Pith. sign in

REVIEW 3 major objections 6 minor 60 references

Concept Drift Detection and Adaptive Retraining of Malware Classification Models

T0 review · 3 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that malware classifiers can be retrained only when concept drift is detected, matching periodic retraining accuracy while substantially reducing the number of models that need to be trained.

desk verdict A well-documented comparative study of drift detectors for malware, but the headline numbers are in-sample upper bounds because both classifier and detector thresholds are tuned on the test batches; the claims need temporal hold-out validation before they can be taken at face value. read the letter →

arxiv 2608.13465 v1 pith:J3JOJXAR submitted 2026-08-13 cs.LG cs.AIcs.CR

Christofer Washington Berruz Chungata , Martin Jurecek , Katerina Potika , William B. Andreopoulos , Mark Stamp This is my paper · ORCID
classification cs.LGcs.AIcs.CR
keywords ConceptDriftMalwareOne-ClassSupportVectorMachinesOCSVMMaximumMeanDiscrepancyMMDMK-MeansParetoFront
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This chapter tries to establish that concept drift in malware classification can be caught automatically, and that retraining a classifier only at detected drift points is a practical replacement for retraining it on every batch. The authors introduce an OCSVM drift detector based on the outlier-to-inlier ratio, compare it with MK-Means silhouette changes and MMD two-sample tests, and test all three across four classifiers and 20 malware family pairs. The headline results are that drift-aware retraining matches periodic retraining accuracy within a few percent while requiring far fewer model retrains, and that the OCSVM detector generally gives the best accuracy-efficiency combination. The paper also provides a Pareto-front procedure for choosing drift-detector thresholds that makes the accuracy-versus-efficiency tradeoff explicit.

What carries the argument

The central mechanism is a thresholded drift signal computed from successive temporal batches of malware samples. For OCSVM, a One-Class SVM trained on the first batch measures the ratio $r = n_{\mathrm{outliers}}/n_{\mathrm{inliers}}$ on each later batch; for MK-Means, the signal is the change in average silhouette coefficient of a minibatch clustering; for MMD, it is a kernel two-sample test $p$-value. A threshold exceedance marks the batch as a drift point and triggers retraining of the classifier, and Pareto-front analysis in the accuracy-efficiency plane selects the threshold.

What would settle it

Take the same 20 family pairs but hold out the most recent temporal batches: tune thresholds and hyperparameters only on earlier batches, then compare drift-aware, periodic, and static accuracy on the held-out batches. If drift-aware accuracy falls substantially below periodic, or OCSVM no longer beats MMD, the claimed tradeoff does not generalize to unseen future batches.

Watch

Extended reading notes

Core claim

The central discovery is that the outlier-to-inlier ratio of a One-Class SVM trained on the first temporal batch is a workable drift signal for malware data: when the ratio on a later batch differs from the initial value by more than a threshold, the data distribution has shifted enough that retraining the classifier pays off. Under this drift-aware policy, accuracy stays within a few percent of the periodic retraining baseline while the number of trained models drops by about 70 percent in the median configuration. The same retraining policy works with MK-Means and MMD as the drift signal, but OCSVM generally dominates on accuracy and detector runtime and is roughly tied with MMD on efficiency.

Load-bearing premise

The results assume that tuning detector thresholds and classifier hyperparameters on the very test batches used for the reported accuracies does not artificially inflate drift-aware performance relative to periodic retraining.

Editorial extensions

If this is right

  • Deployed malware classifiers can switch from periodic retraining to drift-triggered retraining and keep accuracy close to the periodic baseline while training far fewer models.
  • The OCSVM detector is the best overall choice among the three tested: it generally leads in drift-aware accuracy, matches MMD in retraining efficiency, and requires the least time to run per batch.
  • Pareto-front hyperparameter selection gives an operator an explicit knob: choose a point on the accuracy-efficiency tradeoff curve rather than tuning thresholds by hand.
  • The drift-aware scenario improves over the static model by a substantial margin for every classifier tested, so even a rough drift detector beats ignoring drift.
  • The similar results across MK-Means and OCSVM with a much smaller hyperparameter search space suggests the detector configuration can be simplified in practice.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: OCSVM may win because it flags only distributional changes that affect the classifier's decision boundary, while MMD flags any statistical shift; this would explain why the simpler machine-learning detector beats the statistical test on downstream accuracy.
  • Editorial inference: the test-set-based tuning of both classifier hyperparameters and detector thresholds means the reported gap to periodic retraining is an oracle-style upper bound; a deployment protocol that selects thresholds on validation data could show a larger gap on truly unseen future batches.
  • Editorial inference: a natural extension is to make the batch window adaptive, since the paper fixes it at 50 samples and notes that smaller windows detect drift sooner but add noise; an LSTM could learn the window size end-to-end.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper studies concept drift detection for malware classification models, comparing three detectors (OCSVM, MK-Means, and MMD) under static, periodic, and drift-aware retraining scenarios. It uses the KronoDroid dataset, five malware families, 20 family-pair classification tasks, and four classifiers (MLP, RF, SVM, XGB). Drift-aware detector hyperparameters are selected via Pareto-front analysis over the accuracy/efficiency tradeoff, and the authors report that drift-aware retraining achieves accuracy comparable to periodic retraining while retraining far fewer models, with OCSVM generally performing best. The paper concludes that these results provide strong evidence that concept drift can be accurately detected in malware classification models.

