Label-Efficient Training Updates for Time-Varying Malware Detection

A model-agnostic framework systematically evaluates the individual and combined effects of active learning (AL) and semi-supervised learning (SSL) in Android and Windows malware detection. Results show that combining the two can reduce manual labeling cost by up to 90% on both platforms, while detection performance is comparable to retraining with full labels. The study also proposes a feature-level drift analysis method to measure the stability of features over time and demonstrates its correlation with detector performance.