Application of Transfer Learning to Online Models in Malware Detection
摘要
Machine learning is one of the main strategies applied to malware detection in the literature, since machine learning models are more adaptive than signature based solutions. One of the main challenges in the application of machine learning to malware detection is the presence of concept drift, which is a change in the data distribution over time caused by the evolving nature of malware; for example, the development of new malware families. To tackle drift, online models that can be dynamically updated are applied. However, labelled data is needed to keep the model up to date and reliable labels are expensive to obtain. In this paper, we study the effectiveness of the application of transfer learning to improve model performance in malware detection. Transfer learning is based on exploiting knowledge of related datasets to improve predictions in a target dataset, and requires no labels in the target. Therefore, it may help to improve predictions on new malware families by making use of past data. The results show that transfer learning algorithms provide inconsistent performance that, despite significant improvements in some cases, does not extend to different models or algorithms.