Rapidrift: Elementary Techniques to Improve Machine Learning-Based Malware Detection

Manikandaraja, Abishek; Aaby, Peter; Pitropakis, Nikolaos

Abstract

Artificial intelligence and machine learning have become a necessary part of modern living along with the increased adoption of new computational devices. Because machine learning and artificial intelligence can detect malware better than traditional signature detection, the development of new and novel malware aiming to bypass detection has caused a challenge where models may experience concept drift. However, as new malware samples appear, the detection performance drops. Our work aims to discuss the performance degradation of machine learning-based malware detectors with time, also called concept drift. To achieve this goal, we develop a Python-based framework, namely Rapidrift, capable of analysing the concept drift at a more granular level. We also created two new malware datasets, TRITIUM and INFRENO, from different sources and threat profiles to conduct a deeper analysis of the concept drift problem. To test the effectiveness of Rapidrift, various fundamental methods that could reduce the effects of concept drift were experimentally explored.

Citation

Manikandaraja, A., Aaby, P., & Pitropakis, N. (2023). Rapidrift: Elementary Techniques to Improve Machine Learning-Based Malware Detection. Computers, 12(10), Article 195. https://doi.org/10.3390/computers12100195

• Journal Article Type: Article
• Acceptance Date: Sep 19, 2023
• Online Publication Date: Sep 28, 2023
• Publication Date: 2023
• Deposit Date: Oct 3, 2023
• Publicly Available Date: Oct 3, 2023
• Journal: Computers
• Publisher: MDPI
• Peer Reviewed: Peer Reviewed
• Volume: 12
• Issue: 10
• Article Number: 195
• DOI: https://doi.org/10.3390/computers12100195
• Keywords: Computer Networks and Communications; Human-Computer Interaction
• Publisher URL: https://www.mdpi.com/2073-431X/12/10/195