Significance. If the central claim were supported by a valid evaluation, the contribution would be practically useful: a lightweight, unsupervised drift-detection method that reduces retraining costs while preserving accuracy. The paper's experimental scope is substantial, covering 400 scenario experiments and 70,400 drift-detector grid evaluations, with fixed random seeds and a clearly specified workflow. However, the empirical evaluation as presented is an in-sample/oracle assessment: classifier hyperparameters are tuned on the test batches, drift-detector thresholds are selected from test-batch accuracy, and a fixed control set is reused across all batches. These design choices mean the reported parity with periodic retraining and the OCSVM advantage are upper bounds rather than estimates of deployment performance.

major comments (3)
  1. [Section 3.3.1, Eq. (6)] The classifier hyperparameters are tuned on D_test_i, the same test samples used in Eqs. (2), (3), and (4) to compute every reported accuracy. The manuscript discloses this as an oracle-style upper bound, but the abstract and conclusion do not carry that caveat; the claim that drift-aware retraining is 'comparable to periodic retraining' is therefore an in-sample comparison. A temporal hold-out protocol, in which hyperparameters and detector thresholds are tuned on batches up to time t and evaluated on later batches, is required before the results can support the abstract's 'strong evidence' claim.
  2. [Sections 3.4 and 3.5.4] The drift-detector thresholds are selected by Pareto-front analysis of Δdrift = A_drift − A_static computed on the test batches, and the reported median accuracy A_m*_drift is the accuracy of the specific ω*_m chosen on those same batches. This makes the headline accuracy an optimized in-sample value, not a representative deployment accuracy. In addition, the uneven grid sizes (OCSVM 540, MK-Means 240, MMD 100; Table 3) create a selection-bias advantage for OCSVM, since a larger search space is more likely to contain a favorable operating point. At minimum, the comparison should be repeated with thresholds fixed a priori on a validation split.
  3. [Section 3.2.3] The control set X_test consists of the same 20 samples in every temporal batch, so half of every test set is identical across all batches. This common repeated subset inflates every accuracy and mechanically compresses the differences among the static, drift-aware, and periodic scenarios, making 'comparable to periodic' easier to achieve; it also violates the independence of batch-level evaluations. The control samples should be redrawn per batch from temporally matched segments of the control family, or the reported metrics should be computed on drift-family samples only.
minor comments (6)
  1. [Section 4.1] The sentence 'From Figures 14 through 17 we observe that MLP, RF, and MLP all perform well' should probably read 'MLP, RF, and SVM'; the repeated 'MLP' appears to be a typo.
  2. [Figure 7] The figure title 'OCSMV accuracies' is misspelled and should be 'OCSVM accuracies'.
  3. [Section 4.3] The word 'respecitvely' is misspelled and should be 'respectively'.
  4. [Section 4.5] The phrase 'since since these values correspond' contains a duplicated word and should be corrected.
  5. [Section 3.5.4] The term 'median' is used in a non-standard way: the selected point is the Pareto-front point closest to a line through the midpoint of the front. A footnote explaining this would prevent confusion with the statistical median.
  6. [Section 4 and Figures 4, 7, 10, 12] No confidence intervals or significance tests are reported for the accuracy differences between detectors; given the claim that OCSVM 'generally outperforms' the other techniques, this should at least be discussed or acknowledged as a limitation.

Circularity Check

1 steps flagged · score 6.0 of 10

Drift-aware accuracies are selected on the test batches via Eq. (6) and the Section 3.5.4 Pareto-front median, so the headline 'comparable to periodic retraining' is a fitted in-sample value rather than an out-of-sample prediction.

  1. fitted input called prediction [Section 3.3.1 (Eq. 6) and Section 3.5.4 (median Pareto-front accuracy); abstract claim]
    "we are optimizing each model based on the test accuracy ... Thus, the use of test-set tuning is intentional and can be interpreted as an oracle-style upper bound on performance rather than as a realistic deployment procedure. ... Let (x_min, y_min) be the point on the Pareto Front that gives the minimum ΔAccuracy ... Then we define the median accuracy for a given (L,R) pair as A^{m*}_drift(L,R) = (1/|F|) Σ A_drift(F_d,F_c,L,R,ω*_m)."

