{"id":"https://openalex.org/W7147710165","doi":"https://doi.org/10.48550/arxiv.2603.28396","title":"Label-efficient Training Updates for Malware Detection over Time","display_name":"Label-efficient Training Updates for Malware Detection over Time","publication_year":2026,"publication_date":"2026-03-30","ids":{"openalex":"https://openalex.org/W7147710165","doi":"https://doi.org/10.48550/arxiv.2603.28396"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2603.28396","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.28396","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2603.28396","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5116820440","display_name":"Luca Minnei","orcid":null},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Minnei, Luca","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5064054982","display_name":"Cristian Manca","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Manca, Cristian","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060991055","display_name":"Giorgio Piras","orcid":"https://orcid.org/0000-0001-8225-6138"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Piras, Giorgio","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051213660","display_name":"Angelo Sotgiu","orcid":"https://orcid.org/0000-0003-2100-9517"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sotgiu, Angelo","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5115060116","display_name":"Maura Pintor","orcid":"https://orcid.org/0000-0003-3287-7352"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pintor, Maura","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120018639","display_name":"Daniele Ghiani","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ghiani, Daniele","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051452548","display_name":"Davide Maiorca","orcid":"https://orcid.org/0000-0003-2640-4663"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Maiorca, Davide","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075367917","display_name":"Giorgio Giacinto","orcid":"https://orcid.org/0000-0002-5759-3017"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Giacinto, Giorgio","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5008367647","display_name":"Battista Biggio","orcid":"https://orcid.org/0000-0001-7752-509X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Biggio, Battista","raw_affiliation_strings":[],"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":9,"corresponding_author_ids":["https://openalex.org/A5116820440"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9702000021934509,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9702000021934509,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":0.009800000116229057,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.0034000000450760126,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8758000135421753},{"id":"https://openalex.org/keywords/concept-drift","display_name":"Concept drift","score":0.8320000171661377},{"id":"https://openalex.org/keywords/detector","display_name":"Detector","score":0.4375},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.43529999256134033},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.42739999294281006},{"id":"https://openalex.org/keywords/cryptovirology","display_name":"Cryptovirology","score":0.4242999851703644},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4138999879360199},{"id":"https://openalex.org/keywords/retraining","display_name":"Retraining","score":0.3977999985218048},{"id":"https://openalex.org/keywords/software-inspection","display_name":"Software inspection","score":0.3849000036716461}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8758000135421753},{"id":"https://openalex.org/C60777511","wikidata":"https://www.wikidata.org/wiki/Q3045002","display_name":"Concept drift","level":3,"score":0.8320000171661377},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7982000112533569},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.542900025844574},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5123000144958496},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.4375},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.43529999256134033},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.42739999294281006},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.42669999599456787},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.4242999851703644},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4138999879360199},{"id":"https://openalex.org/C2778712577","wikidata":"https://www.wikidata.org/wiki/Q3505966","display_name":"Retraining","level":2,"score":0.3977999985218048},{"id":"https://openalex.org/C10272871","wikidata":"https://www.wikidata.org/wiki/Q929972","display_name":"Software inspection","level":5,"score":0.3849000036716461},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.3774000108242035},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.3725000023841858},{"id":"https://openalex.org/C86034646","wikidata":"https://www.wikidata.org/wiki/Q474311","display_name":"Semantic