# SSCL-TransMD: Semi-Supervised Continual Learning Transformer for Malicious Software Detection
## 2 Related Work  
Malware detection methods can be broadly classified into three categories: traditional malware detection methods, machine learning-based malware detection methods, and deep learning-based malware detection methods. In the following sections, each of these methods are discussed in detail. Traditional malware detection methods primarily rely on feature-based matching using unique features extracted from APK files within software [3]. These methods match the extracted features against a database of known malware features to determine whether the target software is malicious. If a match is found, the target software is classified as malware; otherwise, it is considered benign. One key limitation of this method is its dependency on a database of known malware features. As a result, it is easily affected when attackers use obfuscation techniques to alter the syntax of the software and modify the feature codes. While this method can detect malware through precise matching with known feature codes, it is unable to handle unknown malware [4]. Machine learning-based malware detection operates by first extracting various behavioral features from the sample under analysis [5]. These features are then represented as fixed-dimensional vectors. Finally, existing machine learning algorithms are used to train the classifier on labeled samples, enabling the prediction of the class for unknown samples. [PERSON], [PERSON], and [PERSON] [6] utilized features extracted from permissions, broadcast receivers, and APIs to apply support vector machine for detecting Android malware, achieving a classification accuracy of 98.55%. [PERSON], [PERSON], and [PERSON] [7] reviewed machine learning detectors and provided a detailed summary of the applications of naive Bayes, support vector machine, and deep neural networks in Android malware detection. [PERSON] et al. [8] compared random forest, K-nearest neighbor, and decision tree algorithms as classifiers for Android malware detection, employing the same selected features for training, testing, and evaluation in each machine learning algorithm. The K-nearest neighbor algorithm [9] operates as a supervised learning model that achieves the classification of Android malware by measuring the Euclidean distance between different feature values in the geometric space. K-means clustering algorithm [10], an unsupervised learning algorithm, is typically employed for family categorization of Android malware with the objective of finding centroids among N data points, thereby minimizing the mean square distance from each data point to its nearest centroid. [PERSON] et al. [11] aimed to improve the accuracy of Android malware detection by employing boosting and bagging. [PERSON] and [PERSON] [12] achieved improved accuracy in Android malware detection by combining multiple machine learning classifiers within ensemble learning. [PERSON] and [PERSON] [13] proposed a novel multi-level structured classifier fusion approach, training lower-level Android base classifiers to generate models and using a ranking algorithm to select the final classifier, then assigning weights to the prediction results of the selected classifier based on the prediction accuracy of higher-level base classifiers. However, due to the requirement for multiple detectors to analyze each APK file, the application of ensemble learning is computationally expensive. [PERSON] et al. [14] addressed this issue by employing deep reinforcement learning to automatically start and stop basic classifiers, dynamically determining whether sufficient information is available to classify a given APK file using a deep neural network. Deep learning is a machine learning method based on representation learning of data [15]. Deep learning techniques can integrate feature learning into the learning process of models, thereby reducing the defects caused by manually training features. The DL-Droid framework [16] proposes a new method for detecting Android malware using dynamic analysis techniques based on deep learning technology.