[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83442-en":3,"doc-seo-83442-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},83442,1099513958607,"Jiven","https://ap-avatar.wpscdn.com/avatar/100002390cf8733938c?x-image-process=image/resize,m_fixed,w_180,h_180&k=1778829742770036399",8,"Research & Report","SemiScope Disentangling Classifier Tuning and Joint Optimization in Semi-Supervised Security Classification","Labeled data scarcity limits security classification systems, where semi-supervised learning (SSL) propagates labels from a small labeled pool to a larger unlabeled pool. The work targets a key black-box assumption: SSL pipelines are often tuned jointly without clarifying whether gains come from SSL settings, classifier hyperparameters, or decision-threshold handling. SemiScope is presented as an analysis instrument using Bayesian optimization and a tuned-classifier control, showing that classifier HPO can explain most improvements under equal budgets.","arXiv :2607 .00113v1 [ cs .LG] 30 Jun 2026  \nSemiScope: Disentangling Classifier Tuning and Joint Optimization in Semi-Supervised Security Classification  \nRui Shu  \nNorth Carolina State University  \nTianpei Xia  \nNorth Carolina State University  \nJingzhu He  \nShanghaiTech University  \n~~ Abstract  ~~Background. Labeled data for security classification is scarce. Semi-supervised learning (SSL) reduces this burden by propagating labels from a small labeled pool to larger unlabeled pools. Yet security applications often use SSL as a black box: default parameters, a fixed classifier, and no explicit handling of pseudo-label-induced class imbalance.  \nAims. Recent work reports sizeable gains from optimizing SSL pipelines through joint hyperparameter search, AutoML on pseudo-labeled data, or per-component tuning. These gains are hard to attribute. They may reflect useful joint SSL–classifier interactions, or they may mostly come from the simpler step of tuning the downstream classifier. We disentangle these effects for binary tabular security classification with classical SSL and tree-based classifiers.  \nMethod. We build SemiScope as an analysis instrument, not as a deployment recommendation. It uses Bayesian Optimization to jointly choose SSL settings, confidence filtering, oversampling, classifier family, and classifier hyperparameters. The key control is Tuned-Clf: it fixes SSL to defaults but receives the same 100-trial classifier search budget and the same validation-set decision-threshold tuning procedure as SemiScope. At 10% labels, we compare SemiScope and Tuned-Clf with paired TOST using a ±1 .0 g-measure smallest effect size of interest.  \nResults. SemiScope exceeds every default SSL baseline on all five datasets, improving over the strongest default baseline by 0.7–12.7 g-measure points, depending on the dataset. Under the equal-budget control, however, Tuned-Clf is statistically equivalent to the full joint pipeline on 4 out of 5 datasets, while Phishing is inconclusive. Classifier hyperparameter optimization (HPO) alone recovers a median 86% of SemiScope’s gain over Default Self-Training (ST) + Random Forest (RF) . With equal budgets and symmetric threshold tuning, little extra value remains.  \nConclusions. For these benchmarks, the reusable contribution is the decomposition protocol. Practically, a simpler recipe is sufficient: use Self-Training, tune the classifier with Bayesian Optimization, and tune the decision threshold on validation data. This recipe reaches within 1 g-measure of the Supervised RF reference at 20–30% labels on four datasets and at 40% labels on Drebin, at the same or lower label rate than Default ST + RF in every dataset.  \n2012 ACM Subject Classification Security and privacy → Intrusion detection systems; Computing methodologies → Semi-supervised learning settings  \nKeywords and phrases Semi-Supervised Learning, Hyperparameter Optimization, Security Classification, Data Imbalance, Empirical Software Engineering  \nDigital Object Identifier 10.4230/LIPIcs...  \n 1  Introduction  \nSecurity practitioners increasingly rely on machine learning to detect threats such as spam, malware [35], and network intrusions [29] . The bottleneck is reliable labels: security labeling  \n© Rui Shu, Tianpei Xia and Jingzhu He;  \nlicensed under Creative Commons License CC-BY 4 .0  \nLeibniz International Proceedings in Informatics  \nSchloss Dagstuhl – Leibniz-Zentrum für Informatik, Dagstuhl Publishing, Germany  \nXX:2 SemiScope: Disentangling Classifier Tuning and Joint Optimization  \nrequires domain expertise, manual investigation, and threat taxonomy judgment [37] . Meanwhile, organizations collect large volumes of unlabeled security data, including network flows, URLs, and app manifests [31, 22, 6] .  \nSemi-supervised learning (SSL) addresses this bottleneck by propagating labels from a small labeled pool to a large unlabeled pool [45] . SSL has been applied to insider threat detection [20], malware classification [","cbCaidzvmZPGHrMO","https://ap.wps.com/l/cbCaidzvmZPGHrMO","pdf",3298454,3,1,20,"English","en",105,"# Introduction\n## Motivation and Problem Setting\n## Central Question and Confounds","[{\"question\":\"What problem does SemiScope address in semi-supervised security classification?\",\"answer\":\"It addresses the unclear source of performance gains when SSL pipelines are treated as black boxes, especially whether improvements come from joint SSL–classifier interactions or simpler downstream classifier tuning and threshold handling.\"},{\"question\":\"How does SemiScope separate the effect of SSL tuning from classifier tuning?\",\"answer\":\"It introduces the Tuned-Clf control that keeps SSL at default settings while using the same classifier search budget and the same validation-set decision-threshold tuning procedure as the full joint pipeline.\"},{\"question\":\"What is the practical takeaway from the experiments?\",\"answer\":\"A simpler recipe can be sufficient: use Self-Training, perform Bayesian optimization for the classifier, and tune the decision threshold on validation data, reaching near-supervised reference performance on multiple datasets under comparable label rates.\"}]",1784187784,50,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"semiscope-disentangling-classifier-tuning-and-joint-optimization-in-semi-supervised-security-classification","",{"@graph":36,"@context":85},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,50],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":20},"https://docshare.wps.com/document/research-report/",{"item":51,"name":13,"@type":43,"position":52},"https://docshare.wps.com/document/semiscope-disentangling-classifier-tuning-and-joint-optimization-in-semi-supervised-security-classification/83442/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-24","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does SemiScope address in semi-supervised security classification?","Question",{"text":75,"@type":76},"It addresses the unclear source of performance gains when SSL pipelines are treated as black boxes, especially whether improvements come from joint SSL–classifier interactions or simpler downstream classifier tuning and threshold handling.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does SemiScope separate the effect of SSL tuning from classifier tuning?",{"text":80,"@type":76},"It introduces the Tuned-Clf control that keeps SSL at default settings while using the same classifier search budget and the same validation-set decision-threshold tuning procedure as the full joint pipeline.",{"name":82,"@type":73,"acceptedAnswer":83},"What is the practical takeaway from the experiments?",{"text":84,"@type":76},"A simpler recipe can be sufficient: use Self-Training, perform Bayesian optimization for the classifier, and tune the decision threshold on validation data, reaching near-supervised reference performance on multiple datasets under comparable label rates.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":92},[93,97,101,105,110,114,119,122,126,129,133],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":29,"slug":113},6,"Technology","technology",{"id":115,"doc_module":4,"doc_module_name":46,"category_name":116,"show_sort_weight":117,"slug":118},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":46,"category_name":124,"show_sort_weight":22,"slug":125},9,"Religion & Spirituality","religion-spirituality",{"id":22,"doc_module":4,"doc_module_name":46,"category_name":127,"show_sort_weight":22,"slug":128},"World Cup","world-cup",{"id":130,"doc_module":4,"doc_module_name":46,"category_name":131,"show_sort_weight":130,"slug":132},10,"Lifestyle","lifestyle",{"id":134,"doc_module":4,"doc_module_name":46,"category_name":135,"show_sort_weight":106,"slug":136},19,"General","general"]