    The classifiers are tuned on test accuracy (Eq. 6), and the drift-detector thresholds are selected from a Pareto front whose objective Δdrift = A_drift − A_static is computed on the same test batches. The headline statistic A^{m*}_drift is then the accuracy at the selected ω*_m on that same test-based front, so it is an in-sample fitted maximum, not an estimate for unseen batches. The abstract's claim that drift-aware retraining 'achieve[s] classification accuracy comparable to periodic retraining' and that OCSVM 'generally outperforms' the alternatives therefore reports fitted values as strong evidence of practical detectability.

full rationale

The derivation chain is otherwise self-contained: OCSVM, MK-Means, and MMD are defined independently of the accuracy metric, and the accuracy formulas (Eqs. 2–4) are straightforward definitions rather than derived predictions. The self-citations [12] and [36] provide method provenance (MMD baseline and MK-Means drift-detection design) but are not load-bearing evidence for the central quantitative claim, and no uniqueness theorem is imported. The one substantive circularity-type problem is that the reported drift-aware accuracy, including the median Pareto-front value that drives the headline comparison, is selected using the test batches. Because this fitted value is then presented in the abstract as 'strong evidence' for practical drift detection, the central claim reduces, in part, to an in-sample selection. The reused 50-sample control set biases all scenarios in the same direction and is better treated as an experimental-design threat than as circularity.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The central claims depend on several fitted quantities: drift detector thresholds and detector hyperparameters are selected by grid search over the test batches; per-batch classifier hyperparameters are tuned by Optuna against test accuracy; batch size and train split were chosen based on small-scale tests. The temporal ordering assumes HighestModDate is a valid proxy for evolution. The evaluation assumes the fixed control set remains representative and that test-set tuning yields conclusions transferable to deployment.

free parameters (7)
  • OCSVM threshold T_ocsvm = grid search over 0.01 to 0.60, Pareto-front selected per (Fd, Fc, L)
    Controls the outlier-ratio change that triggers drift; tuned on test batches.
  • OCSVM nu = grid search over 0.1 to 0.9
    Sets the expected outlier fraction; selected via Pareto front.
  • MK-Means threshold T_mkmeans = grid search over 0.01 to 0.60
    Silhouette difference threshold for drift; tuned on test batches.
  • MK-Means cluster count = {2, 4, 6, 8}
    Number of clusters used for silhouette computation; tuned.
  • MMD significance level alpha (T_mmd) = grid search over 0.001 to 0.1
    Hypothesis test threshold for drift; tuned.
  • Classifier hyperparameters per batch = 737,600 Optuna trials over per-model search spaces
    Hyperparameters for MLP, RF, SVM, and XGB tuned on the test accuracy of each batch (Section 3.3.1).
  • Batch size and train split = b = 50, t = 30
    Chosen based on small-scale tests (Section 3.2.1); affects drift detection sensitivity and variance.
assumptions (5)
  • domain assumption HighestModDate timestamp ordering is a valid temporal proxy for malware sample evolution.
    Section 3.1.2; all batch construction and drift detection rely on this ordering.
  • domain assumption The five largest KronoDroid families are representative of Android malware concept drift.
    Section 3.1.1; limits generalization to other families and platforms.
  • domain assumption The fixed 50-sample control set from the control family remains representative across all temporal batches.
    Section 3.2.3; the same X_train and X_test are reused for every batch, which may let models memorize control samples.
  • ad hoc to paper Test-set tuning of drift thresholds yields comparisons that transfer to unseen data.
    Sections 3.3.1 and 3.4; the paper calls this an oracle-style upper bound, but the headline claims do not incorporate this limitation.
  • ad hoc to paper The 'median' Pareto Front point is a representative threshold selection.
    Section 3.5.4, equation (13); no justification that this selection rule matches real deployment choices.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Concept Drift Detection and Adaptive Retraining of Malware Classification Models." pith.science (2026). https://pith.science/paper/J3JOJXAR

@misc{pith2026260813465,
  author       = {Pith},
  title        = {Pith review of: Concept Drift Detection and Adaptive Retraining of Malware Classification Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/J3JOJXAR}},
  note         = {Machine review of arXiv:2608.13465}
}
read the original abstract

