data 10% labeled data 20% labeled data SEED (Flipped) SEED +1 Month SEED +3 Months SEED +11 Months
0.2
30%
40%
50%
60%
Label Noise Ratio (APIGraph)
(b) APIGraph
70%
80%
0.0
10%
20%
30%
40%
50%
60%
Label Noise Ratio (BODMAS)
70%
80%
(c) BODMAS
Fig. 8. Comparing the effect of the label noise with varying label ratio and mitigating its effect using the SEED method on BODMAS, AndroZoo and APIGraph
6.7
Effect of label noise on detection performance
In this section, we study how increasing levels of label noise (via label flipping) affect the detection performance on unseen malware. Specifically, we vary the label-noise ratio from 10% to 80% and analyze how the proposed delayed buffer strategy with SEED mitigates the degradation caused by corrupted labels under different labeled data ratios (5%, 10%, 20%). AndroZoo. As shown in Figure 8a, the detection performance when trained directly with flipped labels degrades sharply as the noise level increases. For instance, at 5% labeled data, unseenAUT(A) decreases steadily from approximately 0.83 at 10% noise to around 0.56 at 40%, and further drops to about 0.29, 0.19, and 0.19 at 60%, 70%, and 80% noise, respectively. Similar degradation patterns are observed for the 10% and 20% labeled-data settings. In contrast, after retraining with noise-free labels obtained after one/three/eleven months, unseen-AUT(A) consistently remains around 0.85–0.89 across the entire noise range, even when the noise ratio reaches 70% or 80%. Thus, demonstrating that SEED effectively mitigates the impact of label corruption and preserves generalization capability on unseen malware families. The complete results of these experiments are available in Table 13. APIGraph. The severity in the reduction of unseen-AUT(A) on the APIGraph dataset is even greater as the label-noise ratio increases from 10% to 80%, as shown in Figure 8b. For example, at , Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
27
Table 11. Detection performance of SEED under varying label noise ratios and different labeled data ratios on the APIGraph dataset. Each experiment is repeated three times, and the mean along with standard deviation is reported. APIGraph Label ratio
5%
10%
20%
Label noise ratio
seen-AUT (B)
seen-AUT (A)
unseen-AUT (B)
unseen-AUT (A)
overall-AUT (B)
overall-AUT (A)
10%+SEED 10%+SEED+1 10%+SEED+3 10%+SEED+11
0.998 ± 0.000 0.998 ± 0.000 0.999 ± 0.000 0.998 ± 0.000
0.928 ± 0.002 0.945 ± 0.001 0.944 ± 0.001 0.942 ± 0.004
0.995 ± 0.001 0.997 ± 0.000 0.998 ± 0.000 0.997 ± 0.000
0.843 ± 0.009 0.902 ± 0.014 0.899 ± 0.018 0.887 ± 0.017
0.996 ± 0.001 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.879 ± 0.006 0.920 ± 0.008 0.918 ± 0.010 0.910 ± 0.010
20%+SEED 20%+SEED+1 20%+SEED+3 20%+SEED+11
0.997 ± 0.000 0.998 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.895 ± 0.006 0.947 ± 0.002 0.950 ± 0.001 0.945 ± 0.002
0.991 ± 0.002 0.997 ± 0.000 0.998 ± 0.000 0.997 ± 0.000
0.683 ± 0.024 0.895 ± 0.012 0.897 ± 0.019 0.889 ± 0.018
0.994 ± 0.001 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.772 ± 0.015 0.917 ± 0.007 0.919 ± 0.011 0.913 ± 0.010
30%+SEED 30%+SEED+1 30%+SEED+3 30%+SEED+11
0.997 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.877 ± 0.005 0.946 ± 0.003 0.948 ± 0.000 0.947 ± 0.003
0.989 ± 0.002 0.997 ± 0.000 0.997 ± 0.000 0.997 ± 0.000
0.591 ± 0.020 0.896 ± 0.013 0.894 ± 0.016 0.876 ± 0.021
0.992 ± 0.001 0.998 ± 0.000 0.998 ± 0.000 0.997 ± 0.000
0.710 ± 0.012 0.917 ± 0.008 0.917 ± 0.009 0.906 ± 0.012
40%+SEED 40%+SEED+1 40%+SEED+3 40%+SEED+11
0.997 ± 0.000 0.999 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.846 ± 0.005 0.948 ± 0.002 0.947 ± 0.002 0.945 ± 0.001
0.982 ± 0.004 0.997 ± 0.000 0.997 ± 0.000 0.997 ± 0.000
0.359 ± 0.031 0.893 ± 0.015 0.885 ± 0.015 0.875 ± 0.018
0.988 ± 0.002 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.562 ± 0.018 0.916 ± 0.001 0.911 ± 0.009 0.904 ± 0.011
50%+SEED 50%+SEED+1 50%+SEED+3 50%+SEED+11
0.996 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.795 ± 0.017 0.947 ± 0.003 0.948 ± 0.003 0.948 ± 0.001
0.975 ± 0.010 0.997 ± 0.000 0.997 ± 0.000 0.997 ± 0.000
0.248 ± 0.055 0.884 ± 0.013 0.890 ± 0.014 0.872 ± 0.020
0.984 ± 0.006 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.476 ± 0.039 0.911 ± 0.006 0.914 ± 0.009 0.904 ± 0.011
60%+SEED 60%+SEED+1 60%+SEED+3 60%+SEED+11
0.995 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.777 ± 0.021 0.947 ± 0.003 0.949 ± 0.004 0.945 ± 0.002
0.963 ± 0.014 0.997 ± 0.000 0.997 ± 0.000 0.996 ± 0.000
0.153 ± 0.012 0.888 ± 0.018 0.876 ± 0.010 0.855 ± 0.031
0.977 ± 0.008 0.998 ± 0.000 0.997 ± 0.000 0.997 ± 0.000
0.412 ± 0.012 0.913 ± 0.011 0.907 ± 0.007 0.893 ± 0.019
70%+SEED 70%+SEED+1 70%+SEED+3 70%+SEED+11
0.995 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.753 ± 0.016 0.946 ± 0.001 0.945 ± 0.003 0.946 ± 0.001
0.959 ± 0.007 0.997 ± 0.000 0.996 ± 0.001 0.996 ± 0.001
0.106 ± 0.004 0.888 ± 0.012 0.867 ± 0.025 0.859 ± 0.027
0.974 ± 0.004 0.998 ± 0.000 0.997 ± 0.000 0.997 ± 0.000
0.375 ± 0.009 0.913 ± 0.007 0.900 ± 0.014 0.896 ± 0.016
80%+SEED 80%+SEED+1 80%+SEED+3 80%+SEED+11
0.995 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.749 ± 0.012 0.946 ± 0.000 0.947 ± 0.004 0.948 ± 0.005
0.947 ± 0.013 0.996 ± 0.001 0.997 ± 0.000 0.996 ± 0.000
0.076 ± 0.011 0.877 ± 0.017 0.878 ± 0.021 0.852 ± 0.024
0.967 ± 0.008 0.997 ± 0.000 0.997 ± 0.000 0.997 ± 0.000
0.354 ± 0.010 0.906 ± 0.009 0.907 ± 0.012 0.893 ± 0.016
10%+SEED 10%+SEED+1 10%+SEED+3 10%+SEED+11
0.998 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.942 ± 0.008 0.955 ± 0.002 0.955 ± 0.000 0.959 ± 0.002
0.996 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.845 ± 0.004 0.904 ± 0.001 0.906 ± 0.011 0.904 ± 0.010
0.997 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.885 ± 0.004 0.925 ± 0.000 0.927 ± 0.006 0.927 ± 0.005
20%+SEED 20%+SEED+1 20%+SEED+3 20%+SEED+11
0.998 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.998 ± 0.000
0.917 ± 0.007 0.956 ± 0.002 0.957 ± 0.002 0.957 ± 0.001
0.994 ± 0.001 0.998 ± 0.000 0.998 ± 0.000 0.997 ± 0.000
0.720 ± 0.029 0.899 ± 0.005 0.900 ± 0.010 0.890 ± 0.012
0.995 ± 0.001 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.802 ± 0.019 0.923 ± 0.002 0.924 ± 0.005 0.918 ± 0.006
30%+SEED 30%+SEED+1 30%+SEED+3 30%+SEED+11
0.997 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.890 ± 0.015 0.954 ± 0.002 0.957 ± 0.000 0.956 ± 0.002
0.989 ± 0.000 0.997 ± 0.000 0.997 ± 0.000 0.997 ± 0.000
0.587 ± 0.020 0.894 ± 0.009 0.892 ± 0.007 0.880 ± 0.011
0.992 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.7131 ± 0.012 0.919 ± 0.006 0.919 ± 0.004 0.912 ± 0.006
40%+SEED 40%+SEED+1 40%+SEED+3 40%+SEED+11
0.997 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.873 ± 0.006 0.954 ± 0.004 0.956 ± 0.002 0.952 ± 0.006
0.987 ± 0.003 0.997 ± 0.001 0.997 ± 0.000 0.996 ± 0.000
0.462 ± 0.044 0.891 ± 0.010 0.885 ± 0.010 0.878 ± 0.013
0.991 ± 0.002 0.998 ± 0.000 0.997 ± 0.000 0.997 ± 0.000
0.633 ± 0.027 0.917 ± 0.007 0.915 ± 0.005 0.909 ± 0.006
50%+SEED 50%+SEED+1 50%+SEED+3 50%+SEED+11
0.996 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.832 ± 0.005 0.954 ± 0.006 0.954 ± 0.003 0.952 ± 0.006
0.975 ± 0.007 0.997 ± 0.000 0.997 ± 0.000 0.996 ± 0.001
0.260 ± 0.013 0.883 ± 0.008 0.879 ± 0.004 0.855 ± 0.004
0.984 ± 0.007 0.998 ± 0.000 0.997 ± 0.000 0.997 ± 0.000
0.498 ± 0.009 0.913 ± 0.006 0.910 ± 0.001 0.896 ± 0.005
60%+SEED 60%+SEED+1 60%+SEED+3 60%+SEED+11
