{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2605-24903","title":"SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget","arxiv_id":"2605.24903","date":"2026-05-24","proceeding":null,"authors":["Suresh Kumar Amalapuram","Bikraj Shresta","Siva Ram murthy Chebiyam","Bheemarjuna Reddy Tamma","Sumohana S Channappayya"],"abstract":"Machine learning based malware detectors become obsolete over time due to concept drift in benign and malware applications. Recent methods rely on fully labeled data and use hierarchical contrastive loss (HCL) with active learning to improve robustness against drift by exploiting semantic structure in malware representations. However, obtaining labeled data in the security domain is difficult. Under partially labeled settings, HCL suffers significant performance degradation in detecting unseen malware, especially on datasets such as BODMAS where strong semantic structure may not exist. In this paper, we propose SEED, a semantic-structure-agnostic method for malware detection under limited supervision. SEED combines a tailored binary cross-entropy objective with semi-supervised continual learning and active learning. For partially labeled seen tasks, unlabeled samples are projected into a representation space constructed from previously seen data using singular value decomposition, and paired with suitable labeled samples to encourage representation consistency. For unseen tasks with fully unlabeled data, uncertainty is quantified using cosine distance in representation space, and the most uncertain samples are selected for analyst labeling. We evaluate SEED on both Windows and Android malware datasets. Using only 20% labeled data on seen tasks, SEED achieves average AUT improvements of 40% on BODMAS and 14% on AndroZoo for unseen malware detection compared to HCL* (the semi-supervised adaptation of HCL), while remaining competitive on APIGraph. Finally, we introduce a delayed buffer update strategy to reduce label noise propagation during replay and improve learning stability.","url_abs":"https://arxiv.org/abs/2605.24903","url_pdf":"https://arxiv.org/pdf/2605.24903","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2605.24903","atlas_url":"https://app.syntology.ai/?focus=2605.24903","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2605.24903"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/amalapuram/SEED","reach":null}],"summary":{"ran":3,"ran_fixture":4,"ran_honours":1,"ran_draft_wrong":2,"unverified":8},"by_repo_kind":{"found_in_text":{"samples":18,"ran":10,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":18,"samples":[{"code_sha256_prefix":"b9e78fc2652abe9c","entry":"GradientRejection","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b9e78fc2652abe9c"}},{"code_sha256_prefix":"54a4b3b27ed1a825","entry":"MarginLoss","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"54a4b3b27ed1a825"}},{"code_sha256_prefix":"c30c74eb0c6cd709","entry":"apply_soft_threshold","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c30c74eb0c6cd709"}},{"code_sha256_prefix":"d51001132cf6692e","entry":"dataset","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d51001132cf6692e"}},{"code_sha256_prefix":"383a3b1d318dae53","entry":"get_representation_matrix","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"383a3b1d318dae53"}},{"code_sha256_prefix":"5895aab0e2a9da35","entry":"get_uncertainity","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5895aab0e2a9da35"}},{"code_sha256_prefix":"50d75bdd6551a4af","entry":"major_representations","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"50d75bdd6551a4af"}},{"code_sha256_prefix":"baf2c5b8e692de6c","entry":"memory_update_equal_allocation2","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"baf2c5b8e692de6c"}},{"code_sha256_prefix":"95df9157322ab7a4","entry":"split_a_task","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"95df9157322ab7a4"}},{"code_sha256_prefix":"cb93a0fdd899743a","entry":"update_GPM","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cb93a0fdd899743a"}},{"code_sha256_prefix":"2ef1b1a0841f5f35","entry":"EarlyStopping","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2ef1b1a0841f5f35"}},{"code_sha256_prefix":"abf64df52e402e4a","entry":"entropy","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"abf64df52e402e4a"}},{"code_sha256_prefix":"a21355f526b3d367","entry":"initialize_buffermemory","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a21355f526b3d367"}},{"code_sha256_prefix":"31e75cedeb4c1c87","entry":"memory_update_equal_allocation","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"31e75cedeb4c1c87"}},{"code_sha256_prefix":"8fd864754802576b","entry":"memory_update_equal_allocation3","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8fd864754802576b"}},{"code_sha256_prefix":"86e2bd432f187c04","entry":"owl_data_labeling_strategy_const_labels2","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"86e2bd432f187c04"}},{"code_sha256_prefix":"677c7ee26c71d99e","entry":"sample_batch_from_memory","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"677c7ee26c71d99e"}},{"code_sha256_prefix":"e0030d15324d9552","entry":"train","repo":"amalapuram/SEED","repo_kind":"found_in_text","path":"SSCL.py","file_url":"https://github.com/amalapuram/SEED/blob/HEAD/SSCL.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e0030d15324d9552"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.LG","source":"arxiv_2026.jsonl"},"syntology_extracted_results":{"kind":"leaderboard_placements","source":"Syntology's leaderboard-shaped extractor over the paper's own arXiv-HTML tables: a model pointed at a cell, the number was read from that cell and checked against the board's metric, dataset, split and scale, and an independent check accepted the entry; not reviewed by the paper's authors or the archive's editors","extractor_model":"global.anthropic.claude-sonnet-4-5-20250929-v1:0","verifier_model":null,"prompt_sha":"fa63d4bb9d755694","coverage":{"sentence":"Syntology has checked 6,885 of the 9,623 papers on this site that are newer than the archive; results from the others appear after they are checked.","papers_newer_than_archive":9623,"papers_checked":6885},"entries":[],"not_placed":{"boards":0,"rejected_by_independent_check":0,"refused_by_a_rule":0,"check_did_not_answer":0,"proposed_without_a_cell":0,"declined_by_site":0}}}