MADCAT: Combating Malware Detection Under Concept Drift with Test-Time Adaptation

2025-05-24

AI Summary

To address the persistent performance degradation of Android malware detectors caused by concept drift, this paper introduces test-time adaptation (TTA) to the domain for the first time, proposing a lightweight, unsupervised online adaptation method. Built upon an encoder-decoder architecture, the method performs self-supervised fine-tuning using only a small number of unlabeled test samples, dynamically optimizing feature representations during inference to simultaneously enhance discrimination against both historical and emerging malware. Its core innovation lies in mitigating concept drift without human annotation, with low computational overhead and real-time responsiveness. Experimental results on continual detection tasks demonstrate an average accuracy improvement of 7.2% over state-of-the-art baselines. Moreover, the method is orthogonal to existing drift-resilient techniques and can be seamlessly integrated with them.

Technology Category

• Machine Learning: Transfer, Domain Adaptation, Multi-Task Learning
• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

We present MADCAT, a self-supervised approach designed to address the concept drift problem in malware detection. MADCAT employs an encoder-decoder architecture and works by test-time training of the encoder on a small, balanced subset of the test-time data using a self-supervised objective. During test-time training, the model learns features that are useful for detecting both previously seen (old) data and newly arriving samples. We demonstrate the effectiveness of MADCAT in continuous Android malware detection settings. MADCAT consistently outperforms baseline methods in detection performance at test time. We also show the synergy between MADCAT and prior approaches in addressing concept drift in malware detection

Problem

• Addressing concept drift in malware detection
• Improving detection of old and new malware samples
• Enhancing continuous Android malware detection performance

Innovation

• Self-supervised test-time adaptation for malware detection
• Encoder-decoder architecture with test-time training
• Balanced subset learning for old and new samples