0.996 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.828 ± 0.010 0.954 ± 0.002 0.956 ± 0.001 0.954 ± 0.004
0.968 ± 0.013 0.997 ± 0.000 0.997 ± 0.000 0.996 ± 0.000
0.190 ± 0.019 0.872 ± 0.015 0.877 ± 0.008 0.855 ± 0.009
0.980 ± 0.008 0.997 ± 0.000 0.997 ± 0.000 0.997 ± 0.000
0.455 ± 0.015 0.906 ± 0.009 0.910 ± 0.004 0.897 ± 0.006
70%+SEED 70%+SEED+1 70%+SEED+3 70%+SEED+11
0.996 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.792 ± 0.001 0.954 ± 0.005 0.958 ± 0.001 0.955 ± 0.002
0.963 ± 0.002 0.997 ± 0.000 0.997 ± 0.001 0.997 ± 0.001
0.136 ± 0.044 0.873 ± 0.002 0.868 ± 0.004 0.842 ± 0.013
0.977 ± 0.001 0.998 ± 0.000 0.997 ± 0.000 0.997 ± 0.000
0.408 ± 0.026 0.907 ± 0.000 0.906 ± 0.002 0.890 ± 0.008
80%+SEED 80%+SEED+1 80%+SEED+3 80%+SEED+11
0.995 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.770 ± 0.015 0.958 ± 0.001 0.956 ± 0.003 0.954 ± 0.004
0.948 ± 0.014 0.997 ± 0.001 0.996 ± 0.001 0.996 ± 0.001
0.104 ± 0.028 0.867 ± 0.011 0.872 ± 0.001 0.830 ± 0.008
0.968 ± 0.008 0.997 ± 0.000 0.997 ± 0.000 0.997 ± 0.000
0.380 ± 0.021 0.905 ± 0.007 0.907 ± 0.001 0.882 ± 0.003
10%+SEED 10%+SEED+1 10%+SEED+3 10%+SEED+11
0.998 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.946 ± 0.007 0.960 ± 0.001 0.959 ± 0.005 0.960 ± 0.004
0.996 ± 0.001 0.998 ± 0.000 0.998 ± 0.000 0.997 ± 0.000
0.848 ± 0.036 0.913 ± 0.003 0.907 ± 0.007 0.902 ± 0.012
0.997 ± 0.000 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.889 ± 0.021 0.933 ± 0.002 0.929 ± 0.006 0.927 ± 0.008
20%+SEED 20%+SEED+1 20%+SEED+3 20%+SEED+11
0.998 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.920 ± 0.010 0.961 ± 0.003 0.961 ± 0.002 0.963 ± 0.000
0.993 ± 0.002 0.998 ± 0.000 0.997 ± 0.000 0.997 ± 0.000
0.736 ± 0.028 0.905 ± 0.003 0.907 ± 0.007 0.901 ± 0.009
0.995 ± 0.001 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.813 ± 0.020 0.928 ± 0.003 0.930 ± 0.005 0.927 ± 0.005
30%+SEED 30%+SEED+1 30%+SEED+3 30%+SEED+11
0.997 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 0.000
0.8888 ± 0.010 0.961 ± 0.003 0.962 ± 0.004 0.960 ± 0.000
0.987 ± 0.005 0.997 ± 0.000 0.998 ± 0.000 0.997 ± 0.001
0.577 ± 0.040 0.891 ± 0.004 0.888 ± 0.013 0.883 ± 0.015
0.991 ± 0.003 0.998 ± 0.000 0.998 ± 0.000 0.998 ± 0.000
0.707 ± 0.026 0.920 ± 0.003 0.919 ± 0.009 0.915 ± 0.009
40%+SEED 40%+SEED+1 40%+SEED+3 40%+SEED+11
0.997 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.998 ± 0.000
0.882 ± 0.008 0.960 ± 0.003 0.962 ± 0.002 0.957 ± 0.003
0.983 ± 0.004 0.997 ± 0.001 0.996 ± 0.001 0.996 ± 0.001
0.455 ± 0.017 0.889 ± 0.010 0.893 ± 0.014 0.868 ± 0.010
0.989 ± 0.002 0.998 ± 0.000 0.997 ± 0.000 0.997 ± 0.001
0.633 ± 0.012 0.919 ± 0.007 0.922 ± 0.009 0.905 ± 0.007
50%+SEED 50%+SEED+1 50%+SEED+3 50%+SEED+11
0.996 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.999 ± 9.761
0.839 ± 0.005 0.959 ± 0.001 0.960 ± 0.002 0.962 ± 0.000
0.975 ± 0.005 0.997 ± 0.001 0.996 ± 0.001 0.997 ± 0.001
0.271 ± 0.013 0.885 ± 0.008 0.887 ± 0.014 0.878 ± 0.011
0.984 ± 0.002 0.997 ± 0.000 0.997 ± 0.000 0.997 ± 0.000
0.508 ± 0.009 0.916 ± 0.005 0.918 ± 0.009 0.913 ± 0.006
60%+SEED 60%+SEED+1 60%+SEED+3 60%+SEED+11
0.996 ± 0.001 0.999 ± 0.000 0.998 ± 0.000 0.998 ± 7.137
0.798 ± 0.022 0.961 ± 0.003 0.957 ± 0.003 0.958 ± 0.002
0.954 ± 0.010 0.997 ± 0.000 0.996 ± 0.001 0.996 ± 0.001
0.125 ± 0.019 0.883 ± 0.013 0.864 ± 0.019 0.847 ± 0.009
0.971 ± 0.006 0.997 ± 0.000 0.997 ± 0.000 0.997 ± 0.001
0.404 ± 0.021 0.916 ± 0.009 0.903 ± 0.012 0.894 ± 0.006
70%+SEED 70%+SEED+1 70%+SEED+3 70%+SEED+11
0.996 ± 0.000 0.999 ± 0.000 0.999 ± 0.000 0.998 ± 0.000
0.786 ± 0.016 0.957 ± 0.002 0.959 ± 0.004 0.954 ± 0.005
0.955 ± 0.014 0.997 ± 0.000 0.996 ± 0.001 0.995 ± 0.001
0.115 ± 0.027 0.884 ± 0.009 0.871 ± 0.021 0.814 ± 0.035
0.972 ± 0.009 0.997 ± 0.000 0.997 ± 0.000 0.997 ± 0.000
0.394 ± 0.023 0.915 ± 0.006 0.908 ± 0.014 0.873 ± 0.022
80%+SEED 80%+SEED+1 80%+SEED+3 80%+SEED+11
0.995 ± 0.000 0.998 ± 0.000 0.999 ± 0.000 0.998 ± 0.000
0.747 ± 0.010 0.957 ± 0.003 0.960 ± 0.004 0.949 ± 0.000
0.939 ± 0.010 0.996 ± 0.000 0.997 ± 0.000 0.995 ± 0.000
0.087 ± 0.012 0.877 ± 0.008 0.879 ± 0.003 0.806 ± 0.003
0.962 ± 0.006 0.997 ± 0.000 0.998 ± 0.000 0.996 ± 0.000
0.360 ± 0.011 0.910 ± 0.006 0.913 ± 0.002 0.866 ± 0.002
, Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 28 Channappayya
Table 12. Detection performance of SEED under varying label noise ratios and different labeled data ratios on the BODMAS dataset. Each experiment is repeated three times, and the mean along with standard deviation is reported. BODMAS Label ratio
Label noise ratio
seen-AUT (B)
seen-AUT (A)
unseen-AUT (B)
unseen-AUT (A)
overall-AUT (B)
overall-AUT (A)
5%
10%+SEED 10%+SEED+1 10%+SEED+3 10%+SEED+11
0.919 ± 0.003 0.929 ± 0.002 0.923 ± 0.008 0.927 ± 0.007
0.709 ± 0.039 0.707 ± 0.033 0.702 ± 0.029 0.708 ± 0.053
0.927 ± 0.031 0.937 ± 0.020 0.933 ± 0.025 0.945 ± 0.010
0.779 ± 0.025 0.773 ± 0.016 0.778 ± 0.019 0.791 ± 0.023
0.922 ± 0.016 0.933 ± 0.009 0.927 ± 0.013 0.936 ± 0.005
0.743 ± 0.021 0.742 ± 0.022 0.741 ± 0.022 0.750 ± 0.023
20%+SEED 20%+SEED+1 20%+SEED+3 20%+SEED+11
0.918 ± 0.007 0.929 ± 0.010 0.925 ± 0.005 0.922 ± 0.008
0.667 ± 0.072 0.659 ± 0.083 0.726 ± 0.021 0.669 ± 0.084
0.935 ± 0.022 0.961 ± 0.003 0.929 ± 0.026 0.936 ± 0.023
0.771 ± 0.015 0.792 ± 0.049 0.763 ± 0.018 0.747 ± 0.031
0.927 ± 0.012 0.947 ± 0.005 0.926 ± 0.013 0.929 ± 0.010
0.724 ± 0.035 0.733 ± 0.060 0.742 ± 0.001 0.712 ± 0.041
30%+SEED 30%+SEED+1 30%+SEED+3 30%+SEED+11
0.916 ± 0.005 0.925 ± 0.002 0.920 ± 0.010 0.926 ± 0.002
0.707 ± 0.018 0.727 ± 0.027 0.688 ± 0.033 0.715 ± 0.023
0.925 ± 0.009 0.927 ± 0.021 0.928 ± 0.021 0.948 ± 0.013
0.743 ± 0.029 0.767 ± 0.019 0.770 ± 0.014 0.804 ± 0.026
0.919 ± 0.006 0.924 ± 0.011 0.923 ± 0.007 0.938 ± 0.007
0.721 ± 0.022 0.744 ± 0.010 0.730 ± 0.014 0.762 ± 0.023
40%+SEED 40%+SEED+1 40%+SEED+3 40%+SEED+11
0.914 ± 0.002 0.926 ± 0.005 0.919 ± 0.006 0.922 ± 0.007
0.695 ± 0.014 0.707 ± 0.005 0.642 ± 0.070 0.706 ± 0.020
0.910 ± 0.023 0.951 ± 0.001 0.936 ± 0.028 0.936 ± 0.022
0.717 ± 0.036 0.795 ± 0.011 0.754 ± 0.029 0.786 ± 0.015
0.909 ± 0.012 0.939 ± 0.002 0.928 ± 0.015 0.929 ± 0.012
0.701 ± 0.015 0.754 ± 0.006 0.705 ± 0.034 0.747 ± 0.013
50%+SEED 50%+SEED+1 50%+SEED+3 50%+SEED+11
0.916 ± 0.006 0.927 ± 0.008 0.922 ± 0.008 0.925 ± 0.007
0.684 ± 0.034 0.716 ± 0.031 0.722 ± 0.046 0.695 ± 0.053
0.916 ± 0.036 0.946 ± 0.019 0.924 ± 0.018 0.950 ± 0.013
0.732 ± 0.068 0.797 ± 0.045 0.768 ± 0.029 0.777 ± 0.029
0.914 ± 0.019 0.936 ± 0.011 0.922 ± 0.007 0.937 ± 0.007
0.706 ± 0.035 0.759 ± 0.032 0.743 ± 0.024 0.736 ± 0.027
60%+SEED 60%+SEED+1 60%+SEED+3 60%+SEED+11
0.912 ± 0.000 0.923 ± 0.003 0.920 ± 0.006 0.923 ± 0.008
0.695 ± 0.018 0.697 ± 0.020 0.655 ± 0.071 0.683 ± 0.080
0.894 ± 0.034 0.948 ± 0.021 0.941 ± 0.016 0.946 ± 0.008
0.719 ± 0.032 0.783 ± 0.034 0.748 ± 0.060 0.780 ± 0.029
0.899 ± 0.019 0.936 ± 0.013 0.931 ± 0.010 0.935 ± 0.003
0.702 ± 0.011 0.742 ± 0.012 0.706 ± 0.057 0.735 ± 0.048
70%+SEED 70%+SEED+1 70%+SEED+3 70%+SEED+11
0.890 ± 0.008 0.923 ± 0.006 0.920 ± 0.005 0.923 ± 0.007
0.607 ± 0.036 0.701 ± 0.062 0.673 ± 0.079 0.633 ± 0.075
0.877 ± 0.001 0.943 ± 0.021 0.940 ± 0.023 0.948 ± 0.015
0.614 ± 0.016 0.788 ± 0.044 0.753 ± 0.055 0.761 ± 0.014
0.877 ± 0.003 0.933 ± 0.011 0.931 ± 0.012 0.937 ± 0.006
0.600 ± 0.023 0.748 ± 0.043 0.717 ± 0.037 0.707 ± 0.038
80%+SEED 80%+SEED+1 80%+SEED+3 80%+SEED+11
0.894 ± 0.020 0.914 ± 0.004 0.923 ± 0.001 0.918 ± 0.021
0.633 ± 0.074 0.674 ± 0.054 0.676 ± 0.067 0.655 ± 0.068
0.875 ± 0.018 0.921 ± 0.032 0.940 ± 0.019 0.948 ± 0.010