gap","level":4,"score":0.3677000105381012},{"id":"https://openalex.org/C112972136","wikidata":"https://www.wikidata.org/wiki/Q7595718","display_name":"Stability (learning theory)","level":2,"score":0.35350000858306885},{"id":"https://openalex.org/C71901391","wikidata":"https://www.wikidata.org/wiki/Q7126699","display_name":"Upload","level":2,"score":0.34310001134872437},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.32659998536109924},{"id":"https://openalex.org/C2776145971","wikidata":"https://www.wikidata.org/wiki/Q30673951","display_name":"Labeled data","level":2,"score":0.32010000944137573},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.310699999332428},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.3010999858379364},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.288100004196167},{"id":"https://openalex.org/C77967617","wikidata":"https://www.wikidata.org/wiki/Q4677561","display_name":"Active learning (machine learning)","level":2,"score":0.2802000045776367},{"id":"https://openalex.org/C2776321320","wikidata":"https://www.wikidata.org/wiki/Q857525","display_name":"Annotation","level":2,"score":0.2624000012874603},{"id":"https://openalex.org/C2778827112","wikidata":"https://www.wikidata.org/wiki/Q22245680","display_name":"Feature engineering","level":3,"score":0.25780001282691956},{"id":"https://openalex.org/C152124472","wikidata":"https://www.wikidata.org/wiki/Q1204361","display_name":"Redundancy (engineering)","level":2,"score":0.25119999051094055}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2603.28396","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.28396","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2603.28396","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.28396","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Machine":[0],"Learning":[1],"(ML)-based":[2],"detectors":[3,250],"are":[4,17,51,99],"becoming":[5],"essential":[6],"to":[7,20,45,102,108,136,184,194],"counter":[8],"the":[9,23,125,129,133,216,246],"proliferation":[10],"of":[11,26,132,156,226,248],"malware.":[12],"However,":[13],"common":[14],"ML":[15],"algorithms":[16],"not":[18],"designed":[19],"cope":[21],"with":[22,215],"dynamic":[24],"nature":[25],"real-world":[27],"settings,":[28],"where":[29],"both":[30,187],"legitimate":[31],"and":[32,77,90,106,117,158,162,166,229,235],"malicious":[33],"software":[34],"evolve.":[35],"This":[36],"distribution":[37,79,126,233],"drift":[38,80,204,234],"causes":[39],"models":[40],"trained":[41],"under":[42,232],"static":[43],"assumptions":[44],"degrade":[46],"over":[47,210,251],"time":[48],"unless":[49],"they":[50,237],"continuously":[52],"updated.":[53],"Regularly":[54],"retraining":[55],"these":[56,173],"models,":[57],"however,":[58],"is":[59],"expensive,":[60],"since":[61],"labeling":[62,75],"new":[63],"acquired":[64],"data":[65],"requires":[66],"costly":[67],"manual":[68,179],"analysis":[69,205],"by":[70,146,182],"security":[71],"experts.":[72],"To":[73],"reduce":[74,178],"costs":[76,181],"address":[78],"in":[81,114],"malware":[82,111,134,168],"detection,":[83],"prior":[84],"work":[85],"explored":[86],"active":[87],"learning":[88,92],"(AL)":[89],"semi-supervised":[91],"(SSL)":[93],"techniques.":[94],"Yet,":[95],"existing":[96],"studies":[97],"(i)":[98],"tightly":[100],"coupled":[101],"specific":[103,110],"detector":[104,217],"architectures":[105],"restricted":[107],"a":[109,120,148,200,223],"domain,":[112],"resulting":[113],"non-uniform":[115],"comparisons;":[116],"(ii)":[118],"lack":[119],"consistent":[121],"methodology":[122,201],"for":[123,164,202,245],"analyzing":[124],"drift,":[127],"despite":[128],"critical":[130],"sensitivity":[131],"domain":[135],"temporal":[137],"changes.":[138],"In":[139],"this":[140,144],"work,":[141],"we":[142],"bridge":[143],"gap":[145],"proposing":[147],"model-agnostic":[149],"framework":[150],"that":[151,172,206],"evaluates":[152],"an":[153],"extensive":[154],"set":[155],"AL":[157,228],"SSL":[159,230],"techniques,":[160,174],"isolated":[161],"combined,":[163,176,241],"Android":[165],"Windows":[167],"detection.":[169],"We":[170,197],"show":[171],"when":[175],"can":[177,238],"annotation":[180],"up":[183],"90%":[185],"across":[186],"domains":[188],"while":[189],"achieving":[190],"comparable":[191],"detection":[192],"performance":[193],"full-labeling":[195],"retraining.":[196],"also":[198],"introduce":[199],"feature-level":[203],"measures":[207],"feature":[208],"stability":[209],"time,":[211],"showing":[212],"its":[213],"correlation":[214],"performance.":[218],"Overall,":[219],"our":[220],"study":[221],"provides":[222],"detailed":[224],"understanding":[225],"how":[227,236],"behave":[231],"be":[239],"successfully":[240],"offering":[242],"practical":[243],"insights":[244],"design":[247],"effective":[249],"time.":[252]},"counts_by_year":[],"updated_date":"2026-04-02T13:53:19.096889","created_date":"2026-04-02T00:00:00"}