arXiv Machine Learning
Jul 13
Regression-aware Continual Learning for Android Malware Detection
arXiv:2507. 18313v2 Announce Type: replace Abstract: Malware evolves rapidly, forcing machine learning-based detectors to be continuously updated.
Concept Drift Detection and Adaptive Retraining of Malware Classification Models
arXiv:2608. 13465v1 Announce Type: cross Abstract: Concept drift refers to changes over time in the statistical properties of data, as compared to the data that was used to train a learning model.
Related stories
arXiv Machine Learning
Jun 24
SEED: Semi-supervised Continual MalwarE Detection for Tackling ConcEpt Drift on a BuDget
arXiv:2605. 24903v2 Announce Type: replace-cross Abstract: Machine learning based malware detectors become obsolete over time due to concept drift in benign and malware applications.
arXiv AI
Jun 19
Learner-based Concept Drift Detection: Analysis and Evaluation
arXiv:2606. 20216v1 Announce Type: cross Abstract: Machine learning algorithms deployed for evolving streaming environments must handle the non-stationary data distributions, commonly referred to as concept drift.
arXiv Machine Learning
Sep 23
HYDRA: Proactive Android Malware Drift Adaptation via Hierarchical Graph Contrastive Learning
HYDRA is a proactive Android malware drift adaptation framework that learns drift‑invariant representations from hierarchically structured data. It combines fine‑grained Control Flow Graphs and coarse‑grained Function Call Graphs to model applications, then applies a cross‑domain contrastive learning objective to align historical and new data distributions. Experiments on large‑scale, time‑ordered malware datasets show HYDRA achieves lower false negative and false positive rates than state‑of‑the‑art baselines while needing up to 87.5% fewer labeled samples.
arXiv Machine Learning
Aug 5
On the Performance of Malware Detection Classifiers Using Hardware Performance Counters
arXiv:2608. 02671v1 Announce Type: cross Abstract: Malware detection using Hardware Performance Counters (HPC) has emerged as a promising solution to improve the security of computing systems as a complement to antivirus software.
arXiv Machine Learning
Sep 24
Enhancing Multiclass Malware Classification in Resource-Constrained Environments
The paper presents a lightweight machine‑learning approach for multi‑class malware detection on resource‑constrained devices. Using a LightGBM classifier with SMOTE oversampling, SOM‑US undersampling, and Genetic‑Algorithm feature selection, the authors achieve 89.1 % accuracy on four malware families and 76 % on 16 individual malware types. A second Random‑Forest model further improves family classification to 91.2 % and individual classification to 78.7 %.
arXiv Machine Learning
Jun 9
A Framework for Evaluating and Benchmarking Concept Drift Detection Methods
arXiv:2606. 07789v1 Announce Type: new Abstract: Data stream mining is fundamentally challenged by concept drift, where distributional changes can degrade model performance.
arXiv AI
Aug 25
Adapter-Based Few-Shot Continual Learning for Malicious Packet Recognition
The paper addresses the challenge of adapting malware detection systems to new threats without retraining from scratch, focusing on the Few-Shot Class-Incremental Learning (FSCIL) setting. It proposes a hybrid framework that uses a self-supervised learning backbone pre-trained on malware packets, incorporates Low-Rank Adaptation (LoRA) to adapt the model while preserving core representations, and employs a prototype-based classification head for incremental sessions. Experiments on multiple datasets show that this approach consistently outperforms existing FSCIL baselines and achieves state-of-the-art performance.
arXiv Machine Learning
Aug 5
NOMADD: Numerical Optimization of Models Adapting to Data Drift
arXiv:2608. 02845v1 Announce Type: new Abstract: Tabular model performance degrades when feature distributions change over time or the relationship between features and outcome variables change over time, known as data drift and concept drift, respectively.
arXiv AI
Jun 3
High-Precision APT Malware Attribution with Out-of-Scope Resilience
arXiv:2606. 03523v1 Announce Type: cross Abstract: Early attribution of Advanced Persistent Threat (APT) activity can help defenders prioritise investigation, select countermeasures, and reduce the impact of an intrusion.
arXiv Machine Learning
Jul 21
When Benchmarks Lie: Evaluating Malicious Prompt Classifiers Under True Distribution Shift
arXiv:2602. 14161v2 Announce Type: replace Abstract: Detecting prompt injection, jailbreak attacks, and harmful requests is critical for deploying LLM-based agents safely, yet current evaluation practices in this literature overestimate generalization.
arXiv AI
Aug 18
Retrofit: Continual Learning with Controlled Forgetting for Binary Security Detection and Analysis
arXiv:2511. 11439v3 Announce Type: replace-cross Abstract: Binary security has increasingly relied on deep learning to reason about malware behavior and program semantics.