# Machine Learning for Malware Evolution Detection

arXiv: https://arxiv.org/abs/2107.01627 · HTML: https://mlsanity.com/paper/2107.01627/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 3 of its 41 references that are in the map.
- First posted on arXiv 4 Jul 2021.

## Builds on (most cited first, 3 of 3)

- [Efficient Estimation of Word Representations in Vector Space](https://mlsanity.com/paper/1301.3781/) (2013)
- [Distributed Representations of Words and Phrases and their Compositionality](https://mlsanity.com/paper/1310.4546/) (2013)
- [Word Embedding Techniques for Malware Evolution Detection](https://mlsanity.com/paper/2103.05759/) (2021)

## Built on by (most cited first, 2 of 2)

- [Cluster Analysis and Concept Drift Detection in Malware](https://mlsanity.com/paper/2502.14135/) (2025)
- [Concept Drift Detection and Adaptive Retraining of Malware Classification Models](https://mlsanity.com/paper/2608.13465/) (2026)

## Abstract (arXiv)

Malware evolves over time and antivirus must adapt to such evolution. Hence, it is critical to detect those points in time where malware has evolved so that appropriate countermeasures can be undertaken. In this research, we perform a variety of experiments on a significant number of malware families to determine when malware evolution is likely to have occurred. All of the evolution detection techniques that we consider are based on machine learning and can be fully automated -- in particular, no reverse engineering or other labor-intensive manual analysis is required. Specifically, we consider analysis based on hidden Markov models (HMM) and the word embedding techniques HMM2Vec and Word2Vec.