0.647 ± 0.070 0.723 ± 0.038 0.754 ± 0.026 0.772 ± 0.040
0.878 ± 0.019 0.917 ± 0.018 0.931 ± 0.010 0.934 ± 0.015
0.631 ± 0.072 0.697 ± 0.013 0.718 ± 0.032 0.717 ± 0.050
10%+SEED 10%+SEED+1 10%+SEED+3 10%+SEED+11
0.918 ± 0.003 0.930 ± 0.006 0.918 ± 0.005 0.933 ± 0.001
0.661 ± 0.066 0.704 ± 0.035 0.622 ± 0.074 0.738 ± 0.018
0.933 ± 0.020 0.960 ± 0.002 0.954 ± 0.005 0.945 ± 0.007
0.732 ± 0.015 0.814 ± 0.033 0.756 ± 0.040 0.804 ± 0.018
0.925 ± 0.012 0.946 ± 0.003 0.938 ± 0.005 0.938 ± 0.004
0.697 ± 0.025 0.762 ± 0.032 0.701 ± 0.050 0.771 ± 0.015
20%+SEED 20%+SEED+1 20%+SEED+3 20%+SEED+11
0.936 ± 0.007 0.932 ± 0.002 0.931 ± 0.009 0.933 ± 0.006
0.734 ± 0.029 0.744 ± 0.020 0.733 ± 0.031 0.751 ± 0.013
0.960 ± 0.005 0.933 ± 0.025 0.944 ± 0.007 0.952 ± 0.013
0.824 ± 0.016 0.794 ± 0.007 0.778 ± 0.016 0.816 ± 0.028
0.947 ± 0.005 0.931 ± 0.014 0.937 ± 0.001 0.942 ± 0.009
0.778 ± 0.021 0.766 ± 0.013 0.753 ± 0.015 0.782 ± 0.017
30%+SEED 30%+SEED+1 30%+SEED+3 30%+SEED+11
0.923 ± 0.011 0.926 ± 0.010 0.921 ± 0.022 0.906 ± 0.008
0.724 ± 0.018 0.677 ± 0.045 0.709 ± 0.087 0.621 ± 0.042
0.934 ± 0.009 0.959 ± 0.004 0.935 ± 0.013 0.927 ± 0.023
0.758 ± 0.025 0.808 ± 0.037 0.782 ± 0.051 0.697 ± 0.045
0.927 ± 0.010 0.944 ± 0.006 0.927 ± 0.017 0.917 ± 0.015
0.734 ± 0.022 0.750 ± 0.037 0.745 ± 0.066 0.664 ± 0.010
40%+SEED 40%+SEED+1 40%+SEED+3 40%+SEED+11
0.916 ± 0.007 0.931 ± 0.000 0.930 ± 0.000 0.926 ± 0.008
0.707 ± 0.020 0.692 ± 0.033 0.735 ± 0.019 0.725 ± 0.024
0.935 ± 0.014 0.959 ± 0.006 0.935 ± 0.009 0.952 ± 0.001
0.754 ± 0.040 0.795 ± 0.011 0.772 ± 0.029 0.812 ± 0.005
0.924 ± 0.012 0.945 ± 0.004 0.932 ± 0.006 0.939 ± 0.004
0.727 ± 0.032 0.746 ± 0.005 0.750 ± 0.021 0.768 ± 0.007
50%+SEED 50%+SEED+1 50%+SEED+3 50%+SEED+11
0.915 ± 0.009 0.931 ± 0.009 0.922 ± 0.008 0.926 ± 0.005
0.644 ± 0.080 0.756 ± 0.024 0.722 ± 0.046 0.701 ± 0.030
0.927 ± 0.022 0.939 ± 0.023 0.924 ± 0.018 0.952 ± 0.006
0.700 ± 0.042 0.779 ± 0.051 0.768 ± 0.029 0.788 ± 0.046
0.918 ± 0.016 0.934 ± 0.016 0.922 ± 0.007 0.939 ± 0.004
0.668 ± 0.045 0.765 ± 0.036 0.743 ± 0.024 0.744 ± 0.039
60%+SEED 60%+SEED+1 60%+SEED+3 60%+SEED+11
0.882 ± 0.020 0.913 ± 0.004 0.931 ± 0.008 0.931 ± 0.008
0.550 ± 0.056 0.623 ± 0.053 0.694 ± 0.041 0.723 ± 0.020
0.879 ± 0.023 0.941 ± 0.020 0.956 ± 0.008 0.955 ± 0.004
0.571 ± 0.052 0.744 ± 0.069 0.774 ± 0.028 0.808 ± 0.005
0.876 ± 0.022 0.929 ± 0.010 0.944 ± 0.007 0.942 ± 0.003
0.555 ± 0.056 0.693 ± 0.056 0.736 ± 0.030 0.765 ± 0.008
70%+SEED 70%+SEED+1 70%+SEED+3 70%+SEED+11
0.859 ± 0.037 0.933 ± 0.005 0.909 ± 0.017 0.928 ± 0.007
0.515 ± 0.104 0.761 ± 0.026 0.646 ± 0.090 0.674 ± 0.038
0.871 ± 0.026 0.918 ± 0.034 0.931 ± 0.014 0.961 ± 0.002
0.588 ± 0.069 0.760 ± 0.037 0.739 ± 0.058 0.812 ± 0.009
0.863 ± 0.027 0.923 ± 0.021 0.920 ± 0.014 0.946 ± 0.003
0.554 ± 0.074 0.754 ± 0.015 0.696 ± 0.066 0.750 ± 0.018
80%+SEED 80%+SEED+1 80%+SEED+3 80%+SEED+11
0.869 ± 0.002 0.926 ± 0.004 0.933 ± 0.002 0.933 ± 0.006
0.590 ± 0.016 0.738 ± 0.033 0.715 ± 0.035 0.738 ± 0.052
0.835 ± 0.007 0.932 ± 0.025 0.949 ± 0.015 0.939 ± 0.009
0.580 ± 0.029 0.768 ± 0.041 0.792 ± 0.038 0.776 ± 0.025
0.843 ± 0.002 0.928 ± 0.015 0.940 ± 0.009 0.935 ± 0.005
0.572 ± 0.023 0.750 ± 0.029 0.754 ± 0.027 0.754 ± 0.028
10%+SEED 10%+SEED+1 10%+SEED+3 10%+SEED+11
0.928 ± 0.002 0.932 ± 0.005 0.922 ± 0.008 0.933 ± 0.005
0.740 ± 0.015 0.751 ± 0.029 0.671 ± 0.067 0.743 ± 0.009
0.937 ± 0.028 0.946 ± 0.006 0.952 ± 0.002 0.945 ± 0.007
0.807 ± 0.052 0.792 ± 0.018 0.774 ± 0.030 0.800 ± 0.013
0.932 ± 0.015 0.939 ± 0.003 0.938 ± 0.002 0.939 ± 0.004
0.773 ± 0.036 0.769 ± 0.019 0.726 ± 0.041 0.771 ± 0.008
20%+SEED 20%+SEED+1 20%+SEED+3 20%+SEED+11
0.931 ± 0.003 0.924 ± 0.009 0.928 ± 0.005 0.930 ± 0.006
0.740 ± 0.008 0.616 ± 0.069 0.738 ± 0.012 0.679 ± 0.074
0.942 ± 0.019 0.952 ± 0.005 0.951 ± 0.008 0.944 ± 0.011
0.785 ± 0.048 0.740 ± 0.053 0.818 ± 0.019 0.747 ± 0.070
0.936 ± 0.012 0.939 ± 0.006 0.939 ± 0.005 0.937 ± 0.008
0.759 ± 0.031 0.688 ± 0.055 0.780 ± 0.008 0.716 ± 0.066
30%+SEED 30%+SEED+1 30%+SEED+3 30%+SEED+11
0.917 ± 0.010 0.930 ± 0.006 0.940 ± 0.001 0.924 ± 0.007
0.700 ± 0.010 0.741 ± 0.007 0.767 ± 0.021 0.719 ± 0.079
0.930 ± 0.019 0.924 ± 0.036 0.952 ± 0.009 0.927 ± 0.024
0.739 ± 0.064 0.778 ± 0.043 0.820 ± 0.010 0.761 ± 0.026
0.923 ± 0.012 0.925 ± 0.022 0.944 ± 0.005 0.925 ± 0.013
0.718 ± 0.036 0.755 ± 0.021 0.789 ± 0.005 0.740 ± 0.019
40%+SEED 40%+SEED+1 40%+SEED+3 40%+SEED+11
0.930 ± 0.002 0.929 ± 0.004 0.916 ± 0.015 0.913 ± 0.025
0.723 ± 0.039 0.722 ± 0.055 0.656 ± 0.104 0.639 ± 0.070
0.946 ± 0.006 0.951 ± 0.006 0.951 ± 0.011 0.941 ± 0.025
0.792 ± 0.017 0.799 ± 0.034 0.778 ± 0.061 0.732 ± 0.086
0.938 ± 0.003 0.940 ± 0.005 0.935 ± 0.011 0.927 ± 0.026
0.758 ± 0.018 0.761 ± 0.041 0.723 ± 0.072 0.686 ± 0.081
50%+SEED 50%+SEED+1 50%+SEED+3 50%+SEED+11
0.913 ± 0.004 0.925 ± 0.006 0.932 ± 0.005 0.930 ± 0.003
0.704 ± 0.011 0.705 ± 0.045 0.744 ± 0.032 0.741 ± 0.026
0.920 ± 0.006 0.936 ± 0.021 0.950 ± 0.010 0.950 ± 0.011
0.731 ± 0.024 0.748 ± 0.072 0.812 ± 0.031 0.810 ± 0.030
0.914 ± 0.004 0.930 ± 0.015 0.940 ± 0.007 0.939 ± 0.006
0.711 ± 0.021 0.725 ± 0.056 0.778 ± 0.026 0.774 ± 0.018
60%+SEED 60%+SEED+1 60%+SEED+3 60%+SEED+11
0.830 ± 0.063 0.926 ± 0.001 0.934 ± 0.002 0.930 ± 0.006
0.471 ± 0.140 0.694 ± 0.058 0.745 ± 0.010 0.716 ± 0.045
0.858 ± 0.043 0.944 ± 0.013 0.948 ± 0.005 0.955 ± 0.005
0.571 ± 0.080 0.781 ± 0.006 0.802 ± 0.011 0.805 ± 0.010
0.843 ± 0.047 0.935 ± 0.008 0.940 ± 0.003 0.943 ± 0.004
0.524 ± 0.098 0.739 ± 0.017 0.771 ± 0.010 0.763 ± 0.023
70%+SEED 70%+SEED+1 70%+SEED+3 70%+SEED+11
0.880 ± 0.010 0.902 ± 0.015 0.910 ± 0.020 0.927 ± 0.009
0.586 ± 0.031 0.594 ± 0.064 0.617 ± 0.110 0.750 ± 0.029
0.857 ± 0.002 0.937 ± 0.013 0.950 ± 0.000 0.941 ± 0.010
0.588 ± 0.025 0.725 ± 0.014 0.764 ± 0.037 0.794 ± 0.031
0.862 ± 0.006 0.921 ± 0.013 0.933 ± 0.007 0.933 ± 0.010
0.577 ± 0.027 0.668 ± 0.029 0.700 ± 0.063 0.768 ± 0.030
80%+SEED 80%+SEED+1 80%+SEED+3 80%+SEED+11
0.785 ± 0.090 0.924 ± 0.006 0.910 ± 0.019 0.926 ± 0.005
0.420 ± 0.135 0.703 ± 0.053 0.616 ± 0.094 0.732 ± 0.022
0.791 ± 0.071 0.955 ± 0.005 0.936 ± 0.009 0.942 ± 0.015
0.467 ± 0.102 0.809 ± 0.022 0.711 ± 0.052 0.788 ± 0.036
0.784 ± 0.078 0.941 ± 0.002 0.923 ± 0.013 0.934 ± 0.008
0.442 ± 0.114 0.759 ± 0.034 0.666 ± 0.066 0.760 ± 0.026
10%
20%
, Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
29
Table 13. Detection performance of SEED under varying label noise ratios and different labeled data ratios on the AndroZoo dataset. Each experiment is repeated three times, and the mean along with standard deviation is reported. AndroZoo Label ratio
5%
10%
20%
Label noise ratio
seen-AUT (B)
seen-AUT (A)
unseen-AUT (B)
unseen-AUT (A)
overall-AUT (B)
overall-AUT (A)
10% +SEED 10%+SEED+1 10%+SEED+3 10%+SEED+11
0.996 ± 0.000 0.995 ± 0.001 0.996 ± 0.001 0.995 ± 0.002
0.854 ± 0.023 0.899 ± 0.005 0.909 ± 0.004 0.921 ± 0.004
0.994 ± 0.000 0.995 ± 0.000 0.995 ± 0.001 0.996 ± 0.001
0.831 ± 0.007 0.879 ± 0.027 0.886 ± 0.037 0.887 ± 0.013
0.995 ± 0.000 0.995 ± 0.000 0.995 ± 0.001 0.995 ± 0.001
0.839 ± 0.005 0.886 ± 0.016 0.894 ± 0.026 0.899 ± 0.007
20%+SEED 20% +SEED+1 20% +SEED+3 20%+SEED+11
0.996 ± 0.000 0.996 ± 0.000 0.995 ± 0.001 0.996 ± 0.000
0.853 ± 0.008 0.907 ± 0.012 0.896 ± 0.020 0.900 ± 0.011
0.993 ± 0.000 0.996 ± 0.000 0.994 ± 0.001 0.995 ± 0.001
0.808 ± 0.022 0.876 ± 0.011 0.871 ± 0.009 0.859 ± 0.015
0.994 ± 0.001 0.996 ± 0.001 0.995 ± 0.001 0.996 ± 0.001
0.824 ± 0.017 0.887 ± 0.007 0.880 ± 0.009 0.874 ± 0.014
30% +SEED 30%+SEED+1 30%+SEED+3 30%+SEED+11
