Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

FARM: Few-shot Adaptive Malware Family Classification under Concept Drift

Numan Halit Guldemir, Oluwafemi Olukoya, Jesús Martínez-del-Rincón

TL;DR

FARM addresses concept drift in Windows PE malware classification by combining a triplet autoencoder for discriminative latent embeddings with DBSCAN-based drift detection and a two-stage adaptation strategy that blends few-shot prototype-based inference with optional full retraining. The triplet autoencoder optimizes $L_{\\text{triplet}}$ and reconstruction loss $L_{\\text{MSE}}$, projecting samples into a latent space where clusters are defined around centroids $\\mu_i$ with per-cluster thresholds $\\tau_i$. Drift is detected unsupervisedly via DBSCAN, enabling rapid identification of drifted samples, which are buffered and used to form new prototypes without immediate retraining. Experiments on the BenchMFC subset show covariate drift improvements of about $5.6\\%$ in $F1$ and unseen-family $F1$ rising from $0.85$ with few-shot adaptation to $0.94$ after retraining, demonstrating robustness and practical utility.

Abstract

Malware classification models often face performance degradation due to concept drift, arising from evolving threat landscapes and the emergence of novel malware families. This paper presents FARM (Few-shot Adaptive Recognition of Malware), a framework designed to detect and adapt to both covariate and label drift in Windows Portable Executable (PE) malware classification. FARM leverages a triplet autoencoder to project samples into a discriminative latent space, enabling unsupervised drift detection via DBSCAN clustering and dynamic thresholding. For rapid adaptation, it employs few-shot learning using prototype-based classification, requiring only a handful of labeled samples. FARM also supports full retraining when enough drifted samples accumulate, updating the latent space for long-term integration. Experiments on the BenchMFC dataset demonstrate that FARM improves classification performance under covariate drift by 5.6\%, and achieves an average F1 score of 0.85 on unseen malware families using only few-shot adaptation, which further increases to 0.94 after retraining. These results highlight FARM's robustness and adaptability in dynamic malware detection environments under limited supervision.

FARM: Few-shot Adaptive Malware Family Classification under Concept Drift

TL;DR

FARM addresses concept drift in Windows PE malware classification by combining a triplet autoencoder for discriminative latent embeddings with DBSCAN-based drift detection and a two-stage adaptation strategy that blends few-shot prototype-based inference with optional full retraining. The triplet autoencoder optimizes and reconstruction loss , projecting samples into a latent space where clusters are defined around centroids with per-cluster thresholds . Drift is detected unsupervisedly via DBSCAN, enabling rapid identification of drifted samples, which are buffered and used to form new prototypes without immediate retraining. Experiments on the BenchMFC subset show covariate drift improvements of about in and unseen-family rising from with few-shot adaptation to after retraining, demonstrating robustness and practical utility.

Abstract

Malware classification models often face performance degradation due to concept drift, arising from evolving threat landscapes and the emergence of novel malware families. This paper presents FARM (Few-shot Adaptive Recognition of Malware), a framework designed to detect and adapt to both covariate and label drift in Windows Portable Executable (PE) malware classification. FARM leverages a triplet autoencoder to project samples into a discriminative latent space, enabling unsupervised drift detection via DBSCAN clustering and dynamic thresholding. For rapid adaptation, it employs few-shot learning using prototype-based classification, requiring only a handful of labeled samples. FARM also supports full retraining when enough drifted samples accumulate, updating the latent space for long-term integration. Experiments on the BenchMFC dataset demonstrate that FARM improves classification performance under covariate drift by 5.6\%, and achieves an average F1 score of 0.85 on unseen malware families using only few-shot adaptation, which further increases to 0.94 after retraining. These results highlight FARM's robustness and adaptability in dynamic malware detection environments under limited supervision.
Paper Structure (26 sections, 11 equations, 3 figures, 9 tables)

This paper contains 26 sections, 11 equations, 3 figures, 9 tables.

Table of Contents

  1. Introduction
  2. Related Works
  3. Concept Drift in Malware Detection
  4. Metric Learning
  5. Few-shot Adaptation
  6. Methodology
  7. Training phase
  8. Drift detection phase
  9. Drift adaptation phase
  10. Few-shot adaptation with prototype-based inference.
  11. Transition to full retraining.
  12. Evaluation and Experimental Setup
  13. Dataset Description
  14. Triplet Autoencoder Training
  15. DBSCAN Clustering and Thresholding Setup
  16. ...and 11 more sections

Figures (3)

  • Figure 1: FARM inference and adaptation pipeline. The system detects concept drift in real-time, buffers uncertain samples, and dynamically adapts using few-shot prototype generation to maintain classification performance.
  • Figure 2: Illustration of the clustering and thresholding process within FARM. After projection into the latent space by the triplet autoencoder, DBSCAN identifies dense regions representing clusters. For each cluster, a centroid (red cross) and a maximum intra-cluster distance are computed, forming a threshold boundary for classification and outlier rejection.
  • Figure 3: t-SNE visualizations of latent embeddings for vobfus and related families under three ablation configurations. Red ellipses highlight vobfus clusters. Left: model trained with zbot but excluding fareit. Middle: model trained with fareit but excluding zbot. Right: both fareit and zbot excluded.