Fast & Furious: Modelling Malware Detection as Evolving Data Streams
Malware is a major threat to computer systems and imposes many challenges to
cyber security. Targeted threats, such as ransomware, cause millions of dollars
in losses every year. The constant increase of malware infections has been
motivating popular antiviruses (AVs) to develop dedicated detection strategies,
which include meticulously crafted machine learning (ML) pipelines. However,
malware developers unceasingly change their samples features to bypass
detection. This constant evolution of malware samples causes changes to the
data distribution (i.e., concept drifts) that directly affect ML model
detection rates. In this work, we evaluate the impact of concept drift on
malware classifiers for two Android datasets: DREBIN (~130K apps) and AndroZoo
(~350K apps). Android is a ubiquitous operating system for smartphones, which
stimulates attackers to regularly create and update malware to the platform. We
conducted a longitudinal evaluation by (i) classifying malware samples
collected over nine years (2009-2018), (ii) reviewing concept drift detection
algorithms to attest its pervasiveness, (iii) comparing distinct ML approaches
to mitigate the issue, and (iv) proposing an ML data stream pipeline that
outperformed literature approaches. As a result, we observed that updating
every component of the pipeline in response to concept drifts allows the
classification model to achieve increasing detection rates as the data
representation (extracted features) is updated. Furthermore, we discuss the
impact of the changes on the classification models by comparing the variations
in the extracted features.