# MORPH: Towards Automated Concept Drift Adaptation for Malware Detection

arXiv: https://arxiv.org/abs/2401.12790 · HTML: https://mlsanity.com/paper/2401.12790/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- Builds on 19 of its 51 references that are in the map.
- First posted on arXiv 23 Jan 2024.

## Builds on (most cited first, 19 of 19)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [On Calibration of Modern Neural Networks](https://mlsanity.com/paper/1706.04599/) (2017)
- [FixMatch: Simplifying Semi-Supervised Learning with Consistency and Confidence](https://mlsanity.com/paper/2001.07685/) (2020)
- [A Survey of Deep Active Learning](https://mlsanity.com/paper/2009.00236/) (2020)
- [In Defense of Pseudo-Labeling: An Uncertainty-Aware Pseudo-label Selection Framework for Semi-Supervised Learning](https://mlsanity.com/paper/2101.06329/) (2021)
- [A Survey on Deep Semi-supervised Learning](https://mlsanity.com/paper/2103.00550/) (2021)
- [EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models](https://mlsanity.com/paper/1804.04637/) (2018)
- [Understanding Self-Training for Gradual Domain Adaptation](https://mlsanity.com/paper/2002.11361/) (2020)
- [An Overview of Deep Semi-Supervised Learning](https://mlsanity.com/paper/2006.05278/) (2020)
- [A Tutorial on Kernel Density Estimation and Recent Advances](https://mlsanity.com/paper/1704.03924/) (2017)
- [Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning](https://mlsanity.com/paper/1801.08917/) (2018)
- [Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Drift](https://mlsanity.com/paper/2010.03856/) (2020)
- [Continuous Learning for Android Malware Detection](https://mlsanity.com/paper/2302.04332/) (2023)
- [Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI](https://mlsanity.com/paper/2211.01753/) (2022)
- [On Training Robust PDF Malware Classifiers](https://mlsanity.com/paper/1904.03542/) (2019)
- [On the Limitations of Continual Learning for Malware Classification](https://mlsanity.com/paper/2208.06568/) (2022)
- [CyNER: A Python Library for Cybersecurity Named Entity Recognition](https://mlsanity.com/paper/2204.05754/) (2022)
- [Self-Supervised Vision Transformers for Malware Detection](https://mlsanity.com/paper/2208.07049/) (2022)
- [TINKER: A framework for Open source Cyberthreat Intelligence](https://mlsanity.com/paper/2102.05571/) (2021)

## Built on by (most cited first, 8 of 8)

- [Understanding Concept Drift with Deprecated Permissions in Android Malware Detection](https://mlsanity.com/paper/2507.22231/) (2025)
- [Empirical Evaluation of Concept Drift in ML-Based Android Malware Detection](https://mlsanity.com/paper/2507.22772/) (2025)
- [R+R: Revisiting Static Feature-Based Android Malware Detection using Machine Learning](https://mlsanity.com/paper/2409.07397/) (2024)
- [MADCAT: Combating Malware Detection Under Concept Drift with Test-Time Adaptation](https://mlsanity.com/paper/2505.18734/) (2025)
- [ADAPT: A Pseudo-labeling Approach to Combat Concept Drift in Malware Detection](https://mlsanity.com/paper/2507.08597/) (2025)
- [Label-efficient Training Updates for Malware Detection over Time](https://mlsanity.com/paper/2603.28396/) (2026)
- [Concept Drift Adaptation Using Self-Supervised and Reinforcement Learning In Android Malware Detection](https://mlsanity.com/paper/2605.24294/) (2026)
- [Concept Drift Detection and Adaptive Retraining of Malware Classification Models](https://mlsanity.com/paper/2608.13465/) (2026)

## Abstract (arXiv)

Concept drift is a significant challenge for malware detection, as the performance of trained machine learning models degrades over time, rendering them impractical. While prior research in malware concept drift adaptation has primarily focused on active learning, which involves selecting representative samples to update the model, self-training has emerged as a promising approach to mitigate concept drift. Self-training involves retraining the model using pseudo labels to adapt to shifting data distributions. In this research, we propose MORPH -- an effective pseudo-label-based concept drift adaptation method specifically designed for neural networks. Through extensive experimental analysis of Android and Windows malware datasets, we demonstrate the efficacy of our approach in mitigating the impact of concept drift. Our method offers the advantage of reducing annotation efforts when combined with active learning. Furthermore, our method significantly improves over existing works in automated concept drift adaptation for malware detection.