Concept drift refers to changes over time in the statistical properties of data, as compared to the data that was used to train a learning model. Machine learning models for malware detection or classification are particularly susceptible to performance degradation caused by concept drift, as attackers constantly modify existing malware. In this chapter, we analyze two machine learning-based approaches to automated concept drift detection-a novel approach based on One-Class Support Vector Machines (OCSVM) and a previously-studied technique based on Minibatch K-Means (MK-Means). For comparison we also consider Maximum Mean Discrepancy (MMD), a statistical technique for detecting changes in multidimensional data. We conduct an extensive series of experiments comparing the effectiveness of four learning models, namely, Multilayer Perceptron, Random Forest, Support Vector Machines, and eXtreme Gradient Boosting. For each of these models, we consider three distinct scenarios: A static scenario where no model retraining occurs, a periodic scenario where models are constantly retrained irrespective of concept drift, and a drift-aware scenario where models are only retrained when concept drift is detected. Under the drift-aware scenario, we analyze the tradeoff between accuracy and training efficiency using Pareto Front analysis. We find that all three concept drift detection techniques achieve classification accuracy comparable to periodic retraining, while offering substantially greater efficiency in terms of the number of models that must be retrained. In addition, drift-aware retraining based on our OCSVM technique generally outperforms the MK-Means and MMD approaches. Overall, these results provide strong evidence that we can accurately detect concept drift in malware classification models.

Figures

Figures reproduced from arXiv: 2608.13465 by the authors.

Figure 1
Figure 1. Average static and periodic accuracy per learning model [PITH_FULL_IMAGE:figures/full_fig_p024_1.png] view at source ↗
Figure 2
Figure 2. Box plot of static and periodic accuracy [PITH_FULL_IMAGE:figures/full_fig_p025_2.png] view at source ↗
Figure 3
Figure 3. MK-Means Pareto Front example From [PITH_FULL_IMAGE:figures/full_fig_p025_3.png] view at source ↗
Figures from the paper (16 more)
Figure 4
Figure 4. Figure 4: MK-Means accuracies From [PITH_FULL_IMAGE:figures/full_fig_p026_4.png]
Figure 5
Figure 5. Figure 5: MK-Means efficiencies As in the MK-Means case, we again see the value of Pareto Front analysis for se￾lecting hyperparameters to meet a desired balance between accuracy and efficiency. −0.050−0.025 0.000 0.025 0.050 0.075 0.100 0.125 0.0 0.2 0.4 0.6 0.8 1.0 ΔAccuracy E…
Figure 6
Figure 6. Figure 6: OCSVM Pareto Front example In Figures 7 and 8, respecitvely, we provide bar graphs of our various accuracy and efficiency metrics. We note that, similar to MK-Means, OCSVM achieves a sub￾stantial accuracy gain over the static baseline at a significant lower retraining …
Figure 7
Figure 7. Figure 7: OCSMV accuracies MLP RF SVM XGB 0.00 0.20 0.40 0.60 0.80 1.00 0.7785 0.7785 0.7785 0.7785 0.5861 0.5826 0.6085 0. 0 5895 .6463 0.6820 0.6873 0.7256 0.6586 0.6951 0.7283 0.7095 Efficiency ℰdrift ℰ 𝑥* drift ℰ 𝑦* drift ℰ𝑚* drift [PITH_FULL_IMAGE:figures/full_fig_p028_7.png]
Figure 8
Figure 8. Figure 8: OCSVM efficiencies With respect to efficiency, the improvement for the OCSVM-based drift-aware scenario averaged over all hyperparameters tested is more than 77%. The improve￾ment in efficiency when restricted to the median Pareto Front-based value ℰ 𝑚* drift and MLP m…
Figure 9
Figure 9. Figure 9: MMD Pareto Front example In [PITH_FULL_IMAGE:figures/full_fig_p029_9.png]
Figure 10
Figure 10. Figure 10: MMD accuracies MLP RF SVM XGB 0.00 0.20 0.40 0.60 0.80 1.00 0.6434 0.6437 0.6434 0.6437 0.6738 0.6714 0.6684 0.6617 0.6948 0.6941 0.6901 0.6996 0.6912 0.6990 0.7017 0.6985 Efficiency ℰdrift ℰ 𝑥* drift ℰ 𝑦* drift ℰ𝑚* drift [PITH_FULL_IMAGE:figures/full_fig_p030_10.png]
Figure 11
Figure 11. Figure 11: MMD efficiencies we restrict to the Pareto Front. The violin graphs in Figures 18 and 19 serve to further emphasize these points. These results strongly suggest that we could reduce the hyperparameter search space for MK-Means and OCSVM without affecting the accuracy …
Figure 12
Figure 12. Figure 12: Drift detector comparison averaged over all ( [PITH_FULL_IMAGE:figures/full_fig_p031_12.png]
Figure 13
Figure 13. Figure 13: Time required to detect drift points per ( [PITH_FULL_IMAGE:figures/full_fig_p032_13.png]
Figure 14
Figure 14. Figure 14: Static and periodic accuracies for MLP model [PITH_FULL_IMAGE:figures/full_fig_p037_14.png]
Figure 15
Figure 15. Figure 15: Static and periodic accuracies for RF model [PITH_FULL_IMAGE:figures/full_fig_p038_15.png]
Figure 16
Figure 16. Figure 16: Static and periodic accuracies for SVM model [PITH_FULL_IMAGE:figures/full_fig_p038_16.png]
Figure 17
Figure 17. Figure 17: Static and periodic accuracies for XGB model [PITH_FULL_IMAGE:figures/full_fig_p038_17.png]
Figure 18
Figure 18. Figure 18: Violin plots for accuracy and efficiency over all hyperparameters [PITH_FULL_IMAGE:figures/full_fig_p039_18.png]
Figure 19
Figure 19. Figure 19: Violin plots for accuracy and efficiency on Pareto Front [PITH_FULL_IMAGE:figures/full_fig_p039_19.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

