Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Detecting and Explaining Malware Family Evolution Using Rule-Based Drift Analysis

Olha Jurečková, Martin Jureček

TL;DR

The paper tackles concept drift in evolving malware by introducing an interpretable drift-detection framework that uses a rule-based classifier (RIPPER) to describe original and evolved samples and a rule-set distance to quantify drift. By generating adversarial variants via MAB-malware and comparing the resulting rule sets, the method provides both drift detection and explicit explanations of which features and values have changed. Experiments on six malware families with EMBER/LIEF features demonstrate robust drift detection (overall accuracy $92.08\%$) and yield actionable insights into evolution patterns. This approach enhances detection robustness and analyst trust by translating drift into human-readable rules and highlightable feature changes.

Abstract

Malware detection and classification into families are critical tasks in cybersecurity, complicated by the continual evolution of malware to evade detection. This evolution introduces concept drift, in which the statistical properties of malware features change over time, reducing the effectiveness of static machine learning models. Understanding and explaining this drift is essential for maintaining robust and trustworthy malware detectors. In this paper, we propose an interpretable approach to concept drift detection. Our method uses a rule-based classifier to generate human-readable descriptions of both original and evolved malware samples belonging to the same malware family. By comparing the resulting rule sets using a similarity function, we can detect and quantify concept drift. Crucially, this comparison also identifies the specific features and feature values that have changed, providing clear explanations of how malware has evolved to bypass detection. Experimental results demonstrate that the proposed method not only accurately detects drift but also provides actionable insights into the behavior of evolving malware families, supporting both detection and threat analysis.

Detecting and Explaining Malware Family Evolution Using Rule-Based Drift Analysis

TL;DR

The paper tackles concept drift in evolving malware by introducing an interpretable drift-detection framework that uses a rule-based classifier (RIPPER) to describe original and evolved samples and a rule-set distance to quantify drift. By generating adversarial variants via MAB-malware and comparing the resulting rule sets, the method provides both drift detection and explicit explanations of which features and values have changed. Experiments on six malware families with EMBER/LIEF features demonstrate robust drift detection (overall accuracy ) and yield actionable insights into evolution patterns. This approach enhances detection robustness and analyst trust by translating drift into human-readable rules and highlightable feature changes.

Abstract

Malware detection and classification into families are critical tasks in cybersecurity, complicated by the continual evolution of malware to evade detection. This evolution introduces concept drift, in which the statistical properties of malware features change over time, reducing the effectiveness of static machine learning models. Understanding and explaining this drift is essential for maintaining robust and trustworthy malware detectors. In this paper, we propose an interpretable approach to concept drift detection. Our method uses a rule-based classifier to generate human-readable descriptions of both original and evolved malware samples belonging to the same malware family. By comparing the resulting rule sets using a similarity function, we can detect and quantify concept drift. Crucially, this comparison also identifies the specific features and feature values that have changed, providing clear explanations of how malware has evolved to bypass detection. Experimental results demonstrate that the proposed method not only accurately detects drift but also provides actionable insights into the behavior of evolving malware families, supporting both detection and threat analysis.
Paper Structure (11 sections, 4 equations, 2 figures, 2 tables)

This paper contains 11 sections, 4 equations, 2 figures, 2 tables.

Table of Contents

  1. INTRODUCTION
  2. Related Work
  3. Background
  4. Malware families
  5. Rule-Based Classification
  6. MAB-malware
  7. Proposed Approach: Detecting Concept Drift in Malware Families Using Rule-Based Classifiers
  8. EXPERIMENTS
  9. Experimental Setup
  10. Experimental Results
  11. CONCLUSIONS

Figures (2)

  • Figure 1: Overview of the proposed concept drift detection framework
  • Figure 2: The distances between rules that are calculated only within the original family (Original vs. original family), and the distances between rules that are calculated from the original family and the rules computed from the adversarial family (Adversarial vs. original family). The Decision rule corresponds to the arithmetic mean of these two distance values and serves as a threshold for determining the presence of concept drift.