# SSCL-TransMD: Semi-Supervised Continual Learning Transformer for Malicious Software Detection
## 6 Conclusions  
With the advent of the smartphone era, the utilization of mobile phones has become increasingly widespread, which leads to the situation that smartphones have become the front line of cyberspace security. Unfortunately, with the evolution of malware detection methods, the malware itself is also incessantly upgrading. This has led to a precipitous decline in the detection rate of many deep learning-based malware detection systems when detecting unknown samples. Continuous learning is one of the solutions to this problem, but, in the process of continuous learning, deep learning models may experience a phenomenon of forgetting what they have already learned, known as catastrophic forgetting. Due to this challenging catastrophic issue of forgetting during model retraining, the field of malware detection still faces immense challenges.  
To address the catastrophic forgetting issue during the continuous updating process of malware models, building upon existing theoretical achievements, a malware detection model based on semi-supervised continuous learning (SSCL-TransMD) is proposed. The SSCL-TransMD model first adopts the lifelong unsupervised learning algorithm LUMP as the foundation and introduces modifications, mainly in the weight calculation method, to incorporate adaptive weight calculation. The improved LUMP algorithm is used to dynamically sample a mixture of labeled historical samples and unlabeled new input samples proportionally, thereby alleviating the adverse effects caused by sample imbalance. Furthermore, the LLGC semi-supervised algorithm is employed to iteratively compute similarity scores for the unlabeled samples in the mixture samples, obtaining pseudo-labels. Lastly, an MLP-based neural network is designed to classify malicious software and provide output results. Finally, we evaluated and examined the proposed method on dataset CICMalDroid2020. The results showed that our proposed method significantly outperforms other methods in continuous learning scenarios. More specifically, the deterioration rate of detection performance for the proposed method is significantly lower when facing the continuous input of new samples compared to other methods, which means that SSCL-TransMD can outperform other detection models when encountering unknown samples in a real-world network.  
Unfortunately, the detection accuracy of SSCL-TransMD is still not good enough in the scenario of supervised learning. In the future, we will place our attention on improving the detection accuracy.  
Conceptualization, L.K.; methodology, D.Z.; software, H.H.; validation, X.X.; formal analysis, S.G.; investigation, L.K.; resources, D.Z.; data curation, D.Z.; writing--original draft preparation, L.K.; writing--review and editing, L.K.; visualization, L.K.; supervision, L.W.; project administration, L.K.; funding acquisition,L.K. All authors have read and agreed to the published version of the manuscript.  
This paper has been supported by the Key Technology Research and Development Program of the Zhejiang Province under Grant 2022C01125 and the General Research Program of the Department of Education under Grant Y202044517.  
Not applicable.  
Data Availability Statement: The data is available at [[https://www.unb.ca/cic/datasets/maldroid-2020.html](https://www.unb.ca/cic/datasets/maldroid-2020.html)]([https://www.unb.ca/cic/datasets/maldroid-2020.html](https://www.unb.ca/cic/datasets/maldroid-2020.html)) (accessed on 8 October 2023).