60 extracted references · 54 canonical work pages

  1. [1]

    MORPH: Towards automated concept drift adaptation for malware detec- tion

    Md Tanvirul Alam, Romy Fieblinger, Ashim Mahara, and Nidhi Rastogi. MORPH: Towards automated concept drift adaptation for malware detec- tion. InProceedings 2024 Network and Distributed System Security Symposium, NDSS, 2024.https://arxiv.org/abs/2401.12790

    arXiv 2024

  2. [2]

    Javier B. Alonso. K-means vs Mini Batch K-means: A comparison.http: //hdl.handle.net/2117/23414, 2013

    work page 2013

  3. [3]

    Springer, 2006

    John Aycock.Computer Viruses and Malware. Springer, 2006

    work page 2006

  4. [4]

    Analyzing and comparing the effectiveness of malware detection: A study of machine learning approaches.Heliyon, 10(1):e23574, 2024

    Muhammad Azeem, Danish Khan, Saman Iftikhar, Shaikhan Bawazeer, and Mohammed Alzahrani. Analyzing and comparing the effectiveness of malware detection: A study of machine learning approaches.Heliyon, 10(1):e23574, 2024

    work page 2024

  5. [5]

    Ahmed, and Andreas Kassler

    Firas Bayram, Bestoun S. Ahmed, and Andreas Kassler. From concept drift to model degradation: An overview on performance-aware drift detectors. Knowledge-Based Systems, 245:108632, 2022

    work page 2022

  6. [6]

    Bertia, Basil Xavier Simon, G

    A. Bertia, Basil Xavier Simon, G. Jaspher W. Kathrine, and G. Matthew Palmer. A study about detecting ransomware by using different algorithms. In 2022 International Conference on Applied Artificial Intelligence and Comput- ing, ICAAIC, pages 1293–1300, 2022

    work page 2022

  7. [7]

    Collective choice under dichotomous preferences.Journal of Economic Theory, 122(2):165–184, 2005

    Anna Bogomolnaia, Herv´ e Moulin, and Richard Stong. Collective choice under dichotomous preferences.Journal of Economic Theory, 122(2):165–184, 2005

    work page 2005

  8. [8]

    Random Forests.Machine Learning, 45:5–32, 2001

    Leo Breiman. Random Forests.Machine Learning, 45:5–32, 2001

    work page 2001

Show all 60 references
  1. [9]

    Breunig, Hans-Peter Kriegel, Raymond T

    Markus M. Breunig, Hans-Peter Kriegel, Raymond T. Ng, and J¨ org Sander. LOF: identifying density-based local outliers. InProceedings of the 2000 ACM SIGMOD International Conference on Management of Data, SIGMOD ’00, pages 93–104, 2000

    2000

  2. [10]

    XGBoost: A scalable tree boosting sys- tem

    Tianqi Chen and Carlos Guestrin. XGBoost: A scalable tree boosting sys- tem. InProceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD ’16, pages 785–794, 2016

    2016

  3. [11]

    Monte da Silva, and Bruno Iran Ferreira Maciel

    Rohgi Toshio Meneses Chikushi, Roberto Souto Maior de Barros, Marilu Gomes N. Monte da Silva, and Bruno Iran Ferreira Maciel. Using spectral entropy and Bernoulli map to handle concept drift.Expert Systems with Ap- plications, 167:114114, 2021

    2021

  4. [12]

    Maximum mean discrepancy for concept drift detection in malware classification models

    Christofer Washington Berruz Chungata, Martin Jureˇ cek, Katerina Potika, and Mark Stamp. Maximum mean discrepancy for concept drift detection in malware classification models. InProceedings of the 12th IEEE International 33 Conference on Big Data Computing Service and Machine...

