# Revisiting Concept Drift in Windows Malware Detection: Adaptation to Real Drifted Malware with Minimal Samples

arXiv: https://arxiv.org/abs/2407.13918 · HTML: https://mlsanity.com/paper/2407.13918/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 18 Jul 2024.

## Built on by (most cited first, 11 of 11)

- [TIF: Learning Temporal Invariance in Android Malware Detectors](https://mlsanity.com/paper/2502.05098/) (2025)
- [Understanding Concept Drift with Deprecated Permissions in Android Malware Detection](https://mlsanity.com/paper/2507.22231/) (2025)
- [MADCAT: Combating Malware Detection Under Concept Drift with Test-Time Adaptation](https://mlsanity.com/paper/2505.18734/) (2025)
- [Trident: Improving Malware Detection with LLMs and Behavioral Features](https://mlsanity.com/paper/2605.00297/) (2026)
- [Adversarial Evasion in Non-Stationary Malware Detection: Minimizing Drift Signals through Similarity-Constrained Perturbations](https://mlsanity.com/paper/2604.21310/) (2026)
- [SoK: AI-Augmented Binary Reversing](https://mlsanity.com/paper/2606.17398/) (2026)
- [SMETA-ZSL:Semantic Meta-Alignment for Zero-Shot Threat Classification](https://mlsanity.com/paper/2607.09936/) (2026)
- [Concept Drift Detection and Adaptive Retraining of Malware Classification Models](https://mlsanity.com/paper/2608.13465/) (2026)
- [Maintaining IoT Device Identification under Concept Drift via Budget-Aware Traffic Labeling](https://mlsanity.com/paper/2608.15465/) (2026)
- [REPLICANT: Learning Policies for Evading and Hardening Malware Detectors](https://mlsanity.com/paper/2608.28499/) (2026)
- [HYDRA: Proactive Android Malware Drift Adaptation via Hierarchical Graph Contrastive Learning](https://mlsanity.com/paper/2609.26352/) (2026)

## Abstract (arXiv)

In applying deep learning for malware classification, it is crucial to account for the prevalence of malware evolution, which can cause trained classifiers to fail on drifted malware. Existing solutions to address concept drift use active learning. They select new samples for analysts to label and then retrain the classifier with the new labels. Our key finding is that the current retraining techniques do not achieve optimal results. These techniques overlook that updating the model with scarce drifted samples requires learning features that remain consistent across pre-drift and post-drift data. The model should thus be able to disregard specific features that, while beneficial for the classification of pre-drift data, are absent in post-drift data, thereby preventing prediction degradation. In this paper, we propose a new technique for detecting and classifying drifted malware that learns drift-invariant features in malware control flow graphs by leveraging graph neural networks with adversarial domain adaptation. We compare it with existing model retraining methods in active learning-based malware detection systems and other domain adaptation techniques from the vision domain. Our approach significantly improves drifted malware detection on publicly available benchmarks and real-world malware databases reported daily by security companies in 2024. We also tested our approach in predicting multiple malware families drifted over time. A thorough evaluation shows that our approach outperforms the state-of-the-art approaches.