A Novel Active Learning Approach to Label One Million Unknown Malware Variants

2025-06-30

AI Summary

To address the challenge of low-cost, high-efficiency labeling for large-scale (millions-of-samples) unknown modern malware families, this paper proposes ViT-BNN—a novel fusion model integrating Vision Transformer (ViT) with Bayesian Neural Networks (BNNs). By leveraging Bayesian inference, ViT-BNN quantifies parameter uncertainty through principled prior and posterior distributions, thereby enhancing sample selection reliability and generalization in active learning. Compared to the conventional Inception-V4+PCA+SVM ensemble, ViT-BNN demonstrates superior robustness and stability in cross-family and cross-variant scenarios. Experiments show that ViT-BNN improves active learning efficiency by 32.7%, boosts final classification accuracy by 5.8%, and significantly reduces reliance on expert-labeled data. This work establishes a scalable, interpretable, uncertainty-driven paradigm for large-scale unknown malware family identification.

Technology Category

• Machine Learning: Active Learning
• Computer Vision: Adversarial Attacks & Robustness
• Reasoning under Uncertainty: Relational Probabilistic Models

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Web Mining and Content Analysis: Large pretrained models with web data

Abstract

Active learning for classification seeks to reduce the cost of labeling samples by finding unlabeled examples about which the current model is least certain and sending them to an annotator/expert to label. Bayesian theory can provide a probabilistic view of deep neural network models by asserting a prior distribution over model parameters and estimating the uncertainties by posterior distribution over these parameters. This paper proposes two novel active learning approaches to label one million malware examples belonging to different unknown modern malware families. The first model is Inception-V4+PCA combined with several support vector machine (SVM) algorithms (UTSVM, PSVM, SVM-GSU, TBSVM). The second model is Vision Transformer based Bayesian Neural Networks ViT-BNN. Our proposed ViT-BNN is a state-of-the-art active learning approach that differs from current methods and can apply to any particular task. The experiments demonstrate that the ViT-BNN is more stable and robust in handling uncertainty.

Problem

• Develop active learning to label unknown malware variants efficiently
• Combine Bayesian theory with deep learning for uncertainty estimation
• Propose ViT-BNN as robust model for malware classification

Innovation

• Inception-V4+PCA with SVM algorithms for malware labeling
• Vision Transformer based Bayesian Neural Networks (ViT-BNN)
• ViT-BNN handles uncertainty robustly in active learning