    2026

  5. [13]

    Coello Coello, B

    Carlos A. Coello Coello, B. Gary Lamont, and David A. Van Veldhuizen.Evolu- tionary Algorithms for Solving Multi-Objective Problems. Springer, 2nd edition, 2007

    2007

  6. [14]

    Support-vector networks.Machine Learning, 20:273–297, 1995

    Corinna Cortes and Vladimir Vapnik. Support-vector networks.Machine Learning, 20:273–297, 1995

    1995

  7. [15]

    Trends in ai inference energy consumption: Beyond the performance-vs- parameter laws of deep learning.Sustainable Computing: Informatics and Systems, 38:100857, 2023

    Radosvet Desislavov, Fernando Mart´ ınez-Plumed, and Jos´ e Hern´ andez-Orallo. Trends in ai inference energy consumption: Beyond the performance-vs- parameter laws of deep learning.Sustainable Computing: Informatics and Systems, 38:100857, 2023

    2023

  8. [16]

    Outlier detection with One-Class SVMs: An application to melanoma progno- sis

    Stephan Dreiseitl, Melanie Osl, Christian Scheibb¨ ock, and Michael Binder. Outlier detection with One-Class SVMs: An application to melanoma progno- sis. InAMIA Annual Symposium Proceedings, pages 172–176, 2010

    2010

  9. [17]

    F-Secure Labs: Adware:Android/Airpush.https://www.f-secure.com/sw- desc/adware-android-airpush.shtml, 2025

    2025

  10. [18]

    F-Secure Labs: Riskware:Android/SmsReg.https://www.f-secure.com/sw- desc/riskware-android-smsreg.shtml, 2025

    2025

  11. [19]

    F-Secure Labs: Trojan:Android/Boxer.https://www.f-secure.com/v- descs/trojan-android-boxer.shtml, 2025

    2025

  12. [20]

    F-Secure Labs: Trojan:W32/Agent.https://www.f-secure.com/v-descs/ agent.shtml, 2025

    2025

  13. [21]

    Borgwardt, Malte J

    Arthur Gretton, Karsten M. Borgwardt, Malte J. Rasch, Bernhard Sch¨ olkopf, and Alexander Smola. A kernel two-sample test.Journal of Machine Learning Research, 13:723–773, 2012

    2012

  14. [22]

    GitHub - aleguma/kronodroid: KronoDroid dataset.https://github.com/aleguma/kronodroid, 2021

    Alejandro Guerra-Manzanares. GitHub - aleguma/kronodroid: KronoDroid dataset.https://github.com/aleguma/kronodroid, 2021

    2021

  15. [23]

    Kron- oDroid: Time-based hybrid-featured dataset for effective android malware de- tection and characterization.Computers & Security, 110:102399, 2021

    Alejandro Guerra-Manzanares, Hayretdin Bahsi, and Sven N˜ omm. Kron- oDroid: Time-based hybrid-featured dataset for effective android malware de- tection and characterization.Computers & Security, 110:102399, 2021

    2021

  16. [24]

    J. A. Hartigan and M. A. Wong. Algorithm AS 136: A K-means clustering al- gorithm.Journal of the Royal Statistical Society. Series C (Applied Statistics), 28(1):100–108, 1979

    1979

  17. [25]

    Combating concept drift with explanatory detection and adaptation for android malware classifi- cation

    Yiling He, Junchi Lei, Zhan Qin, Kui Ren, and Chun Chen. Combating concept drift with explanatory detection and adaptation for android malware classifi- cation. InProceedings of the 2025 ACM Conference on Computer and Com- munications Security, CCS, pages 1–15, 2025

    2025

  18. [26]

    IBM: Random Forest.https://www.ibm.com/think/topics/random-forest, 2021. 34

    2021

  19. [27]

    Ikotun, Absalom E

    Abiodun M. Ikotun, Absalom E. Ezugwu, Laith Abualigah, Belal Abuhaija, and Jia Heming. K-means clustering algorithms: A comprehensive review, variants analysis, and advances in the era of big data.Information Sciences, 622:178–210, 2023

    2023

  20. [28]

    PE header analysis for malware detection

    Samuel Kim. PE header analysis for malware detection. Master’s thesis, San Jose State University, California, 2018.https://scholarworks.sjsu.edu/ etd_projects/624/

    2018

  21. [29]

    H. T. Kung, F. Luccio, and F. P. Preparata. On finding the maxima of a set of vectors.Journal of the ACM, 22(4):469–476, 1975

    1975

  22. [30]

    XGBoost versus Random Forest.https://www.qwak.com/post/ xgboost-versus-random-forest, 2022

    Alon Lev. XGBoost versus Random Forest.https://www.qwak.com/post/ xgboost-versus-random-forest, 2022

    2022

  23. [31]

    Revisiting concept drift in windows malware detection: Adaptation to real drifted mal- ware with minimal samples

    Adrian Shuai Li, Arun Iyengar, Ashish Kundu, and Elisa Bertino. Revisiting concept drift in windows malware detection: Adaptation to real drifted mal- ware with minimal samples. InProceedings 2025 Network and Distributed Sys- tem Security Symposium, NDSS, 2025.https://arxiv.or...

