Chen, Z;
Zhang, Z;
Kan, Z;
Yang, L;
Cortellazzi, J;
Pendlebury, F;
Pierazzi, F;
... Wang, G; + view all
(2023)
Is It Overkill? Analyzing Feature-Space Concept Drift in Malware Detectors.
In:
Proceedings of the IEEE Security and Privacy Workshops (SPW) 2023.
(pp. pp. 21-28).
Institute of Electrical and Electronics Engineers (IEEE)
Preview |
Text
feature-drift.pdf - Accepted Version Download (777kB) | Preview |
Abstract
Concept drift is a major challenge faced by machine learning-based malware detectors when deployed in practice. While existing works have investigated methods to detect concept drift, it is not yet well understood regarding the main causes behind the drift. In this paper, we design experiments to empirically analyze the impact of feature-space drift (new features introduced by new samples) and compare it with data-space drift (data distribution shift over existing features). Surprisingly, we find that data-space drift is the dominating contributor to the model degradation over time while feature-space drift has little to no impact. This is consistently observed over both Android and PE malware detectors, with different feature types and feature engineering methods, across different settings. We further validate this observation with recent online learning based malware detectors that incrementally update the feature space. Our result indicates the possibility of handling concept drift without frequent feature updating, and we further discuss the open questions for future research.
| Type: | Proceedings paper |
|---|---|
| Title: | Is It Overkill? Analyzing Feature-Space Concept Drift in Malware Detectors |
| Event: | 2023 IEEE Security and Privacy Workshops (SPW) |
| Location: | San Francisco, CA, USA |
| Dates: | 25th May 2023 |
| ISBN-13: | 979-8-3503-1236-2 |
| Open access status: | An open access version is available from UCL Discovery |
| DOI: | 10.1109/SPW59333.2023.00007 |
| Publisher version: | https://doi.org/10.1109/SPW59333.2023.00007 |
| Language: | English |
| Additional information: | This version is the author accepted manuscript. For information on re-use, please refer to the publisher's terms and conditions. |
| UCL classification: | UCL UCL > Provost and Vice Provost Offices > UCL BEAMS UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science > Dept of Computer Science |
| URI: | https://discovery.ucl.ac.uk/id/eprint/10176632 |
Archive Staff Only
 |
View Item |