0.995 ± 0.000 0.996 ± 0.001 0.996 ± 0.001 0.995 ± 0.002
0.812 ± 0.031 0.904 ± 0.014 0.904 ± 0.006 0.895 ± 0.016
0.993 ± 0.001 0.993 ± 0.001 0.995 ± 0.000 0.993 ± 0.000
0.758 ± 0.018 0.854 ± 0.037 0.878 ± 0.018 0.868 ± 0.010
0.993 ± 0.001 0.994 ± 0.001 0.995 ± 0.000 0.994 ± 0.001
0.778 ± 0.021 0.871 ± 0.026 0.886 ± 0.012 0.878 ± 0.013
40% + SEED 40%+SEED+1 40%+SEED+3 40%+SEED+11
0.996 ± 0.000 0.995 ± 0.001 0.995 ± 0.002 0.996 ± 0.001
0.793 ± 0.040 0.891 ± 0.010 0.900 ± 0.005 0.905 ± 0.008
0.989 ± 0.000 0.995 ± 0.001 0.995 ± 0.000 0.994 ± 0.000
0.558 ± 0.024 0.875 ± 0.012 0.875 ± 0.007 0.872 ± 0.004
0.992 ± 0.000 0.995 ± 0.001 0.995 ± 0.001 0.995 ± 0.000
0.639 ± 0.025 0.881 ± 0.011 0.884 ± 0.003 0.884 ± 0.005
50%+SEED 50%+SEED+1 50%+SEED+3 50%+SEED+11
0.996 ± 0.001 0.996 ± 0.001 0.995 ± 0.002 0.996 ± 0.001
0.795 ± 0.033 0.900 ± 0.016 0.908 ± 0.011 0.896 ± 0.015
0.974 ± 0.006 0.994 ± 0.001 0.995 ± 0.000 0.995 ± 0.000
0.411 ± 0.082 0.859 ± 0.029 0.857 ± 0.011 0.857 ± 0.022
0.982 ± 0.004 0.995 ± 0.000 0.995 ± 0.002 0.995 ± 0.001
0.541 ± 0.064 0.873 ± 0.025 0.875 ± 0.009 0.870 ± 0.019
60%+SEED 60%+SEED+1 60%+SEED+3 60%+SEED+11
0.996 ± 0.000 0.996 ± 0.000 0.996 ± 0.001 0.995 ± 0.001
0.719 ± 0.008 0.892 ± 0.010 0.902 ± 0.014 0.892 ± 0.007
0.969 ± 0.004 0.994 ± 0.001 0.995 ± 0.000 0.994 ± 0.000
0.297 ± 0.007 0.869 ± 0.021 0.864 ± 0.026 0.860 ± 0.014
0.978 ± 0.002 0.995 ± 0.001 0.995 ± 0.000 0.994 ± 0.000
0.441 ± 0.007 0.877 ± 0.017 0.876 ± 0.021 0.872 ± 0.012
70%+SEED 70%+SEED+1 70%+SEED+3 70%+SEED+11
0.994 ± 0.000 0.924 ± 0.102 0.995 ± 0.002 0.995 ± 0.002
0.601 ± 0.101 0.901 ± 0.016 0.906 ± 0.003 0.896 ± 0.018
0.953 ± 0.000 0.965 ± 0.038 0.994 ± 0.001 0.993 ± 0.001
0.186 ± 0.037 0.836 ± 0.043 0.851 ± 0.012 0.864 ± 0.023
0.967 ± 0.000 0.951 ± 0.060 0.994 ± 0.001 0.994 ± 0.002
0.327 ± 0.060 0.858 ± 0.032 0.871 ± 0.007 0.875 ± 0.019
80%+SEED 80%+SEED+1 80%+SEED+3 80%+SEED+11
0.993 ± 0.000 0.994 ± 0.002 0.996 ± 0.001 0.995 ± 0.002
0.616 ± 0.085 0.890 ± 0.011 0.902 ± 0.016 0.905 ± 0.006
0.931 ± 0.014 0.994 ± 0.001 0.994 ± 0.001 0.994 ± 0.000
0.190 ± 0.065 0.843 ± 0.012 0.847 ± 0.023 0.851 ± 0.007
0.952 ± 0.009 0.994 ± 0.001 0.995 ± 0.001 0.994 ± 0.001
0.334 ± 0.061 0.860 ± 0.008 0.866 ± 0.015 0.870 ± 0.003
10% + SEED 10% +SEED+1 10% +SEED+3 10%+SEED+11
0.995 ± 0.001 0.995 ± 0.002 0.995 ± 0.002 0.997 ± 0.001
0.881 ± 0.023 0.909 ± 0.015 0.904 ± 0.020 0.909 ± 0.015
0.994 ± 0.001 0.995 ± 0.000 0.994 ± 0.001 0.996 ± 0.000
0.824 ± 0.016 0.863 ± 0.037 0.858 ± 0.022 0.894 ± 0.005
0.994 ± 0.001 0.995 ± 0.000 0.994 ± 0.001 0.996 ± 0.000
0.843 ± 0.017 0.879 ± 0.020 0.873 ± 0.020 0.899 ± 0.002
20%+SEED 20%+SEED+1 20%+SEED+3 20%+SEED+11
0.996 ± 0.000 0.996 ± 0.001 0.997 ± 0.000 0.996 ± 0.001
0.850 ± 0.018 0.897 ± 0.010 0.914 ± 0.006 0.916 ± 0.007
0.992 ± 0.001 0.996 ± 0.001 0.996 ± 0.000 0.996 ± 0.000
0.746 ± 0.012 0.870 ± 0.024 0.898 ± 0.008 0.883 ± 0.010
0.994 ± 0.001 0.996 ± 0.001 0.997 ± 0.000 0.996 ± 0.000
0.782 ± 0.014 0.885 ± 0.014 0.903 ± 0.007 0.893 ± 0.005
30%+SEED 30% +SEED+1 30% +SEED+3 30%+SEED+11
0.996 ± 0.000 0.995 ± 0.001 0.998 ± 0.000 0.998 ± 0.000
0.867 ± 0.011 0.903 ± 0.016 0.912 ± 0.003 0.920 ± 0.005
0.993 ± 0.000 0.995 ± 0.000 0.996 ± 0.000 0.996 ± 0.000
0.718 ± 0.015 0.864 ± 0.016 0.876 ± 0.035 0.879 ± 0.010
0.994 ± 0.000 0.995 ± 0.000 0.997 ± 0.000 0.996 ± 0.000
0.768 ± 0.009 0.877 ± 0.011 0.888 ± 0.022 0.893 ± 0.004
40%+SEED 40%+SEED+1 40%+SEED+3 40%+SEED+11
0.997 ± 0.000 0.996 ± 0.001 0.995 ± 0.001 0.995 ± 0.001
0.838 ± 0.014 0.901 ± 0.006 0.895 ± 0.016 0.910 ± 0.006
0.987 ± 0.003 0.996 ± 0.000 0.995 ± 0.000 0.995 ± 0.000
0.518 ± 0.066 0.867 ± 0.019 0.870 ± 0.014 0.874 ± 0.012
0.990 ± 0.002 0.996 ± 0.001 0.995 ± 0.001 0.995 ± 0.001
0.627 ± 0.043 0.879 ± 0.011 0.879 ± 0.005 0.887 ± 0.009
50%+SEED 50% +SEED+1 50% +SEED+3 50%+SEED+11
0.996 ± 0.000 0.995 ± 0.001 0.995 ± 0.001 0.996 ± 0.002
0.814 ± 0.032 0.901 ± 0.019 0.895 ± 0.019 0.905 ± 0.008
0.977 ± 0.004 0.995 ± 0.000 0.995 ± 0.000 0.995 ± 0.001
0.390 ± 0.033 0.863 ± 0.017 0.840 ± 0.038 0.846 ± 0.037
0.984 ± 0.003 0.995 ± 0.000 0.995 ± 0.000 0.995 ± 0.001
0.534 ± 0.027 0.876 ± 0.013 0.858 ± 0.023 0.866 ± 0.026
60%+SEED 60%+SEED+1 60%+SEED+3 60%+SEED+11
0.996 ± 0.000 0.996 ± 0.002 0.996 ± 0.002 0.998 ± 0.000
0.756 ± 0.044 0.905 ± 0.011 0.903 ± 0.013 0.918 ± 0.006
0.971 ± 0.000 0.994 ± 0.001 0.995 ± 0.000 0.995 ± 0.000
0.344 ± 0.067 0.815 ± 0.006 0.853 ± 0.034 0.848 ± 0.057
0.979 ± 0.000 0.994 ± 0.001 0.995 ± 0.001 0.996 ± 0.000
0.484 ± 0.030 0.846 ± 0.007 0.871 ± 0.017 0.872 ± 0.036
70%+SEED 70%+SEED+1 70%+SEED+3 70%+SEED+11
0.994 ± 0.001 0.996 ± 0.001 0.995 ± 0.001 0.996 ± 0.002
0.672 ± 0.031 0.913 ± 0.009 0.903 ± 0.005 0.908 ± 0.008
0.952 ± 0.012 0.995 ± 0.000 0.994 ± 0.000 0.994 ± 0.000
0.291 ± 0.050 0.866 ± 0.019 0.826 ± 0.023 0.827 ± 0.032
0.966 ± 0.008 0.995 ± 0.000 0.994 ± 0.000 0.995 ± 0.001
0.420 ± 0.028 0.882 ± 0.013 0.852 ± 0.013 0.854 ± 0.020
80%+SEED 80%+SEED+1 80%+SEED+3 80%+SEED+11
0.993 ± 0.002 0.996 ± 0.002 0.997 ± 0.001 0.998 ± 0.000
0.645 ± 0.045 0.898 ± 0.021 0.907 ± 0.011 0.893 ± 0.022
0.931 ± 0.002 0.994 ± 0.000 0.995 ± 0.000 0.994 ± 0.000
0.225 ± 0.062 0.812 ± 0.046 0.809 ± 0.039 0.802 ± 0.051
0.952 ± 0.000 0.994 ± 0.000 0.996 ± 0.000 0.995 ± 0.000
0.367 ± 0.025 0.841 ± 0.025 0.842 ± 0.023 0.832 ± 0.025
10% +SEED 10%+SEED+1 10%+SEED+3 10%+SEED+11
0.994 ± 0.000 0.994 ± 0.000 0.993 ± 0.001 0.993 ± 0.002
0.845 ± 0.012 0.899 ± 0.001 0.896 ± 0.003 0.901 ± 0.003
0.994 ± 0.000 0.994 ± 0.000 0.995 ± 0.000 0.995 ± 0.000
0.857 ± 0.026 0.887 ± 0.011 0.883 ± 0.021 0.882 ± 0.024
0.994 ± 0.000 0.994 ± 0.000 0.994 ± 0.000 0.994 ± 0.000
0.852 ± 0.018 0.890 ± 0.007 0.887 ± 0.013 0.889 ± 0.015
20% +SEED 20% +SEED+1 20% +SEED+3 20%+SEED+11
0.995 ± 0.000 0.994 ± 0.001 0.993 ± 0.000 0.993 ± 0.000
0.871 ± 0.006 0.892 ± 0.032 0.893 ± 0.008 0.905 ± 0.006
0.994 ± 0.000 0.995 ± 0.000 0.994 ± 0.000 0.996 ± 0.000
0.787 ± 0.009 0.885 ± 0.010 0.873 ± 0.008 0.904 ± 0.013
0.994 ± 0.000 0.994 ± 0.001 0.993 ± 0.000 0.995 ± 0.000
0.815 ± 0.006 0.888 ± 0.014 0.879 ± 0.007 0.904 ± 0.010
30%+SEED 30%+SEED+1 30%+SEED+3 30%+SEED+11
0.995 ± 0.001 0.991 ± 0.001 0.994 ± 0.001 0.995 ± 0.001
0.855 ± 0.032 0.881 ± 0.006 0.862 ± 0.054 0.905 ± 0.018
0.992 ± 0.000 0.993 ± 0.000 0.995 ± 0.000 0.996 ± 0.000
0.721 ± 0.006 0.869 ± 0.012 0.898 ± 0.007 0.884 ± 0.012
0.993 ± 0.000 0.993 ± 0.001 0.995 ± 0.000 0.995 ± 0.001
0.766 ± 0.012 0.873 ± 0.011 0.886 ± 0.017 0.891 ± 0.015
40% 40%+SEED+1 40%+SEED+3 40%+SEED+11
0.995 ± 0.000 0.994 ± 0.000 0.995 ± 0.001 0.997 ± 0.000
0.828 ± 0.014 0.900 ± 0.005 0.901 ± 0.010 0.919 ± 0.003
0.989 ± 0.002 0.995 ± 0.000 0.995 ± 0.000 0.996 ± 0.000
0.590 ± 0.059 0.871 ± 0.008 0.873 ± 0.015 0.883 ± 0.013
0.991 ± 0.002 0.994 ± 0.000 0.995 ± 0.000 0.997 ± 0.000
0.671 ± 0.036 0.880 ± 0.004 0.883 ± 0.007 0.895 ± 0.008
50%+SEED 50%+SEED+1 50%+SEED+3 50%+SEED+11
0.994 ± 0.001 0.995 ± 0.000 0.995 ± 0.001 0.993 ± 0.002
0.786 ± 0.032 0.877 ± 0.025 0.899 ± 0.003 0.889 ± 0.006
0.984 ± 0.001 0.995 ± 0.000 0.994 ± 0.000 0.992 ± 0.003
0.431 ± 0.028 0.865 ± 0.023 0.869 ± 0.016 0.877 ± 0.021
0.987 ± 0.001 0.995 ± 0.000 0.994 ± 0.001 0.992 ± 0.002
0.551 ± 0.029 0.869 ± 0.013 0.879 ± 0.009 0.881 ± 0.015
60%+SEED 60%+SEED+1 60%+SEED+3 60%+SEED+11
0.996 ± 0.000 0.993 ± 0.000 0.995 ± 0.001 0.997 ± 0.000
0.771 ± 0.054 0.898 ± 0.011 0.890 ± 0.025 0.914 ± 0.010
0.964 ± 0.009 0.993 ± 0.000 0.995 ± 0.001 0.996 ± 0.001
0.264 ± 0.048 0.839 ± 0.027 0.849 ± 0.039 0.893 ± 0.012