    2025 arXiv

  24. [32]

    Isolation forest

    Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. In2008 Eighth IEEE International Conference on Data Mining, pages 413–422, 2008

    2008

  25. [33]

    Manevitz and Malik Yousef

    Larry M. Manevitz and Malik Yousef. One-Class SVMs for document classifi- cation.Journal of Machine Learning Research, 2:139–154, 2002

    2002

  26. [34]

    Energy considerations for large pretrained neural networks.https://arxiv.org/abs/2506.01311, 2025

    Leo Mei and Mark Stamp. Energy considerations for large pretrained neural networks.https://arxiv.org/abs/2506.01311, 2025

    2025 arXiv

  27. [35]

    A survey of malware detec- tion techniques based on machine learning.International Journal of Advanced Computer Science and Applications, 10(1), 2019

    Hoda El Merabet and Abderrahmane Hajraoui. A survey of malware detec- tion techniques based on machine learning.International Journal of Advanced Computer Science and Applications, 10(1), 2019

    2019

  28. [36]

    Cluster analysis and concept drift detection in malware.Journal of Computer Virology and Hacking Techniques, 21, 2025

    Aniket Mishra and Mark Stamp. Cluster analysis and concept drift detection in malware.Journal of Computer Virology and Hacking Techniques, 21, 2025

    2025

  29. [37]

    Zubair Rafique, and Juan Caballero

    Antonio Nappa, M. Zubair Rafique, and Juan Caballero. The Malicia dataset: Identification and analysis of drive-by download operations.International Jour- nal of Information Security, 14(1):15–33, 2014

    2014

  30. [38]

    Optuna: Efficient optimization algorithms — Optuna 3.5.0 documen- tation.https://optuna.readthedocs.io/en/stable/tutorial/10_key_ features/003_efficient_optimization_algorithms.html, 2025

    2025

  31. [39]

    Word embedding techniques for malware evo- lution detection

    Sunhera Paul and Mark Stamp. Word embedding techniques for malware evo- lution detection. In Mark Stamp, Mamoun Alazab, and Andrii Shalaginov, ed- itors,Malware Analysis Using Artificial Intelligence and Deep Learning, pages 321–343. Springer, 2021

    2021

  32. [40]

    Polars: Data types and structures.https://docs.pola.rs/user-guide/ concepts/data-types-and-structures/, 2025

    2025

  33. [41]

    Stephan Rabanser, Stephan G¨ unnemann, and Zachary C. Lipton. Failing loudly: an empirical study of methods for detecting dataset shift. InProceed- ings of the 33rd International Conference on Neural Information Processing Systems, 2019. 35

    2019

  34. [42]

    Choudhary, K

    Ananya Redhu, P. Choudhary, K. Srinivasan, and Tapan Kumar Das. Deep learning-powered malware detection in cyberspace: a contemporary review. Frontiers in Physics, 12, 2024

    2024

  35. [43]

    Ross, Niall M

    Gordon J. Ross, Niall M. Adams, Dimitris K. Tasoulis, and David J. Hand. Ex- ponentially weighted moving average charts for detecting concept drift.Pattern Recognition Letters, 33(2):191–198, 2012

    2012

  36. [44]

    Rousseeuw and Katrien Van Driessen

    Peter J. Rousseeuw and Katrien Van Driessen. A fast algorithm for the mini- mum covariance determinant estimator.Technometrics, 41(3):212–223, 1999

    1999

  37. [45]

    Platt, John Shawe-Taylor, Alex J

    Bernhard Sch¨ olkopf, John C. Platt, John Shawe-Taylor, Alex J. Smola, and Robert C. Williamson. Estimating the support of a high-dimensional distribu- tion.Neural Computation, 13(7):1443–1471, 2001

    2001

  38. [46]

    novelty and outlier detection.https://scikit-learn.org/ stable/modules/outlier_detection.html

    scikit-learn: 2.7. novelty and outlier detection.https://scikit-learn.org/ stable/modules/outlier_detection.html

  39. [47]

