Harnessing Open-World Machine Learning for Advanced Malware Detection: A Survey
摘要
The ever-changing threat landscape of malware keeps it at the forefront of cybersecurity research. As attackers develop new strains and techniques, researchers continuously work to improve detection methods. This necessitates robust malware classification systems that can not only differentiate between known malware types but also identify entirely new ones. Traditional machine learning approaches, such as static and dynamic analysis, signature-based detection, and classifiers like support vector machines (SVMs), k-nearest neighbors (kNNs), and artificial neural networks (ANNs), have been widely used. These methods rely on closed-world learning, assuming all possible classes are present during training. While this works in many scenarios, it falls short in dynamic and evolving environments. The key limitation of these traditional models is their inability to recognize unseen classes—those not encountered during training. This is where open-world machine learning comes in. Open-world learnings empowers systems to adapt to new information, similar to human learning. By enabling the system to recognize and learn from novel threats encountered during operation, open-world machine learning offers a more robust approach to malware classification in the ever-changing real world.