Toward Never-Ending Learner for Malware Analysis (NELMA)

Malware or malicious software poses an increasing threat to sensitive data and network systems. With the advancement of technology and the omnipresence of internet connectivity and online services, this menace is getting more eminent every day. Malware developers are continually inventing new and better malware and are using different techniques to obfuscate their malcode. Therefore, it is imperative to have an efficient and self-sufficient malware detection system. Machine learning models are capable of producing highly accurate malware classifications. However, there is a growing number of unlabeled datasets that the models rely on for classification. In this paper, we use Semi-Supervised Learning models to detect malicious Android apps. We observe that co-training helps improve classifier performance. We focus our analysis on Android malware and try to determine a set of classifiers that, alone or combined, generate highly accurate predictions. Additionally, we incorporate malware sub-classes into co-training and observe the effect on classifier accuracy.