Efficient Incremental Instance-based Learning Algorithms for Open World Malware Classification

Malware is growing rapidly in number and become more and more sophisticated. To prevent them we need to collect samples continuously and update them to the classifier. In this paper, we will propose a method to update new labeled samples of malware to the classifier easily without re-training everything. The classifier can be updated by both labeled malware samples of an existing class or a new class. Our method also has the ability to detect samples of unknown families. Experiments are performed over the traditional computer malware dataset and the IoT malware dataset. The results have shown that our method can reach the macro F1-score almost the same re-train everything but take significantly less time.