🤖 machine learning

FARM: Few-shot Adaptive Malware Family Classification under Concept Drift

This paper introduces FARM, a unified framework that leverages a triplet autoencoder for unsupervised concept drift detection and a few-shot learning strategy to effectively adapt Windows PE malware family classifiers to evolving threat landscapes with limited labeled data.

Original authors: Numan Halit Guldemir, Oluwafemi Olukoya, Jesús Martínez-del-Rincón

Published 2026-03-16

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Numan Halit Guldemir, Oluwafemi Olukoya, Jesús Martínez-del-Rincón

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a security guard at a busy airport. Your job is to spot dangerous items in luggage.

The Problem: The Criminals Keep Changing Their Clothes
In the world of computer viruses (malware), the "criminals" are constantly evolving.

The "Cosplay" Drift (Covariate Drift): A known criminal (like a virus called WannaCry) decides to wear a different mask or carry a slightly different bag. It's still the same criminal, but it looks different enough that your old security rules might miss it.
The "New Face" Drift (Label Drift): A completely new criminal gang shows up that you have never seen before. Your security guard has no idea what they look like, so they might let them right through the door.

Traditional security software is like a guard with a static photo album. If the criminal changes their appearance or a new gang arrives, the guard gets confused, and the system fails. This is called Concept Drift.

The Solution: Meet FARM
The paper introduces a new system called FARM (Few-shot Adaptive Recognition of Malware). Think of FARM not as a guard with a photo album, but as a super-smart detective with a flexible memory.

Here is how FARM works, broken down into simple steps:

1. The "Magic Mirror" (Triplet Autoencoder)

Instead of just looking at the surface of a file, FARM uses a "Magic Mirror" (a neural network) to project every file into a special 3D room called the Latent Space.

In this room, files that act similarly are grouped together in tight clusters, like friends sitting at the same table.
Files that are different are pushed far away to the corners of the room.
This helps the system see the essence of the malware, not just its superficial features.

2. The "Fence" and the "Outlier" (Drift Detection)

FARM draws a fuzzy fence around each known group of friends (malware families).

If a file stays inside the fence: It's recognized as a known friend.
If a file wanders outside the fence: The system doesn't immediately guess what it is. Instead, it raises a red flag: "Hey, this looks weird! It doesn't fit with any of our known groups."
This is how it catches both the "cosplayers" (who changed too much) and the "new gangs" (who have no group yet).

3. The "Waiting Room" (The Buffer)

When the system spots a weird file, it doesn't throw it away or force it into a wrong group. It puts it in a Waiting Room (a buffer).

It waits to see if more weird files arrive.
If only one weird file shows up, it might be a fluke.
But if 10 or more weird files start showing up and they look similar to each other, the system realizes: "Aha! This is a new gang!"

4. The "Quick Study" (Few-Shot Adaptation)

This is the superpower of FARM. Usually, to learn a new criminal gang, you need thousands of photos. FARM is a Quick Study.

Once the system sees that small group of 10 new files in the Waiting Room, it creates a "Prototype" (a mental average of what this new gang looks like).
Now, the system can recognize this new gang immediately, even if it only has seen a handful of examples. It doesn't need to go back to school and relearn everything from scratch. It just adds this new "mental photo" to its list.

5. The "Deep Dive" (Full Retraining)

Sometimes, a new gang becomes so popular that they flood the airport. FARM has a second mode: Full Retraining.

Once the system has collected enough data (say, 100 samples) of this new gang, it takes a break, goes back to the drawing board, and re-trains its entire "Magic Mirror" to permanently include this new group in its main structure.
This ensures the system is solid and ready for the long haul.

Why is this a big deal?

Speed: It adapts instantly to new threats without waiting for human experts to label thousands of files.
Accuracy: It stops the system from getting "overconfident." Old systems often guess "I'm 99% sure this is safe" even when it's a new virus. FARM says, "I don't know this one, let's check it out."
Efficiency: It works with very little data (Few-Shot), which is perfect because new viruses are rare and hard to find labeled examples for.

In Summary:
FARM is like a security guard who doesn't just memorize faces but understands behavior. When a criminal changes their look, the guard notices they don't fit the pattern. When a new gang arrives, the guard quickly learns their style after seeing just a few members, and eventually updates the whole security manual to keep everyone safe.

1. Problem Statement

Malware detection models suffer from concept drift, a phenomenon where the statistical properties of data change over time, leading to performance degradation. In the context of Windows Portable Executable (PE) malware, this manifests in two primary forms:

Covariate Drift (Intra-class drift): Existing malware families evolve their behaviors or characteristics to evade detection while retaining their class identity.
Label Drift (Inter-class drift): Entirely new, previously unknown malware families emerge, introducing novel classes that the model has never encountered.

Key Challenges:

Model Aging: Static models trained on historical data fail to detect new variants or families, with performance dropping significantly (e.g., from 99% to 76% in six months).
Label Scarcity: Obtaining labeled data for new threats is expensive, time-consuming, and often unreliable.
Confidence Failure: Standard classifiers often remain overconfident (high softmax scores) even when encountering unseen or drifted samples, making them poor at detecting drift.
Platform Gap: Most existing drift adaptation research focuses on Android malware, leaving a gap in solutions for the high-volume Windows PE ecosystem.

