Is It Overkill? Analyzing Feature-Space Concept Drift in Malware Detectors
Is It Overkill? Analyzing Feature-Space Concept Drift in Malware Detectors
复制标题
DOI：
10.1109/spw59333.2023.00007
复制
发表时间：
2023-05
期刊：
影响因子：
--
通讯作者：
Zhi Chen;Zhenning Zhang;Zeliang Kan;Limin Yang;Jacopo Cortellazzi;Feargus Pendlebury;Fabio Pierazzi;L. Cavallaro;Gang Wang
中科院分区：
文献类型：
--
作者：
Zhi Chen;Zhenning Zhang;Zeliang Kan;Limin Yang;Jacopo Cortellazzi;Feargus Pendlebury;Fabio Pierazzi;L. Cavallaro;Gang Wang
概念漂移是基于机器学习的恶意软件检测器在实际部署时面临的主要挑战。虽然现有的工作已经调查的方法来检测概念漂移，它还没有很好地了解漂移背后的主要原因。在本文中，我们设计实验来实证分析特征空间漂移（新样本引入的新特征）的影响，并将其与数据空间漂移（现有特征上的数据分布偏移）进行比较。令人惊讶的是，我们发现数据空间漂移是模型随时间退化的主要贡献者，而特征空间漂移几乎没有影响。这在Android和PE恶意软件检测器上得到了一致的观察，它们具有不同的功能类型和功能工程方法，跨不同的设置。我们进一步验证了这一观察与最近的在线学习为基础的恶意软件检测器，逐步更新的特征空间。我们的研究结果表明，处理概念漂移没有频繁的功能更新的可能性，我们进一步讨论了未来的研究开放的问题。
Concept drift is a major challenge faced by machine learning-based malware detectors when deployed in practice. While existing works have investigated methods to detect concept drift, it is not yet well understood regarding the main causes behind the drift. In this paper, we design experiments to empirically analyze the impact of feature-space drift (new features introduced by new samples) and compare it with data-space drift (data distribution shift over existing features). Surprisingly, we find that data-space drift is the dominating contributor to the model degradation over time while feature-space drift has little to no impact. This is consistently observed over both Android and PE malware detectors, with different feature types and feature engineering methods, across different settings. We further validate this observation with recent online learning based malware detectors that incrementally update the feature space. Our result indicates the possibility of handling concept drift without frequent feature updating, and we further discuss the open questions for future research.