0.975 ± 0.006 0.993 ± 0.000 0.995 ± 0.001 0.997 ± 0.000
0.436 ± 0.044 0.858 ± 0.020 0.863 ± 0.035 0.901 ± 0.011
70%+SEED 70%+SEED+1 70%+SEED+3 70%+SEED+11
0.995 ± 0.000 0.995 ± 0.001 0.995 ± 0.000 0.997 ± 0.000
0.650 ± 0.146 0.886 ± 0.019 0.891 ± 0.002 0.882 ± 0.021
0.953 ± 0.011 0.995 ± 0.000 0.994 ± 0.000 0.995 ± 0.001
0.198 ± 0.085 0.837 ± 0.018 0.834 ± 0.015 0.859 ± 0.023
0.967 ± 0.007 0.995 ± 0.000 0.995 ± 0.000 0.996 ± 0.000
0.349 ± 0.104 0.854 ± 0.017 0.853 ± 0.009 0.867 ± 0.009
80%+SEED 80%+SEED+1 80%+SEED+3 80%+SEED+11
0.993 ± 0.000 0.995 ± 0.000 0.996 ± 0.002 0.996 ± 0.000
0.469 ± 0.101 0.905 ± 0.003 0.890 ± 0.013 0.888 ± 0.037
0.923 ± 0.005 0.994 ± 0.000 0.995 ± 0.001 0.995 ± 0.000
0.116 ± 0.038 0.811 ± 0.017 0.839 ± 0.021 0.834 ± 0.042
0.947 ± 0.003 0.994 ± 0.000 0.995 ± 0.001 0.995 ± 0.000
0.234 ± 0.058 0.843 ± 0.009 0.856 ± 0.017 0.851 ± 0.035
, Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 30 Channappayya
5% labeled data, unseen-AUT(A) drops dramatically from approximately 0.84 at 10% noise to 0.08 at 80% noise. Comparable degradation trends are observed for the 10% and 20% labeled-data settings. In contrast, after incorporating noise-free labels, unseen-AUT(A) remains stable around 0.86–0.90 for all labeled-data ratios, even under extremely noisy scenarios. The complete results of these experiments are available in Table 11. BODMAS. Figure 8c shows that the detection performance degradation is less abrupt as the noise ratio increases. For instance, with 5% labeled data, unseen-AUT(A) decreases gradually from approximately 0.78 at 10% noise to 0.65 at 80% noise. A similar trend is observed for 10% and 20% labeled data. After retraining with noise-free labels, unseen-AUT(A) values are restored to the range of 0.75–0.82 for most noise ratios, even when the noise reaches 80%. Overall, these results demonstrate that SEED effectively stabilizes detection performance on BODMAS under high label-noise conditions. This comparatively slower degradation may be attributed to the more stable feature distribution in BODMAS. It may also be related to the shorter temporal span of the dataset (approximately one year) compared to AndroZoo and APIGraph, which cover longer time periods and may introduce greater variability and concept drift. The complete results of these experiments are available in Table 12. 6.8
Operating-Point Evaluation at Fixed False Positive Rates
In this section, we study the operating-point behavior of SEED and the baseline detectors under fixed false positive rate (FPR) constraints. This evaluation examines how the true positive rate (TPR) evolves across sequential tasks when the detectors are required to operate at specific FPR thresholds. AndroZoo. Figure 9 presents the operating-point analysis of SEED against CADE, HCL, and HCL∗ on the AndroZoo dataset. In the CADE vs SEED comparison (left block), both methods achieve high detection rates at FPR=10−1 ; however, SEED shows smoother performance evolution across tasks, while CADE exhibits more variability. As the operating constraint becomes stricter (FPR=10−2
CADE SEED
0.6 0.4 0.2
1.0
CADE SEED
0.8
AndroZoo - All Tasks (False Positive Rate = 10 3) CADE SEED
1.0
0.6 0.4 0.2
AndroZoo - All Tasks (False Positive Rate = 10 1)
0.9 0.8 0.7 0.6
HCL
0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34
0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34
0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34
SEED 0.5 0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34
(a) FPR = 10−1
(b) FPR = 10−2
(c) FPR = 10−3
(d) FPR = 10−1
Task ID
Task ID
Task ID
Task ID
CADE Vs SEED 1.0
0.8 0.7 0.6 HCL* SEED
AndroZoo - All Tasks (False Positive Rate = 10 2)
0.8 0.6 0.4 0.2
1.0
True Positive Rate (TPR)
AndroZoo - All Tasks (False Positive Rate = 10 1)
0.9
0.5
Task ID
(e) FPR = 10−2
AndroZoo - All Tasks (False Positive Rate = 10 3)
1.0 HCL 0.9 SEED 0.8 0.7 0.6 0.5 0.4 0.3 0.2 0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34
Task ID
(f) FPR = 10−3
HCL Vs SEED True Positive Rate (TPR)
True Positive Rate (TPR)
1.0
AndroZoo - All Tasks (False Positive Rate = 10 2)
1.0 0.9 0.8 0.7 0.6 0.5 0.4 HCL SEED 0.3 0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34
True Positive Rate (TPR)
0.4
AndroZoo - All Tasks (False Positive Rate = 10 2)
0.8
True Positive Rate (TPR)
0.6
0.2
1.0
True Positive Rate (TPR)
0.8
True Positive Rate (TPR)
AndroZoo - All Tasks (False Positive Rate = 10 1) True Positive Rate (TPR)
True Positive Rate (TPR)
1.0
HCL* SEED
0.8
AndroZoo - All Tasks (False Positive Rate = 10 3) HCL* SEED
0.6 0.4 0.2
0.40 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34
0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34
0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34
(g) FPR = 10−1
(h) FPR = 10−2
(i) FPR = 10−3
Task ID
Task ID
Task ID
HCL∗ Vs SEED Fig. 9. Operating-point comparison of SEED with baseline detectors on the AndroZoo dataset at fixed false positive rate (FPR) thresholds. The left column presents CADE vs SEED, the right column shows HCL vs SEED, and the bottom panel shows HCL∗ vs SEED. Within each comparison group, the three plots correspond to FPR levels 10−1 , 10−2 , and 10−3 . Across all plots, the red curves denote SEED, whereas the blue curves represent the corresponding baseline methods (CADE, HCL, or HCL∗ ). , Vol. 1, No. 1, Article . Publication date: May 2026.
1
2
3
4
5
6
7
Task ID
8
9
10
11
(a) FPR = 10−1
BODMAS - All Tasks (False Positive Rate = 10 2) CADE SEED
0.5 0.4 0.3 0.2 0.1 0.0 0
1
2
3
4
5
6
Task ID
7
8
9
10
11
0.35 0.30 0.25 0.20 0.15 0.10 0.05 0.00 0
(b) FPR = 10−2
BODMAS - All Tasks (False Positive Rate = 10 3) CADE SEED
1
2
3
4
5
6
Task ID
7
8
9
10
11
BODMAS - All Tasks (False Positive Rate = 10 1)
0.9
HCL SEED
0.8 0.7 0.6 0.5 0
(c) FPR = 10−3
1
2
3
4
5
6
7
Task ID
8
9
10
11
2
3
4
5
6
Task ID
7
8
9
10
BODMAS - All Tasks (False Positive Rate = 10 2)
0.6
HCL* SEED
0.5 0.4 0.3 0.2 0.1 0.0 0
11
True Positive Rate (TPR)
True Positive Rate (TPR)
True Positive Rate (TPR)
HCL* SEED
1
BODMAS - All Tasks (False Positive Rate = 10 3)
HCL SEED
0.5 0.4 0.3 0.2 0.1 0.0 0
1
2
3
4
5
6
Task ID
7
8
9
10
11
(e) FPR = 10−2
0.35 0.30 0.25 0.20 0.15 0.10 0.05 0.00 0
HCL SEED
1
2
3
4
5
6
Task ID
7
8
9
10
11
(f) FPR = 10−3
HCL Vs SEED
BODMAS - All Tasks (False Positive Rate = 10 1)
0
BODMAS - All Tasks (False Positive Rate = 10 2)
0.6
(d) FPR = 10−1
CADE Vs SEED 0.9 0.8 0.7 0.6 0.5 0.4 0.3
31
True Positive Rate (TPR)
0.6
True Positive Rate (TPR)
CADE SEED
True Positive Rate (TPR)
BODMAS - All Tasks (False Positive Rate = 10 1)
True Positive Rate (TPR)
0.9 0.8 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0
True Positive Rate (TPR)
True Positive Rate (TPR)
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
(g) FPR = 10−1
1
2
3
4
5
6
Task ID
7
8
9
10
11
0.40 0.35 0.30 0.25 0.20 0.15 0.10 0.05 0.00 0
(h) FPR = 10−2
BODMAS - All Tasks (False Positive Rate = 10 3) HCL* SEED
1
2
3
4
5
6
Task ID
7
8
9
10
11
(i) FPR = 10−3
HCL∗ Vs SEED Fig. 10. Operating-point comparison of SEED with baseline detectors on the BODMAS dataset at fixed false positive rate (FPR) thresholds. The left column presents CADE vs SEED, the right column shows HCL vs SEED, and the bottom panel shows HCL∗ vs SEED. Within each comparison group, the three plots correspond to FPR levels 10−1 , 10−2 , and 10−3 . Across all plots, the red curves denote SEED, whereas the blue curves represent the corresponding baseline methods (CADE, HCL, or HCL∗ ).
