Deep Learning-Driven Malware Classification with API Call Sequence Analysis and Concept Drift Handling

2025-02-12

AI Summary

To address performance degradation in malware classification caused by concept drift in dynamic networks, this paper proposes an online adaptive deep learning framework that jointly models API call sequences and employs a genetic algorithm (GA) for continuous model evolution. Specifically, GA-based mutation operations and fitness evaluation are integrated directly into the deep model training pipeline, enabling real-time parameter adaptation; this is coupled with a lightweight concept drift detection and response mechanism to trigger timely model updates. Experiments on multi-period real-world malware datasets demonstrate that the proposed method achieves an average 12.7% improvement in classification accuracy and reduces model retraining frequency by 68%, significantly outperforming static deep models and conventional machine learning approaches. The framework exhibits enhanced robustness and adaptability against evolving malware, offering a principled solution for sustainable detection in non-stationary environments.

Technology Category

• Machine Learning: Life-Long and Continual Learning
• Multiagent Systems: Adversarial Agents
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Web Mining and Content Analysis: Models for Web evolution
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

Malware classification in dynamic environments presents a significant challenge due to concept drift, where the statistical properties of malware data evolve over time, complicating detection efforts. To address this issue, we propose a deep learning framework enhanced with a genetic algorithm to improve malware classification accuracy and adaptability. Our approach incorporates mutation operations and fitness score evaluations within genetic algorithms to continuously refine the deep learning model, ensuring robustness against evolving malware threats. Experimental results demonstrate that this hybrid method significantly enhances classification performance and adaptability, outperforming traditional static models. Our proposed approach offers a promising solution for real-time malware classification in ever-changing cybersecurity landscapes.

Problem

• Addressing concept drift in malware classification
• Enhancing accuracy with genetic algorithm integration
• Ensuring robustness against evolving malware threats

Innovation

• Deep learning with genetic algorithms
• API call sequence analysis
• Concept drift handling