.png){kind=icon}
Return
One step forward, two steps back: ML-based malware detection under concept drift
.png){kind=icon}
PRE
AI
DOI：10.1007/s00607-025-01543-7.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
The arms race between malware authors and detection frameworks is marked by continuous malware mutations and corresponding model retraining efforts. With over 1.5 million new samples reported daily (VirusTotal Statistics, 2025 https://www.virustotal.com/en/statistics/ ), retraining has become the de facto response to evolving threats. In this paper, we question the effectiveness of this approach by exposing key limitations: while retraining offers only marginal improvements in detecting malicious samples, it often degrades performance on benign samples. To address these challenges, we evaluate multiple retraining strategies that enable the timely detection of emerging malware families while tracking mutation patterns. Our analysis reveals that retraining can unintentionally aid adversaries by allowing the reuse of old malware samples, which online detectors often discard. Additionally, we uncover labeling inconsistencies−such as family renaming−across online detection engines, which obscure shared malicious capabilities and weaken family-based detection efforts.
Keywords:
Adversarial machine learning
Robust malware detection
Model drift
Journal
C
IF:
2.8
Papers:
2.3K
Citations:
3.5K
Organization
View more organizations
Cited Papers
.png){kind=icon}
ShareSave
ShareSaveShareSaveShareSave
ShareSaveShareSaveShareSave View more