mlsanityData to 14 Oct 2026

Reviewer Integration and Performance Measurement for Malware Detection

arXiv 1510.07338 ↗First posted 26 Oct 2015cs.CRcited by 19

Not on the map. Why?

Abstract (arXiv)

We present and evaluate a large-scale malware detection system integrating machine learning with expert reviewers, treating reviewers as a limited labeling resource. We demonstrate that even in small numbers, reviewers can vastly improve the system's ability to keep pace with evolving threats. We conduct our evaluation on a sample of VirusTotal submissions spanning 2.5 years and containing 1.1 million binaries with 778GB of raw feature data. Without reviewer assistance, we achieve 72% detection at a 0.5% false positive rate, performing comparable to the best vendors on VirusTotal. Given a budget of 80 accurate reviews daily, we improve detection to 89% and are able to detect 42% of malicious binaries undetected upon initial submission to VirusTotal. Additionally, we identify a previously unnoticed temporal inconsistency in the labeling of training datasets. We compare the impact of training labels obtained at the same time training data is first seen with training labels obtained months later. We find that using training labels obtained well after samples appear, and thus unavailable in practice for current training data, inflates measured detection by almost 20 percentage points. We release our cluster-based implementation, as well as a list of all hashes in our evaluation and 3% of our entire dataset.

Key facts. Cited by 19 papers in the map (data through 14 Oct 2026). First posted on arXiv 26 Oct 2015.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 2; 2022: 4; 2023: 5; 2024: 4; 2025: 3; 2026: 1.

19 papers.

Sort:

By area:

  1. 2023Continuous Learning for Android Malware Detectioncited by 33
  2. 2022The Role of Machine Learning in Cybersecuritycited by 22
  3. 2025LAMD: Context-driven Android Malware Detection and Classification with LLMscited by 18
  4. 2022SoK: The Impact of Unlabelled Data in Cyberthreat Detectioncited by 15
  5. 2021Learning Security Classifiers with Verified Global Robustness Propertiescited by 14
  6. 2023SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detectioncited by 13
  7. 2023Decoding the Secrets of Machine Learning in Malware Classification: A Deep Dive into Datasets, Feature Extraction, and Model Performancecited by 13
  8. 2024TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time (Extended Version)cited by 9
  9. 2022The Cross-evaluation of Machine Learning-based Network Intrusion Detection Systemscited by 8
  10. 2023MalProtect: Stateful Defense Against Adversarial Query Attacks in ML-based Malware Detectioncited by 8
  11. 2025DRMD: Deep Reinforcement Learning for Malware Detection under Concept Driftcited by 7
  12. 2022Towards a Fair Comparison and Realistic Evaluation Framework of Android Malware Detectors based on Static Analysis and Machine Learningcited by 6
7 more
  1. 2021Realizable Universal Adversarial Perturbations for Malwarecited by 5
  2. 2024Unraveling the Key of Machine Learning-based Android Malware Detectioncited by 4
  3. 2024MalMixer: Few-Shot Malware Classification with Retrieval-Augmented Semi-Supervised Learningcited by 3
  4. 2024On the Effectiveness of Adversarial Training on Malware Classifierscited by 1
  5. 2025ADAPT: A Pseudo-labeling Approach to Combat Concept Drift in Malware Detectioncited by 1
  6. 2023Effectiveness of Moving Target Defenses for Adversarial Attacks in ML-based Malware Detectioncited by 0
  7. 2026SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDgetcited by 0