    McCann, Ying Huang, Wei Wang, and Jun Kong

    Tongxin Shi, Roy A. McCann, Ying Huang, Wei Wang, and Jun Kong. Mal- ware detection for Internet of Things using one-class classification.Sensors, 24(13):4122, 2024

    2024

  40. [48]

    neural_network.MLPClassifier.html, 2010

    sklearn.neural network.mlpclassifier — scikit-learn 0.20.3 documenta- tion.https://scikit-learn.org/stable/modules/generated/sklearn. neural_network.MLPClassifier.html, 2010

    2010

  41. [49]

    A fuzzy drift corre- lation matrix for multiple data stream regression

    Yiliao Song, Guangquan Zhang, Haiyan Lu, and Jie Lu. A fuzzy drift corre- lation matrix for multiple data stream regression. In2020 IEEE International Conference on Fuzzy Systems, FUZZ-IEEE, pages 1–6, 2020

    2020

  42. [50]

    Chapman and Hall/CRC, Boca Raton, second edition, 2022

    Mark Stamp.Introduction to Machine Learning with Applications in Informa- tion Security. Chapman and Hall/CRC, Boca Raton, second edition, 2022

    2022

  43. [51]

    Juan Terven, Diana-Margarita Cordova-Esparza, Julio-Alejandro Romero- Gonz´ alez, Alfonso Ram´ ırez-Pedraza, and E. A. Ch´ avez-Urbiola. A comprehen- sive survey of loss functions and metrics in deep learning.Artificial Intelligence Review, 58:195, 2025

    2025

  44. [52]

    Papadopoulos, and Yannis Manolopoulos

    Eleftherios Tiakas, Apostolos N. Papadopoulos, and Yannis Manolopoulos. Skyline queries: An introduction. In2015 6th International Conference on Information, Intelligence, Systems and Applications, IISA, pages 1–6, 2015

    2015

  45. [53]

    Machine learning for malware evolu- tion detection

    Lolitha Sresta Tupadha and Mark Stamp. Machine learning for malware evolu- tion detection. In Mark Stamp, Corrado Aaron Visaggio, Francesco Mercaldo, and Fabio Di Troia, editors,Artificial Intelligence for Cybersecurity, pages 183–

  46. [54]

    Alibi detect: Algorithms for outlier, adversarial and drift detection, 2019

    Arnaud Van Looveren, Janis Klaise, Giovanni Vacanti, Oliver Cobb, Ashley Scillitoe, Robert Samoilescu, and Alex Athorne. Alibi detect: Algorithms for outlier, adversarial and drift detection, 2019

    2019

  47. [55]

    Detecting malware evolution using support vector machines.Expert Systems with Applications, 143:113022, 2020

    Mayuri Wadkar, Fabio Di Troia, and Mark Stamp. Detecting malware evolution using support vector machines.Expert Systems with Applications, 143:113022, 2020. 36

    2020

  48. [56]

    Tree-structured parzen estimator: Understanding its algo- rithm components and their roles for better empirical performance.https: //arxiv.org/abs/2304.11127, 2023

    Shuhei Watanabe. Tree-structured parzen estimator: Understanding its algo- rithm components and their roles for better empirical performance.https: //arxiv.org/abs/2304.11127, 2023

    2023 arXiv

  49. [57]

    What is a support vector ma- chine (SVM)?https://www.techtarget.com/whatis/definition/support- vector-machine-SVM, 2023

    Kinza Yasar and Fred Tabsharani. What is a support vector ma- chine (SVM)?https://www.techtarget.com/whatis/definition/support- vector-machine-SVM, 2023

    2023

  50. [58]

    MOEA/D: A multiobjective evolutionary algorithm based on decomposition.IEEE Transactions on Evolutionary Computation, 11(6):712–731, 2007

    Qingfu Zhang and Hui Li. MOEA/D: A multiobjective evolutionary algorithm based on decomposition.IEEE Transactions on Evolutionary Computation, 11(6):712–731, 2007

    2007

  51. [59]

    Adaptive online incremental learning for evolving data streams.Applied Soft Computing, 105:107255, 2021

    Si-si Zhang, Jian-wei Liu, and Xin Zuo. Adaptive online incremental learning for evolving data streams.Applied Soft Computing, 105:107255, 2021

    2021

  52. [60]

    MANAGE: A novel malware evolution model based on digital genes

    Yu Zhang, Qingzhong Liu, and Yuanquan Shi. MANAGE: A novel malware evolution model based on digital genes. In2022 7th IEEE International Con- ference on Data Science in Cyberspace, DSC, pages 64–70, 2022. Appendix In this Appendix, we provide additional relevant graphs. Figure...

    2022

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.