Concept drift–resilient malware analysis in evolving threat environments

Abstract

Malware family classification is often developed under the assumption that the data distribution remains stable, although in practice malware evolves continuously through the modification of existing families and the emergence of new ones. This thesis investigates malware family classification as a deployed learning problem under concept drift and examines how drift affects model reliability over time, how it can be detected, how its effects can be mitigated, and how drifted behaviour can be explained. Through temporally ordered experiments, the thesis shows that models trained on historical malware can degrade substantially when applied to later samples, and that this degradation varies across malware families and time periods rather than appearing as a uniform decline. To detect such change, the thesis introduces a metric learning--based framework that models known family structure in a latent space and identifies samples that deviate from it. The thesis further develops an adaptive framework that combines drift detection with few-shot updates and conditional retraining. The results show that limited labelled evidence can recover part of the lost performance and support the incorporation of novel families, while longer-term retraining yields more stable improvement. The thesis also extends the analysis to drift understanding through Integrated Gradients--based feature attribution. Behavioural analysis is performed using capabilities identified by the CAPA tool and techniques from the MITRE ATT&CK framework. The results show that detected drift is often associated with identifiable feature changes and, in many cases, with observable behavioural divergence from the training distribution. Overall, the findings show that concept drift is a persistent and practically significant source of error in malware family classification. Reliable malware classification under temporal change depends not only on initial predictive performance, but also on evaluation that respects temporal ordering and continued mechanisms for drift detection, adaptation, and understanding.

Date of Award	Dec 2026
Original language	English
Awarding Institution	Queen's University Belfast
Sponsors	Republic of Türkiye Ministry of National Education
Supervisor	Oluwafemi Olukoya (Supervisor) & Jesus Martinez-del-Rincon (Supervisor)