Concept Drift Detection and Adaptive Retraining of Malware Classification Models
A research paper on arXiv (cs.AI) analyzes concept drift detection for malware classification models, comparing One-Class SVM, Minibatch K-Means, and Maximum Mean Discrepancy, and evaluates four learning models (Multilayer Perceptron, Random Forest, Support Vector Machines, eXtreme Gradient Boosting) under static, periodic, and drift-aware retraining scenarios.
The paper addresses performance degradation in malware classification due to concept drift, where attackers constantly modify malware. It compares a novel OCSVM-based drift detection approach with MK-Means and MMD, and tests four classifiers under three retraining scenarios: no retraining, periodic retraining, and drift-aware retraining triggered only when drift is detected.
The study suggests that drift-aware retraining can maintain model accuracy while reducing unnecessary retraining compared to periodic retraining. OCSVM and MK-Means are evaluated as automated drift detectors, with MMD as a statistical baseline. The effectiveness likely depends on the classifier and drift characteristics.
Adaptive retraining for malware classifiers is relevant for security vendors seeking to maintain detection efficacy against evolving threats without constant model updates, potentially reducing computational costs and improving response to new malware variants.
Drift-aware retraining could lower operational costs for security products by reducing unnecessary model updates while sustaining detection accuracy, offering a competitive advantage in the cybersecurity market.
Next signals include publication of experimental results comparing drift detection methods across classifiers, potential adoption of drift-aware retraining in commercial malware detection systems, and further research on real-time drift detection in production environments.