Addressing malware family concept drift with triplet autoencoder

TL;DR

This paper introduces a novel supervised autoencoder with triplet loss and DBSCAN clustering to improve detection of new malware families amid concept drift, validated on Android and Windows malware datasets.

Contribution

It presents a new method combining triplet autoencoder and clustering to effectively identify emerging malware families, addressing concept drift in malware detection.

Findings

Significant improvement in detecting new malware families.

Robust clustering of malware features enhances classification accuracy.

Method sustains performance over evolving malware datasets.

Abstract

Machine learning is increasingly vital in cybersecurity, especially in malware detection. However, concept drift, where the characteristics of malware change over time, poses a challenge for maintaining the efficacy of these detection systems. Concept drift can occur in two forms: the emergence of entirely new malware families and the evolution of existing ones. This paper proposes an innovative method to address the former, focusing on effectively identifying new malware families. Our approach leverages a supervised autoencoder combined with triplet loss to differentiate between known and new malware families. We create clear and robust clusters that enhance the accuracy and resilience of malware family classification by utilizing this metric learning technique and the Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithm. The effectiveness of our method is validated using an Android malware dataset and a Windows portable executable (PE) malware dataset, showcasing its capability to sustain model performance within the dynamic landscape of emerging malware threats. Our results demonstrate a significant improvement in detecting new malware families, offering a reliable solution for ongoing cybersecurity challenges.