2. Methodology: The FARM Framework

FARM (Few-shot Adaptive Recognition of Malware) is a unified framework designed to detect drift and adapt to it using a pipeline of metric learning, unsupervised clustering, and few-shot adaptation.

A. Core Architecture: Triplet Autoencoder

Instead of relying on a standard classification layer, FARM uses a Triplet Autoencoder to project high-dimensional EMBER features (static PE features) into a discriminative latent space.

Components: An encoder-decoder structure trained jointly.
Loss Function: A combination of Triplet Loss (to ensure semantic separation between classes) and Mean Squared Error (MSE) Loss (to preserve input reconstruction fidelity).
- Triplet Loss: Minimizes the distance between an anchor and a positive (same class) while maximizing the distance to a negative (different class) by a margin $\alpha$ .
- MSE Loss: Ensures the latent representation retains sufficient structural information.
Goal: Create an embedding space where samples of the same family cluster tightly, and different families are well-separated.

B. Drift Detection Phase

Once samples are embedded, FARM performs unsupervised drift detection:

Clustering: Uses DBSCAN (Density-Based Spatial Clustering of Applications with Noise) on the latent space. Unlike K-means, DBSCAN does not require a pre-defined number of clusters and can identify sub-structures within families.
Dynamic Thresholding: For each cluster, a threshold ( $\tau$ ) is calculated based on the maximum distance of inlier samples to the cluster centroid.
Decision Logic:
- If a new sample falls within the threshold of a known cluster $\rightarrow$ Classify as that family.
- If a sample falls outside all known thresholds $\rightarrow$ Flag as Drifted (potential new family or evolved variant) and store in a buffer.

C. Drift Adaptation Phase

The framework employs a two-stage adaptation strategy:

Immediate Few-Shot Adaptation:
- Drifted samples accumulate in a buffer.
- When the buffer reaches a minimum size (e.g., 10 samples), DBSCAN is re-applied to find cohesive groups.
- Prototype Generation: The mean embedding of a new cluster becomes a prototype.
- Inference: New samples are classified by comparing their distance to these prototypes (nearest-neighbor in latent space). This allows the system to recognize new families with minimal labeled data without retraining the encoder.
Long-term Full Retraining:
- Once a sufficient number of samples (e.g., 100) for a new family are accumulated, the model undergoes full retraining.
- The original training data is combined with the new samples, the triplet autoencoder is updated, and new centroids/thresholds are established. This consolidates the new family into the model's permanent structure.

3. Key Contributions

Unified Framework: Proposes FARM, the first unified approach for Windows PE malware that simultaneously handles covariate drift (evolving variants) and label drift (new families).
Metric-Learning-Based Drift Detection: Replaces unreliable classifier confidence scores with distance-based detection in a learned latent space using a Triplet Autoencoder and DBSCAN.
Few-Shot Adaptation: Introduces a mechanism to integrate new malware families using only a small number of labeled samples (prototypes), addressing the scarcity of labeled data.
Hybrid Adaptation Strategy: Combines rapid, lightweight prototype insertion for immediate response with periodic full retraining for long-term stability.

4. Experimental Results

The framework was evaluated on the BenchMFC dataset (223k+ samples, 526 families), focusing on a controlled 16-family subset.

Baseline Performance: On known families, FARM achieved an average F1 score of 0.97.
Covariate Drift (Evolving Families):
- FARM improved classification performance on evolving families by 5.6% on average after adaptation.
- Specific gains were observed in families with high drift (e.g., upatre +19.4%, fareit +11.6%).
Label Drift (Unseen Families):
- Drift Detection: Successfully identified 84% of unseen families as drifted. (Note: vobfus had lower detection due to behavioral overlap with known families).
- Few-Shot Adaptation: Achieved an average F1 score of 0.85 on unseen families using only a few labeled samples.
- Full Retraining: After retraining, the average F1 score increased to 0.94.
Generalization (N-way K-shot):
- Performance improved consistently with more support samples (e.g., moving from 1-shot to 5-shot).
- 10-shot configurations provided a practical trade-off between accuracy and labeling cost.
Comparison: FARM outperformed the CADE baseline (which uses contrastive loss) and a fixed-threshold variant, demonstrating the superiority of DBSCAN-based dynamic thresholds.

5. Significance and Implications

Operational Viability: FARM offers a practical solution for real-world security operations where models must adapt to rapidly changing threats without constant manual re-labeling.
Efficiency: By leveraging few-shot learning, the framework drastically reduces the dependency on large labeled datasets for new threats.
Robustness: The use of metric learning and clustering provides a more robust mechanism for detecting distributional shifts compared to traditional confidence-based methods.
Future Directions: The authors note that while effective, the system relies on static EMBER features. Future work aims to extend this to packed malware (obfuscated code) and improve the interpretability of drift decisions.

In conclusion, FARM demonstrates that combining metric learning, unsupervised clustering, and few-shot learning creates a resilient architecture capable of maintaining high accuracy in the face of the dynamic and adversarial nature of Windows PE malware.