0.85 0.80 0.75 0.70 0
CADE SEED
10
20
30
40
Task ID
50
60
70
80
APIGraph - All Tasks (False Positive Rate = 10 2)
1.0 0.9 0.8 0.7 0.6 0.5 0.4 0.30
CADE SEED
10
(a) FPR = 10−1
20
30
40
Task ID
50
60
APIGraph - All Tasks (False Positive Rate = 10 4)
APIGraph - All Tasks (False Positive Rate = 10 3)
70
0.8 0.6 0.4 0.2 0.00
80
CADE SEED
10
(b) FPR = 10−2
20
30
40
Task ID
50
60
70
True Positive Rate (TPR)
True Positive Rate (TPR)
True Positive Rate (TPR)
0.95 0.90
True Positive Rate (TPR)
APIGraph - All Tasks (False Positive Rate = 10 1)
1.00
80
0.8 0.6 0.4
CADE SEED
0.2 0.0 0
10
(c) FPR = 10−3
20
30
40
Task ID
50
60
70
80
(d) FPR = 10−4
HCL SEED
10
20
30
40
Task ID
50
60
70
80
1.00 0.95 0.90 0.85 0.80 0.75 0.70 0
APIGraph - All Tasks (False Positive Rate = 10 2)
HCL SEED
10
(e) FPR = 10−1
20
30
40
Task ID
50
60
APIGraph - All Tasks (False Positive Rate = 10 3)
1.0
70
0.6 0.4 0.2 0.0 0
80
HCL SEED
10
(f) FPR = 10−2
20
30
40
Task ID
50
60
APIGraph - All Tasks (False Positive Rate = 10 4)
1.0
0.8
70
True Positive Rate (TPR)
APIGraph - All Tasks (False Positive Rate = 10 1)
True Positive Rate (TPR)
1.00 0.98 0.96 0.94 0.92 0.90 0.88 0
True Positive Rate (TPR)
True Positive Rate (TPR)
CADE Vs SEED 0.8 0.6 0.4 0.2 0.0 0
80
HCL SEED
10
(g) FPR = 10−3
20
30
40
Task ID
50
60
70
80
(h) FPR = 10−4
HCL* SEED
10
20
30
40
Task ID
50
60
(i) FPR = 10−1
70
80
1.00 0.95 0.90 0.85 0.80 0.75 0.70 0
APIGraph - All Tasks (False Positive Rate = 10 2)
HCL* SEED
10
20
30
40
Task ID
50
60
(j) FPR = 10−2
70
80
APIGraph - All Tasks (False Positive Rate = 10 4)
APIGraph - All Tasks (False Positive Rate = 10 3)
1.0 0.8 0.6 0.4 0.2 0.0 0
HCL* SEED
10
20
30
40
Task ID
50
60
(k) FPR = 10−3
70
80
True Positive Rate (TPR)
APIGraph - All Tasks (False Positive Rate = 10 1)
True Positive Rate (TPR)
1.00 0.98 0.96 0.94 0.92 0.90 0.88 0
True Positive Rate (TPR)
True Positive Rate (TPR)
HCL Vs SEED 0.8 0.6 0.4 0.2 0.0 0
HCL* SEED
10
20
30
40
Task ID
50
60
70
80
(l) FPR = 10−4
HCL∗ Vs SEED Fig. 11. Operating-point comparison of SEED with baseline detectors on the APIGraph dataset at fixed false positive rate (FPR) thresholds. The top, middle, and bottom rows show CADE vs SEED, HCL vs SEED, and HCL∗ vs SEED, respectively. Each column corresponds to an FPR constraint of 10−1 , 10−2 , 10−3 , and 10−4 . Across all plots, red curves denote SEED and blue curves denote the corresponding baseline method. , Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 32 Channappayya
and 10−3 ), SEED preserves higher detection rates across a larger portion of the task sequence. In the HCL vs SEED comparison (right block), SEED maintains a relatively stable TPR across tasks, particularly at stricter operating points. Finally, in the HCL∗ vs SEED comparison (bottom block), SEED achieves detection performance comparable to the contrastive baseline, with SEEDoften maintaining competitive or slightly higher performance in later tasks. BODMAS. The operating-point comparison on the BODMAS dataset is illustrated in Figure 10. In the CADE vs SEED comparison (left block of Figure 10), SEED consistently maintains a higher or comparable detection rate across most tasks. In the HCL vs SEED comparison (right block), at FPR=10−1 , both methods achieve relatively strong performance across the early tasks. However, at the stricter FPRs (10−2 and 10−3 ), SEED consistently maintains higher TPR values across several tasks, whereas HCL exhibits more pronounced fluctuations. The comparison with HCL∗ (bottom block) shows that SEED achieves detection performance that is consistently comparable to the contrastive baseline across the task sequence. Further, SEED maintains a stable detection trajectory across tasks. APIGraph. Figure 11 presents the operating-point evaluation on the APIGraph dataset. In the CADE vs SEED comparison (top row of Figure 11), SEED maintains detection performance that is consistently comparable to or slightly higher than CADE across most tasks. The HCL vs SEED comparison (middle row) shows that both detectors achieve high detection rates across the task sequence; in particular, SEED maintains a more stable trajectory across tasks at the stricter operating points. The comparison with HCL∗ (bottom row) reveals that SEED achieves performance that remains highly competitive with the contrastive baseline across all evaluated operating points. Although the performance gap is smaller in this dataset, SEED maintains stable detection performance even at the strictest operating point (FPR=10−4 ). 6.9
Effect of self labeling on detection performance Self labeling
Analyst labeling
1.0
0.5
Unseen-AUT (A)
APIGraph
0.5
AndroZoo
1.0
0.5
0.0
BODMAS 5%
10%
20%
Label Ratio (%)
30%
40%
Fig. 12. Comparing the detection performance (Unseen-AUT(A)) for self labeling and analysts labeling with varying labeled data ratio. A pronounced gap is observed on AndroZoo, BODMAS remains comparatively close, and APIGraph shows stable analyst performance while selflabeling degrades at higher ratios.
, Vol. 1, No. 1, Article . Publication date: May 2026.
In this subsection, we compare two labeling strategies for samples from unseen tasks: self-labeling, where the detector assigns labels and analyst labeling, where a security expert provides ground-truth annotations (see Figure 12). We focus on generalization of self-labeling strategy and report the using unseen-AUT(A) values, since this setting best reflects deployment-time robustness. Across datasets, the results show that increasing the amount of labeled data is not always sufficient and the quality of the labels can be the dominant factor. APIGraph. Analyst labeling remains both high and stable across all the labeled data ratios, consistently around 0.91–0.93 unseen-AUT(A), with only minor variation. Self-labeling, however, shows a clear degradation as the labeled data ratio increases. The unseen-AUT(A) value is 0.819 at 5%, becomes 0.861 at 10%, and then declines sharply to about 0.742 at 30% and roughly 0.658 at 40%, with larger variability at the highest labeled data ratio.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
33
AndroZoo. On AndroZoo, analyst labeling yields consistently strong unseen generalization across all labeled data ratios. In contrast, self-labeling remains low. Specifically, unseen-AUT(A) value is about 0.402 at 5% and only reaches roughly 0.421 at 10%, before dropping to around 0.362 by 40%. This creates a persistent gap of roughly 0.4–0.5 absolute points between the two strategies, indicating that self labeling disproportionately harms performance on truly unseen tasks. BODMAS. The performance of the two strategies are closer, and self-labeling is often competitive at lower labeled-data ratios. Unseen-AUT(A) under self-labeling rises from approximately 0.691 at 5% to about 0.782 at 40%, while analyst labeling increases from around 0.754 at 5% to roughly 0.821 at 40%. A small reversal is visible at 10% (self-labeling at ∼ 0.751 versus analyst labeling at ∼ 0.719), but from 20% onwards, analyst labeling consistently leads, with a modest but steady advantage. Overall, BODMAS appears relatively tolerant to self-labeling noise compared to the other datasets, although analyst-provided labels still deliver the best unseen-task performance at higher label ratios. 6.10
Effect of Distance Computation in Latent Space
In this section, we investigate how the choice of distance computation in the latent space affects detection performance under varying labeled data ratios. Specifically, we compare representing each class using a centroid against cosine distance computed against all labeled samples. Across datasets, the relative behavior between centroid and cosine distance varies depending on dataset characteristics and the amount of labeled data (see Figure 13). 1.0
Unseen-AUT (A)
0.8 0.6 0.4 0.2 0.0
BODMAS AndroZoo APIGraph
Centroid Distance All Samples Distance
5%
10%
20%
Label Ratio
30%
AndroZoo. Both strategies maintain consistently high performance across all labeled ratios. With 5% labeled data, the unseen AUT(A) exceeds 0.84 for both variants, with centroid distance producing 0.842 and the cosine distance strategy reaching 0.855. As the labeled ratio increases to 10%, the performance difference between the two approaches becomes minimal.
40%
Fig. 13. Comparing the detection performance (Unseen-AUT(A)) under centroid distance and allsamples distance strategies with varying labeled data ratios on BODMAS, AndroZoo, and APIGraph datasets. APIGraph consistently achieves the highest performance, while BODMAS and AndroZoo show gradual improvements as the labeled data ratio increases.
APIGraph. The APIGraph dataset demonstrates strong performance for both distance strategies even under limited labeled data. With only 5% labeled data, the centroid distance method achieves an unseen AUT(A) of 0.904, whereas the cosine distance method slightly improves this to 0.910. Increasing the labeled ratio leads to gradual improvements for both methods, reaching approximately 0.917 at 10% labeled data. When the labeled ratio increases further, the gap between the two strategies becomes negligible.
BODMAS. On BODMAS, with only 5% labeled data, the centroid distance method achieves an unseen AUT(A) of 0.766, slightly higher than the 0.754 obtained using cosine distance. Increasing the labeled ratio to 10% improves the centroid-based performance to 0.791, while the cosine-distancebased performance drops to 0.719. As the labeled data ratio grows, both approaches improve, although their relative ranking fluctuates slightly. For instance, at 20% labeled data, the cosine distance strategy reaches 0.810, exceeding the centroid score of 0.783, while at 30% and 40% labeled , Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 34 Channappayya
data the difference becomes subtle. Overall, the results indicate that summarizing each class using a centroid does not significantly improve generalization to unseen tasks. 6.11
Effect of SVD Threshold on Detection Performance
In this section, we analyze how varying the SVD threshold affects the unseen malware detection performance under different labeled data ratios. We compare SVD thresholds of 10%, 50%, and 95%, and focus on unseen-AUT(A) to understand how retaining principal components influences generalization to unseen tasks. The overall trend in the figure indicates that the 95% threshold consistently remains a strong and reliable choice across datasets (refer Figure 14). BODMAS. The effect of the SVD threshold is visible but relatively stable compared to the other datasets. At lower labeled-data ratios, the performance under 95% is already competitive, and at higher labeled-data ratios it becomes the strongest setting. For example, unseen-AUT(A) reaches 0.810 at 20% labeled data and 0.821 at 40% labeled data under the 95% threshold, which are the best results among the compared thresholds for those settings. Even in cases where 95% is not the absolute best, it remains very close to the top-performing configuration. This suggests that retaining a larger proportion of the latent structure is beneficial and does not introduce instability on BODMAS. AndroZoo. On AndroZoo, the benefit of using a higher SVD threshold is even more pronounced. The 1.0 50% threshold can lead to clear performance drops in some settings, whereas the 95% threshold consis0.5 tently restores strong unseen detection performance. APIGraph For instance, at 5% labeled data, unseen-AUT(A) in0.5 creases from 0.641 under 50% to 0.855 under 95%, and at 10% labeled data it rises from 0.541 to 0.859. Across AndroZoo 1.0 the remaining labeled-data ratios, the 95% threshold 0.5 either achieves the best result or remains very close to the best-performing setting. These observations BODMAS 0.0 10% 50% 95% SVD Threshold (%) indicate that a more conservative dimensionality reduction strategy is important for preserving disFig. 14. Comparing the detection performance criminative information on AndroZoo. 20% labeled data 30% labeled data
40% labeled data
Unseen-AUT (A)
5% labeled data 10% labeled data
(Unseen-AUT(A)) under varying SVD thresholds with different labeled data ratios on BODMAS, AndroZoo, and APIGraph datasets. Overall, the 95% SVD threshold consistently achieves competitive or superior performance across datasets, indicating that retaining a larger proportion of latent variance preserves discriminative information for unseen malware detection.
