Concept Drift Detection and Adaptive Retraining of Malware Classification Models

2026-08-13

AI Summary

This study addresses the performance degradation of malware classification models caused by concept drift due to the continuous evolution of malicious software. To mitigate this issue, the authors propose an adaptive retraining mechanism that updates the model only when a distribution shift is detected, thereby balancing classification accuracy and training efficiency. The approach innovatively employs One-Class Support Vector Machine (OCSVM) for concept drift detection and compares its effectiveness against Minibatch K-Means and Maximum Mean Discrepancy (MMD). Experimental results demonstrate that OCSVM achieves classification accuracy comparable to periodic retraining while substantially reducing the number of retraining events. Overall, the proposed method offers a superior Pareto trade-off between accuracy and computational overhead compared to baseline approaches.

Abstract

Concept drift refers to changes over time in the statistical properties of data, as compared to the data that was used to train a learning model. Machine learning models for malware detection or classification are particularly susceptible to performance degradation caused by concept drift, as attackers constantly modify existing malware. In this chapter, we analyze two machine learning-based approaches to automated concept drift detection-a novel approach based on One-Class Support Vector Machines (OCSVM) and a previously-studied technique based on Minibatch K-Means (MK-Means). For comparison we also consider Maximum Mean Discrepancy (MMD), a statistical technique for detecting changes in multidimensional data. We conduct an extensive series of experiments comparing the effectiveness of four learning models, namely, Multilayer Perceptron, Random Forest, Support Vector Machines, and eXtreme Gradient Boosting. For each of these models, we consider three distinct scenarios: A static scenario where no model retraining occurs, a periodic scenario where models are constantly retrained irrespective of concept drift, and a drift-aware scenario where models are only retrained when concept drift is detected. Under the drift-aware scenario, we analyze the tradeoff between accuracy and training efficiency using Pareto Front analysis. We find that all three concept drift detection techniques achieve classification accuracy comparable to periodic retraining, while offering substantially greater efficiency in terms of the number of models that must be retrained. In addition, drift-aware retraining based on our OCSVM technique generally outperforms the MK-Means and MMD approaches. Overall, these results provide strong evidence that we can accurately detect concept drift in malware classification models.

Problem

• Concept Drift
• Malware Classification
• Model Retraining
• Performance Degradation
• Machine Learning

Innovation

• Concept Drift Detection
• One-Class SVM
• Adaptive Retraining
• Malware Classification
• Pareto Front Analysis