Addressing malware family concept drift with triplet autoencoder

Machine learning is increasingly vital in cybersecurity, especially in malware detection. However, the phenomenon known as concept drift, where the characteristics of malware change over time, presents a significant challenge for maintaining the efficacy of these detection systems. Concept drift can occur in two forms: the emergence of entirely new malware families and the evolution of existing ones. This paper proposes an innovative method to address the former, focusing on effectively identifying new malware families. Our approach leverages a supervised autoencoder combined with triplet loss to differentiate between known and new malware families. By utilizing this metric learning technique and the DBSCAN clustering algorithm, we create clear and robust clusters that enhance the accuracy and resilience of malware family classification. The effectiveness of our method is validated using an Android malware dataset (Drebin) and a Windows PE malware dataset (BODMAS), showcasing its capability to sustain model performance amidst the dynamic landscape of emerging malware threats. Our results demonstrate a significant improvement in detecting new malware families, offering a reliable solution for ongoing cybersecurity challenges.