APIGraph. On APIGraph, all three thresholds yield strong performance, but the 95% threshold remains consistently competitive and often achieves the best or near-best result. For example, unseenAUT(A) reaches 0.917 at 10% labeled data, 0.930 at 20%, and 0.931 at 40% labeled data under the 95% threshold. Although the absolute differences across thresholds are smaller than those observed on AndroZoo, the results show that retaining 95% of the variance does not hurt performance and instead provides a stable operating point across all labeled-data ratios. Taken together with the results on BODMAS and AndroZoo, these trends support the use of a 95% SVD threshold as a generally good default choice for the proposed framework. , Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
6.12
35
Computational Overhead of SVD and GPM
In this section, we analyze the computational overhead introduced by the SVD and the GPM under different labeled-data ratios. Specifically, we measure the run time required for the SVD computation and the GPM update step across the APIGraph, AndroZoo, and BODMAS datasets. The results are summarized in Table 14. Across all datasets, the time required for SVD computation remains small and stable as the labeled data ratio increases. On APIGraph, the SVD computation takes approximately 4.80–5.10 seconds while the total training time ranges between 1290 and 1467 seconds, whereas on AndroZoo it varies from 10.63 to 13.16 seconds with total run time between 1189 and 1453 seconds. On BODMAS, the SVD overhead is even smaller, around 1.09–1.21 seconds compared to a total run time of 532–710 seconds. The GPM update introduces negligible overhead across all datasets, requiring only 0.17– 0.20 seconds on APIGraph, 0.30–0.41 seconds on AndroZoo, and 0.02–0.04 seconds on BODMAS. Overall, these results indicate that incorporating SVD and GPM adds minimal computational cost relative to the total training time. This demonstrates that the proposed framework remains computationally efficient and practical for real-world deployments. 6.13
Memory Overhead Analysis
We analyze the buffer memory reorganization overhead across datasets under varying labeled data ratios. Table 14 summarizes the reorganization time and the resulting buffer size for APIGraph, AndroZoo, and BODMAS. The results show that the memory footprint remains modest even when the memory grows with tasks. For instance, on AndroZoo the buffer memory stabilizes around 118– 130 MBytes with reorganization times between 29 and 38 seconds. In contrast, the requirements for BODMAS and APIGraph are significantly smaller, remaining around 14.5 MBytes and 8.5 MBytes respectively, with reorganization times below 1 second and around 3–4 seconds. Importantly, the buffer size changes only marginally as the labeled data ratio increases. These results indicate that the memory growth remains controlled in practice and the absolute memory requirement is small relative to modern system resources, demonstrating that the proposed framework remains practical even when the memory expands across tasks. Table 14. Runtime and memory overhead analysis across APIGraph, AndroZoo, and BODMAS with varying labeled data ratios. Buffer memory reorganization time corresponds to total memory population time, and memory size is reported in Mega Bytes (MBytes) Dataset
Label ratio
Buffer reorg. time (s)
Buffer size (MBytes) SVD time (s) GPM time (s) Total run time (s)
APIGraph
5% 10% 20% 30% 40%
3.2609 3.5565 3.6356 3.9652 3.8255
8.44 8.56 8.56 8.56 8.50
4.8047 4.8579 5.0114 5.1027 5.0134
0.1822 0.1933 0.1992 0.1715 0.1841
1454.7591 1345.0489 1290.6780 1455.4202 1467.6545
5% 10% AndroZoo 20% 30% 40%
29.1482 34.0686 36.8561 37.7255 37.1821
118.33 128.59 128.38 128.45 129.81
11.3073 10.6384 13.1620 12.7992 11.4308
0.3810 0.3636 0.3916 0.4120 0.3030
1356.7664 1189.8041 1283.7342 1322.1672 1453.0899
5% 10% 20% 30% 40%
0.3379 0.3509 0.3665 0.3338 0.3384
14.48 14.60 14.46 14.60 14.60
1.2069 1.1618 1.1728 1.0872 1.1490
0.0247 0.0285 0.0245 0.0287 0.0366
665.4773 532.4300 599.1412 568.9392 709.7778
BODMAS
, Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 36 Channappayya
7
Ablation study
In this section, we study the sensitivity of the proposed approach to various components. Specifically, we focus on three components namely buffer memory, GPM, and gradient direction of GPM. 7.1
Sensitivity to the buffer memory and GPM
Buffer memory is used to store and replay the training exemplars to restore the knowledge of previous tasks to improve plasticity. While, GPM helps to minimize the interference from preceding tasks, essential under the semi-supervised learning paradigm. Table 15. Ablation study demonstrating the sensitivity of the proposed method on various components including buffer memory and GPM. The best values are marked in bold. unseen-AUT (A) Memory
GPM
BODMAS
AndroZoo
API Graph
✗ ✓ ✗
✗ ✗ ✓
0.514 ± 0.040 0.585 ± 0.081 0.695 ± 0.052
0.533 ± 0.000 0.533 ± 0.000 0.533 ± 0.000
0.577 ± 0.065 0.554 ± 0.053 0.854 ± 0.053
✓
✓
0.810 ± 0.027
0.855 ± 0.018
0.930 ± 0.002
We compare the impact of each component on unseen-AUT (A) and the results are presented in Table 15. We made the following observations from these results. On all datasets, absence of both the components severely impacts the detection performance of the unseen malware samples. As a results, lowest unseen-AUT (A) is observed. GPM has a greater impact on detection performance than buffer memory on the BODMAS and APIGraph datasets. Table 16. Ablation study demonstrating the sensitivity of the proposed method in detecting unseen malware (unseen-AUT (A)) to the gradient directions in the GPM. The best values are marked in bold.
unseen-AUT (A)
7.2
Threshold
BODMAS
AndroZoo
API Graph
10% 50% 99%
0.802 ± 0.020 0.855 ± 0.018 0.930 ± 0.002 0.763 ± 0.054 0.831 ± 0.023 0.926 ± 0.003 0.810 ± 0.027 0.829 ± 0.039 0.901 ± 0.010
Sensitivity to the gradient directions in GPM
In this section, we study the sensitivity of the proposed method in detecting unseen malware (unseen-AUT (A)) to the gradient directions of past tasks (refer to Table 16). A higher threshold implies considering all the gradient directions of the past tasks. On the BODMAS dataset, detection performance improves as the threshold increases. Intuitively, this suggests that to enhance detection performance on the current task, the current gradient directions must be orthogonal to those of all past tasks to minimize interference. In contrast, detection performance decreases with increasing threshold on the APIGraph and AndroZoo datasets. This can be attributed to the data curation process and the inherent semantic structure of the dataset. Intuitively, in the presence of such semantic structure across successive tasks, it is sufficient to project the current gradient directions orthogonal to only a few of the past tasks’ gradient directions. Consequently, increasing the threshold degrades detection performance, , Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
37
as enforcing orthogonality to all gradient directions of all past tasks may disrupt the learning of the dataset’s inherent semantic structure. 8
Limitations
In this section, we describe the limitations of the proposed method from the design perspective and observations made during the empirical studies. Size of buffer memory: This work assumes growing memory size to store the partial labeled samples until the last seen task. However, there after the size grows steadily based on the labeling budget. Security of ML model: It is important to acknowledge that the developed model could potentially be used by adversaries to create more sophisticated malware. By publishing our findings, we aim to strike a balance between advancing defensive capabilities and mitigating the risk of misuse. Thus, addressing the issues such as adversarial attacks is not considered in this work. 9
Additional details about our proposed model
The model used in our experiment is composed of two subnetworks: encoder and classifier. The encoder first reduces the dimensionality to 100 and then progressively increases it to 250 and 500 before decreasing it to 150 and 50. Output after each layer is subjected to batchnorm, dropout (with ratio of 0.2) and a ReLU activation. Weights in the layers are initialized using Kaiming uniform method to improve the convergence of our model. The classifier consists of a simple linear layer that outputs 2 neurons with one neuron for each class (benign and malware). The model outputs raw logits from the classifier. The hyperparameters used in our method are the percentage of batch size that contains the samples from the memory (b_m), percentage of malware samples (bma) to be present in b_m, learning rate, weight decay, maximum threshold (𝜏), and analysts labels. We find the best hyperparameters using grid search method. The search space for b_m is 0.1 to 0.7, for bma 0.1 to 0.9, learning rate is {10−1, 10−2, 10−3, 10−4, 10−5 }, weight decay is {10−1, 10−2, 10−3, 10−4, 10−5, 10−6, 10−7, 10−8, 10−9 }, and 𝜏𝑚𝑎𝑥 is 0.1 to 0.3. The best hyperparameters for BODMAS datset are: b_m is 0.5, bma is 0.8, learning rate is 10−1 , weight decay is 10−9 , and 𝜏𝑚𝑎𝑥 is 0.09. For AndroZoo dataset, b_m is 0.3, bma is 0.4, learning rate is 10−2 , weight decay is 10−1 , and 𝜏𝑚𝑎𝑥 is 0.05. For APIGraph, b_m is 0.6, bma is 0.7, learning rate is 10−1 , weight decay is 10−4 , and 𝜏𝑚𝑎𝑥 is 0.05. 10
Details about baseline methods
10.0.1 HCL. For hierarchical contrastive learning, we use the same model as used by the original paper [14]. The model consists of an encoder that reduces the dimensions from input feature size to 512, 384, 256 and then finally to 128 and the classifier that has two hidden layers of 100 neurons each and finally a 2-neuron output layer. The model outputs normalized softmax probabilities. Output of each hidden layer is subjected to ReLU. The model is trained for 50 epochs with early stopping of patience 3 based on the PR-AUC value of the validation set. A batch size of 64 is used for all datasets with margin value set to 1 and 𝜆 to 100. Adam optimizer is used with default values and a grid search is conducted for finding the best learning rate and weight decay. The search space for best hyperparameters is {10−1, 10−2, 10−3, 10−4, 10−5, 10−6, 10−7 }. The best hyperparameters for the datasets found are as follows: For the API Graph, the learning rate is 0.0001 and the weight decay is 10−6 . For BODMAS, the learning rate remains 0.0001, with the weight decay adjusted to 10−7 . Lastly, for AndroZoo, the learning rate is configured as 10−5 and the weight decay is set to 10−5 . 10.0.2 CADE. For CADE, we use the same model architecture as introduced by the original paper which consists of 512-128-32-7 dimensions with ReLU after each layer except the last layers in , Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 38 Channappayya
both the encoder and decoder. We use a MLP with two hidden layers of 100 neurons that finally outputs two neurons as in the case of HCL. The auto encoder is trained using the same setup as previously discussed for hierarchical contrastive learning. The MLP is also trained with Adam Optimizer and has the same learning rate as the ones used in CADE. MLP is trained for 50 epochs with early stopping of patience 7 based on the PR-AUC value of the validation set. The search space for best hyperparameters is {10−1, 10−2, 10−3, 10−4, 10−5, 10−6, 10−7 }. The best hyperparameters for the datasets found are as follows: for the API Graph, the learning rate of 0.001 and the weight decay 10−7 gave the best results. For BODMAS, the learning rate is 0.01 with the weight decay adjusted to 10−7 . Lastly, for AndroZoo, the learning rate is set to 0.001 and the weight decay is set to 10−6 . 10.0.3 Continual learning baselines. We use AGEM and EWC continual learning methods provided by the avalanche library. In AGEM, we set the patterns_per_exp to 256, sample size of 64 and used a mini-batch size of 64 for training. In case of EWC, we set the regularization strength (ewc_lambda) to 0.4 and also used the same mini-batch size. While training on these methods we use the same optimizer and model as used in CADE and HCL. We implemented MIR and CBRS methods and for both we use a step scheduler with a gamma of 0.96 and early stopping with patience 3. We use SGD as our optimizer and do a grid search for learning rate and weight decay in the same space as before. The replay size is set to 1500 and memory size of 2000 for all datasets except for APIGraph in CBRS, where we use a replay size of 500 and a memory size of 1000, with minority allocation set to 0.8. The search space for best hyperparameters is {10−1, 10−2, 10−3, 10−4, 10−5, 10−6, 10−7 }. For MIR, the best hyperparameters for the APIGraph were when the learning rate was 0.01 and the weight decay was 0.01. Similarly, for BODMAS, the learning rate was found to be 0.001 and the weight decay was 10−6 . Lastly, for AndroZoo, the learning rate was 0.01 and the weight decay was 0.001. On CBRS, we found the final best hyperparameters for the APIGraph: a learning rate of 0.1 and a weight decay of 0.001. For BODMAS, the learning rate was 0.01 and the weight decay was 10−6 . Finally, for AndroZoo, the learning rate was 0.1 and the weight decay was 0.001. Similarly, for EWC, on the APIGraph dataset, the learning rate was 0.01 and the weight decay was 10−5 . On the BODMAS dataset, the learning rate was 0.1 with a weight decay of 10−7 . For AndroZoo, the learning rate was 0.01 and the weight decay was 10−5 . Lastly, for AGEM, on the APIGraph dataset, the learning rate was 0.01 and the weight decay was 10−6 . On the BODMAS dataset, the learning rate was 0.01 and the weight decay was 10−7 . Similarly, for AndroZoo, the learning rate was 0.01 with a weight decay of 10−7 . 11
Hardware and ML frameworks
Our experiments were carried out on a server equipped with 376 GB of memory, 104 cores (Intel(R) Xeon(R) Gold 6230R CPU @ 2.10 GHz), and 2 Nvidia Quadro RTX 5000 GPUs. We leverage the open-source continual learning library Avalanche (version 0.2.1) to implement baseline methods like EWC and A-GEM whereas other baselines like MIR, CBRS, and the proposed method are implemented using Pytorch version 1.13 with CUDA version V11.6.124. The python version is 3.8.13. 11.1
