# SSCL-TransMD: Semi-Supervised Continual Learning Transformer for Malicious Software Detection
## 2 Related Work
In the case of considering only dynamic features, the detection rate of this method is 97.8%. When static features are added, the detection rate increases to 99.6%. In addition, the DL-Droid framework [16] compares detection performance and code coverage, and compares the performance of traditional machine learning classifiers, showing that this method outperforms machine learning-based methods. [PERSON] et al. [17] proposed a hybrid malware classification method using segmentation-based fractal texture analysis and deep convolutional neural network features. Android APKs are binarized into grayscale images generated using bytecode information. [PERSON] et al. [17] used the time-reversal backpropagation algorithm to train long short-term memory neural networks for detecting Android malware. Two different network topologies are used: a standard long short-term memory neural network with only one hidden layer and a stacked long short-term memory neural network with three hidden layers. High detection accuracy for Android malware is demonstrated in both static and dynamic analysis. DeepRefiner [18] uses long short-term memory neural networks to perform two-layer detection and verification of the semantic structure of Android bytecode. The accuracy of this method is 97.4%, with a false positive rate of 2.54%. Compared to traditional methods, this method has higher efficiency and accuracy. [PERSON] et al. [19] extracted vectorized opcodes from APKs' bytecode usingone-hot encoding to detect malware attributes. By performing experiments with recurrent neural networks, long short-term memory networks, neural networks, deep convolutional networks, and sparse autoencoder models, bi-directional long short-term memory neural networks were found to be the best model for this method. The AdMat [20] model uses a matrix-based convolutional neural network approach for detecting Android malware. This approach treats applications as features and views them as images. An adjacency matrix of the application has been constructed to improve data processing efficiency. This paper used convolutional neural network methods to analyze API sequence calls, opcodes, and permissions for the detection of Android malware in Zero-Day scenarios. [PERSON] et al. [21] used deep learning techniques to detect Android malware based on dynamic analysis of application activity sequences. The paper showed that analyzing a series of activities can provide information for detecting malware, but analyzing longer sequences does not necessarily result in more accurate models. In the real world, the number of malware instances is smaller than the number of harmless applications. The dataset in the paper contains over 180,000 samples, with two-thirds being malware. This dataset is significantly larger than other datasets used in previous research. The paper simulates real-world situations by randomly sampling a small portion of malware samples. Using the state-of-the-art BERT (Bidirectional Encoder Representations from Transformers) model, the paper demonstrates ideal malware detection performance in an extremely unbalanced dataset. Experimental results verify the effectiveness of this method in handling highly imbalanced datasets.