# Cluster Analysis and Concept Drift Detection in Malware

arXiv: https://arxiv.org/abs/2502.14135 · HTML: https://mlsanity.com/paper/2502.14135/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 46 references that are in the map.
- First posted on arXiv 19 Feb 2025.

## Builds on (most cited first, 7 of 7)

- [Continuous Learning for Android Malware Detection](https://mlsanity.com/paper/2302.04332/) (2023)
- [Detecting Concept Drift With Neural Network Model Uncertainty](https://mlsanity.com/paper/2107.01873/) (2021)
- [Evolution and Detection of Polymorphic and Metamorphic Malwares: A Survey](https://mlsanity.com/paper/1406.7061/) (2014)
- [A Comparison of Adversarial Learning Techniques for Malware Detection](https://mlsanity.com/paper/2308.09958/) (2023)
- [Efficient Concept Drift Handling for Batch Android Malware Detection Models](https://mlsanity.com/paper/2309.09807/) (2023)
- [Word Embedding Techniques for Malware Evolution Detection](https://mlsanity.com/paper/2103.05759/) (2021)
- [Machine Learning for Malware Evolution Detection](https://mlsanity.com/paper/2107.01627/) (2021)

## Built on by (most cited first, 2 of 2)

- [Understanding Concept Drift with Deprecated Permissions in Android Malware Detection](https://mlsanity.com/paper/2507.22231/) (2025)
- [Concept Drift Detection and Adaptive Retraining of Malware Classification Models](https://mlsanity.com/paper/2608.13465/) (2026)

## Abstract (arXiv)

Concept drift refers to gradual or sudden changes in the properties of data that affect the accuracy of machine learning models. In this paper, we address the problem of concept drift detection in the malware domain. Specifically, we propose and analyze a clustering-based approach to detecting concept drift. Using a subset of the KronoDroid dataset, malware samples are partitioned into temporal batches and analyzed using MiniBatch K-Means clustering. The silhouette coefficient is used as a metric to identify points in time where concept drift has likely occurred. To verify our drift detection results, we train learning models under three realistic scenarios, which we refer to as static training, periodic retraining, and drift-aware retraining. In each scenario, we consider four supervised classifiers, namely, Multilayer Perceptron (MLP), Support Vector Machine (SVM), Random Forest, and XGBoost. Experimental results demonstrate that drift-aware retraining guided by silhouette coefficient thresholding achieves classification accuracy far superior to static models, and generally within 1% of periodic retraining, while also being far more efficient than periodic retraining. These results provide strong evidence that our clustering-based approach is effective at detecting concept drift, while also illustrating a highly practical and efficient fully automated approach to improved malware classification via concept drift detection.