Ethics considerations
We utilized datasets stored as NPZ files at [14] containing numerical representations of preprocessed data. These files were provided ‘as-is,’ and we did not engage in any data extraction from malware or benign software packages ourselves. The files were devoid of any identifiable information, ensuring no sensitive data was present. , Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
39
It is important to acknowledge that the developed model could potentially be used by adversaries. However, these challenges are not unique to our research; they are common considerations in any new development within the field of malware detection. By publishing our findings, we aim to strike a balance between advancing defensive capabilities and minimizing the risk of misuse. Consequently, addressing issues such as adversarial attacks on the proposed method is beyond the scope of this work. We plan to explore adversarial robustness as part of our future work. 11.2
Reproducibility
The code and results are presented in an accessible way, allowing the research community to build upon them. The code repository is available at https://github.com/anonymouscode79/SSCL. For reproducibility of the reported results, first create a virtual environment using the requirements.txt file located in the GitHub repository. Ensure that the version numbers of the software packages match exactly. The following software versions were used: Python 3.8.13, PyTorch 1.13 with CUDA version V11.6.124, and the open-source continual learning library Avalanche version 0.2.1. After creating the environment, use the commands provided in configurations.md to reproduce the results. 12
Conclusions and Future Work
In this paper, we introduced a novel semi-supervised continual learning-based method designed to adapt to distribution shifts in both benign and malicious applications under limited labeled data. The proposed method constructs a representation space using basis vectors derived from the limited labeled data via singular value decomposition. This representation space is then used to rank the unlabeled data—which may contain novel malware and benign samples—based on their distance from the labeled data. The most challenging samples are selected for labeling according to the available labeling budget. In this way, we reformulated the problem of unsupervised malware detection as a semi-supervised learning task under a limited labeling budget. Our empirical evaluations on Android and Windows PE malware datasets demonstrated that the proposed approach achieved competitive results using only partially labeled data. We believe our work will inspire and encourage further research in this direction. As part of future work, we will focus on developing unsupervised anomaly detection methodologies for malware detection that are robust to distribution shifts, as such approaches effectively eliminate the need for human analysts to label novel malware families. Additionally, we believe our research has broader applicability in domains such as network intrusion detection, anomaly detection, fraud detection, among others. References [1] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. “Imagenet classification with deep convolutional neural networks”. In: in Proceedings of the Advances in Neural Information Processing Systems 25 (2012). [2] Ashish Vaswani et al. “Attention is All you Need”. In: Proceedings of the Advances in Neural Information Processing Systems. Vol. 30. 2017. [3] Kaspersky Lab Whitepaper Machine Learning. https://media.kaspersky.com/en/enterprisesecurity/KasperskyLab-Whitepaper-Machine-Learning.pdf. [4] Themida - Advanced Windows Software Protection. https://www.oreans.com/Themida.php. [5] CodeVirtualizer - Obfuscation System Against Reverse Engineering. https://www.oreans.com/ CodeVirtualizer.php. [6] Theo Chow et al. “Drift Forensics of Malware Classifiers”. In: Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec). 2023, pp. 197–207. , Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 40 Channappayya
[7] Lan-Zhe Guo et al. “Robust semi-supervised learning when not all classes have labels”. In: in Proceedings of the Advances in Neural Information Processing Systems 35 (2022), pp. 3305–3317. [8] Kaidi Cao, Maria Brbic, and Jure Leskovec. “Open-World Semi-Supervised Learning”. In: Proceedings of the International Conference on Learning Representations. 2022. url: https: //openreview.net/forum?id=O-r8LOR-CCA. [9] Liyuan Wang et al. “A comprehensive survey of continual learning: Theory, method and application”. In: IEEE Transactions on Pattern Analysis and Machine Intelligence (TPAMI) (2024), pp. 1–20. [10] David Lopez-Paz and Marc’Aurelio Ranzato. “Gradient episodic memory for continual learning”. In: Proceedings of 31st Conference on Advances in Neural Information Processing Systems (NeurIPS). Vol. 30. 2017, pp. 6470–6479. [11] Arslan Chaudhry et al. “Efficient lifelong learning with a-gem”. In: arXiv preprint arXiv:1812.00420 (2018). [12] Rahaf Aljundi et al. “Gradient based sample selection for online continual learning”. In: Proceeding of 33rd Conference on Neural Information Processing Systems (NeurIPS). Vol. 32. 2019. [13] Aristotelis Chrysakis and Marie-Francine Moens. “Online continual learning from imbalanced data”. In: Proceeding of 37th International Conference on Machine Learning (ICML). 2020, pp. 1952–1961. [14] Yizheng Chen, Zhoujie Ding, and David Wagner. “Continuous Learning for Android Malware Detection”. In: Proceedings of the 32nd USENIX Security Symposium (USENIX Security). Aug. 2023, pp. 1127–1144. [15] Limin Yang et al. “BODMAS: An open dataset for learning based temporal analysis of PE malware”. In: 2021 IEEE Security and Privacy Workshops (SPW). 2021, pp. 78–84. [16] Daniel Arp et al. “Drebin: Effective and explainable detection of android malware in your pocket.” In: Proceedings of the Network and Distributed Systems Security (NDSS) Symposium. Vol. 14. 2014, pp. 23–26. [17] Feargus Pendlebury et al. “TESSERACT : Eliminating experimental bias in malware classification across space and time”. In: Proceedings of the 28th USENIX Security Symposium (USENIX Security). 2019, pp. 729–746. [18] Limin Yang et al. “CADE: Detecting and explaining concept drift samples for security applications”. In: 30th USENIX Security Symposium (USENIX Security 21). 2021, pp. 2327–2344. [19] Xian Wu et al. “From grim reality to practical solution: Malware classification in real-world noise”. In: Proceedings of the IEEE Symposium on Security and Privacy (SP). 2023, pp. 2602– 2619. [20] Mohammad Saidur Rahman, Scott Coull, and Matthew Wright. “On the limitations of continual learning for malware classification”. In: Proceedings of the First Conference on Lifelong Learning Agents (CoLLAs). 2022, pp. 564–582. [21] Brad Miller et al. “Reviewer integration and performance measurement for malware detection”. In: Proceedings of the Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA). 2016, pp. 122–141. [22] Lisa Liu et al. “Error prevalence in nids datasets: A case study on cic-ids-2017 and cse-cicids-2018”. In: Proceedings of IEEE Conference on Communications and Network Security (CNS). 2022, pp. 254–262. [23] Xiaojin Zhu and Andrew B Goldberg. Introduction to semi-supervised learning. Springer Nature, 2022. [24] Roberto Jordaney et al. “Transcend: Detecting concept drift in malware classification models”. In: 26th USENIX security symposium (USENIX security 17). 2017, pp. 625–642. , Vol. 1, No. 1, Article . Publication date: May 2026.
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
41
[25] Dongqi Han et al. “Anomaly Detection in the Open World: Normality Shift Detection, Explanation, and Adaptation”. In: Proceeding of Network and Distributed System Security Symposium (NDSS). 2023. [26] Federico Barbero et al. “Transcending transcend: Revisiting malware classification in the presence of concept drift”. In: 2022 IEEE Symposium on Security and Privacy (SP). 2022, pp. 805–823. [27] Shuo Yang et al. “ReCDA: Concept Drift Adaptation with Representation Enhancement for Network Intrusion Detection”. In: Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 2024, pp. 3818–3828. [28] Saravanan Thirumuruganathan et al. “Detecting and Mitigating Sampling Bias in Cybersecurity with Unlabeled Data”. In: 33rd USENIX Security Symposium (USENIX Security 24). 2024, pp. 1741–1758. [29] Giuseppina Andresini et al. “Insomnia: Towards concept-drift robustness in network intrusion detection”. In: Proceedings of the 14th ACM Workshop on Artificial Intelligence and Security. 2021, pp. 111–122. [30] Ke Xu et al. “Droidevolver: Self-evolving android malware detection system”. In: 2019 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE. 2019, pp. 47–62. [31] Zeliang Kan et al. “Investigating labelless drift adaptation for malware detection”. In: Proceedings of the 14th ACM Workshop on Artificial Intelligence and Security. 2021, pp. 123– 134. [32] David Escudero García and Noemí DeCastro-García. “Application of Anomaly Detection Models to Malware Detection in the Presence of Concept Drift”. In: International Conference on Hybrid Artificial Intelligence Systems. Springer. 2023, pp. 15–26. [33] Jinsung Yoon et al. “Vime: Extending the success of self-and semi-supervised learning to tabular domain”. In: Advances in Neural Information Processing Systems 33 (2020), pp. 11033– 11043. [34] Giovanni Apruzzese, Aurore Fass, and Fabio Pierazzi. “When Adversarial Perturbations meet Concept Drift: an Exploratory Analysis on ML-NIDS”. In: The 17th ACM Workshop on Artificial Intelligence Security (AISec). 2024. [35] Alexis Lechat, Stéphane Herbin, and Frédéric Jurie. “Pseudo-Labeling for Class Incremental Learning”. In: Proceedings of the 32nd British Machine Vision Conference (BMVC). 2021. [36] Liyuan Wang et al. “Ordisco: Effective and efficient usage of incremental unlabeled data for semi-supervised continual learning”. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 2021, pp. 5383–5392. [37] Suresh K. Amalapuram, Bheemarjuna Tamma, and Sumohana S. Channappayya. “SPIDER: A Semi-Supervised Continual Learning-based Network Intrusion Detection System”. In: Proceedings of the 43rd IEEE Conference on Computer Communications (IEEE INFOCOM). 2024, pp. 571–580. [38] A. Krizhevsky. “Learning Multiple Layers of Features from Tiny Images”. In: Master’s Thesis, University of Toronto (2009). url: https://www.cs.utoronto.ca/~kriz/learning-features-2009TR.pdf. [39] Shudong Li et al. “Imbalanced malware family classification using multimodal fusion and weight self-learning”. In: IEEE Transactions on Intelligent Transportation Systems 24.7 (2022), pp. 7642–7652. [40] Xiaohan Zhang et al. “Enhancing state-of-the-art classifiers with api semantics to detect evolved android malware”. In: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. 2020, pp. 757–770. [41] AndroZoo. https://androzoo.uni.lu/.. , Vol. 1, No. 1, Article . Publication date: May 2026.
Suresh Kumar Amalapuram, Bikraj Shresta, Siva Ram Murthy Chebiyam, Bheemarjuna Reddy Tamma, and Sumohana 42 Channappayya
[42] H. S. Anderson and P. Roth. “EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models”. In: ArXiv e-prints (Apr. 2018). arXiv: 1804.04637 [cs.CR]. [43] Suresh Kumar Amalapuram, Sumohana S. Channappayya, and Bheemarjuna Tamma. “Augmented Memory Replay-based Continual Learning Approaches for Network Intrusion Detection”. In: Proceedings of 37th Conference on Neural Information Processing Systems (NeurIPS). Vol. 36. 2023. [44] Emanuele Francazi, Marco Baity-Jesi, and Aurelien Lucchi. “A theoretical analysis of the learning dynamics under class imbalance”. In: International Conference on Machine Learning. PMLR. 2023, pp. 10285–10322. [45] Jiangpeng He. “Gradient reweighting: Towards imbalanced class-incremental learning”. In: IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024, pp. 16668–16677. [46] Mehrdad Farajtabar et al. “Orthogonal gradient descent for continual learning”. In: Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics (AISTATS). 2020, pp. 3762–3773. [47] Gobinda Saha, Isha Garg, and Kaushik Roy. “Gradient Projection Memory for Continual Learning”. In: Proceedings of the International Conference on Learning Representations (ICLR). 2020. [48] Zhen Zhao et al. “Rethinking Gradient Projection Continual Learning: Stability/Plasticity Feature Space Decoupling”. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 2023, pp. 3718–3727. [49] Jingjing Wang et al. “Re-measuring the label dynamics of online anti-malware engines from millions of samples”. In: Proceedings of the 2023 ACM on Internet Measurement Conference. 2023, pp. 253–267. [50] Shuofei Zhu et al. “Measuring and Modeling the Label Dynamics of Online Anti-Malware Engines”. In: 29th USENIX Security Symposium (USENIX Security 20). USENIX Association, Aug. 2020, pp. 2361–2378. isbn: 978-1-939133-17-5. url: https://www.usenix.org/conference/ usenixsecurity20/presentation/zhu. [51] Marcus Botacin and Heitor Gomes. “Towards more realistic evaluations: The impact of label delays in malware detection pipelines”. In: Computers & Security 148 (2025), p. 104122. [52] James Kirkpatrick et al. “Overcoming catastrophic forgetting in neural networks”. In: National Academy of Sciences 114.13 (2017), pp. 3521–3526. [53] Rahaf Aljundi et al. “Online continual learning with maximal interfered retrieval”. In: Proceeding of 33rd Conference on Neural Information Processing Systems (NeurIPS). Vol. 32. 2019. [54] Daniel Arp et al. “Dos and don’ts of machine learning in computer security”. In: Proceeding of 31st USENIX Security Symposium (USENIX Security). 2022. [55] Marius Dragoi et al. “AnoShift: A distribution shift benchmark for unsupervised anomaly detection”. In: Proceeding of 36th Conference on Neural Information Processing Systems (NeurIPS). Vol. 35. 2022, pp. 32854–32867.
, Vol. 1, No. 1, Article . Publication date: May 2026.