💻 computer science

Detecting and Explaining Malware Family Evolution Using Rule-Based Drift Analysis

This paper proposes an interpretable, rule-based approach to detect and explain malware family evolution by comparing generated rule sets to identify specific feature changes that constitute concept drift, thereby enhancing the robustness and transparency of malware detection systems.

Original authors: Olha Jurečková, Martin Jureček

Published 2026-02-04

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Olha Jurečková, Martin Jureček

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a security guard at a museum. Your job is to spot fake paintings (malware) and tell them apart from real ones. To do this, you have a rulebook. For example, your rulebook might say: "If a painting has a red frame AND a blue background, it's a fake."

For a while, this works great. But then, the forgers (malware creators) get smart. They start changing their tricks. They might switch the frame to green or change the background to yellow. Suddenly, your old rulebook fails because the "fake" paintings no longer look exactly like the ones you memorized. In the world of computers, this is called Concept Drift: the bad guys change their style so much that your old detection rules stop working.

This paper proposes a new way to catch these changes and, more importantly, explain exactly how the bad guys changed their tricks.

The Problem: The "Black Box" Mystery

Usually, computer programs that detect malware are like "black boxes." They might say, "This is bad!" with 99% accuracy, but they can't tell you why. It's like a security guard who just points at a painting and says, "Fake!" without explaining which part of the painting gave it away. This is frustrating because if you don't know what changed, you can't update your rulebook effectively.

The Solution: A Rule-Based Detective

The authors of this paper suggest using a different kind of detective: one that writes down simple, human-readable rules.

Instead of a black box, imagine a detective who writes notes like this:

"Rule 1: If the file is 500KB AND has a specific code section, it's the 'Agensla' family of malware."

When the malware evolves, the computer generates a new set of rules for the new, changed malware.

How They Detect the Change (The "Drift")

The researchers use a clever comparison method:

The Original Rulebook: They write down the rules for the "old" version of a malware family.
The Evolved Rulebook: They use a special tool (called MAB-malware) to automatically create "evolved" versions of the malware that try to sneak past the detector. Then, they write down the rules for these new versions.
The Comparison: They compare the two rulebooks side-by-side. They calculate a "distance" score.
- If the rules are almost the same, the score is low (no drift).
- If the rules are very different, the score is high (drift detected!).

The Analogy: Think of it like comparing two recipes for chocolate cake.

Old Recipe: "Use 2 cups of flour, 1 cup of sugar, and bake at 350°F."
New Recipe: "Use 2 cups of almond meal, 1 cup of honey, and bake at 300°F."
The "distance" between these recipes is huge. The paper's method doesn't just say "The recipe changed!" It points specifically to the ingredients that swapped out (flour $\to$ almond meal, sugar $\to$ honey). This tells the security guard exactly what to look for next time.

The Experiment

The team tested this on six different families of malware (like Agensla, DCRat, and Mokes). They used a computer program to "evolve" these malware families, making them harder to detect, and then checked if their rule-based system could spot the changes.

The Results:

Accuracy: They were able to detect when the malware had evolved about 92% of the time.
Clarity: Because they used simple rules, they could see exactly which features (like file size or specific code sections) the malware authors changed to hide.
Best Case: For one family called "Mokes," the system was incredibly good at spotting the difference between the old and new versions.

Why This Matters

The paper claims that this approach is special because it is interpretable. It doesn't just give a "Yes/No" answer; it gives a "Why."

Old Way: "This is malware." (But you don't know why).
New Way: "This is malware because it changed its file header and removed a specific code signature."

By knowing how the malware changed, security experts can update their defenses faster and understand the tactics the bad guys are using. The paper concludes that using these simple, logical rules is a powerful way to keep up with the constantly changing world of computer viruses.

Technical Summary: Detecting and Explaining Malware Family Evolution Using Rule-Based Drift Analysis

Problem Statement
Malware detection and classification are critical yet increasingly difficult tasks due to the continuous evolution of malicious code. Attackers constantly modify malware to evade detection, introducing concept drift—a phenomenon where the statistical properties of malware features change over time. This drift undermines static machine learning models, reducing their effectiveness. Furthermore, while black-box models may achieve high accuracy, they lack interpretability, offering little insight into why a sample is classified as malicious or how it has evolved. This opacity hinders analyst trust and the ability to derive actionable intelligence for incident response. Existing drift detection methods often rely on complex, opaque models (e.g., deep neural networks, ensemble methods) or statistical frameworks that fail to explain drift at the feature level.

Methodology
The authors propose an interpretable framework for detecting and explaining concept drift in malware families using a rule-based classifier. The approach consists of three primary stages:

Rule Generation (Original vs. Evolved):
- Original Family: A rule-based classifier (specifically RIPPER, implemented via the wittgenstein library) is trained on a representative set of original malware samples to generate a set of human-readable logical rules ( $R_{orig}$ ). These rules describe the structural and behavioral characteristics of the family.
- Evolved Family: Adversarial variants of the malware are generated using MAB-malware, a reinforcement learning-based adversarial generator. This tool employs a multi-armed bandit agent to apply minimal binary modifications (e.g., appending benign data, zeroing fields, code transformations) to evade a target classifier (EMBER). A second set of rules ( $R_{adv}$ ) is generated from these evolved samples using the same RIPPER process.
Drift Quantification:
- The method compares the rule sets $R_{orig}$ and $R_{adv}$ using a normalized Hamming distance.
- Rules are converted into binary vectors where a '1' indicates a sample is detected by the rule and '0' otherwise.
- The distance metric $d(x,y)$ calculates the proportion of positions where the binary vectors differ, quantifying the disagreement between the rule sets. A significant distance indicates concept drift.
Drift Detection and Explanation:
- Decision Rule: A threshold is established as the arithmetic mean of the average distance between rule sets from the same original family (intra-family variance) and the distance between the original and adversarial families. If the distance between new rules and historical rules exceeds this threshold, concept drift is predicted.
- Interpretability: Because the classifier outputs explicit logical conditions (e.g., f3=72 AND f1 in [10,48]), the method inherently identifies which specific features and values have changed between the original and evolved samples, providing a direct explanation of the malware's evolutionary tactics.

Experimental Setup
The framework was validated on six malware families: Agensla, DCRat, Makoob, Mokes, Strab, and Taskun.

Data: Samples were drawn from the RawMal-TF dataset.
Features: Static features were extracted from Windows Portable Executable (PE) files using the LIEF library, including metadata, header information, section statistics, imported/exported functions, and byte-level distributions.
Adversarial Generation: MAB-malware was used to create adversarial samples that successfully evaded the EMBER classifier.
Dimensions: Experiments were conducted across feature vector dimensionalities of 3, 5, 10, 15, 25, 50, 75, and 100.

Key Results

Detection Accuracy: The proposed method achieved an overall concept drift detection accuracy of 92.08% across all six families and feature dimensionalities.
Family-Specific Performance:
- Agensla and Mokes achieved 100% accuracy across all dimensionalities.
- Taskun had a single error (out of 80 experiments) at the 100-dimensional setting.
- DCRat showed the highest error rate (22.5% overall), though it achieved 0% error at the 25-dimensional setting.
Drift Magnitude: The study demonstrated that the distance metric effectively quantifies the magnitude of drift. For the Mokes family, the distance between original and adversarial rule sets was up to 15 times larger than the distance between rule sets derived from different subsets of the same original family.
Interpretability: The rule-based approach successfully identified specific feature changes responsible for the evolution, distinguishing it from black-box drift detection methods.

Significance and Contributions
The paper claims that its primary contribution is bridging the gap between effective drift detection and practical forensic analysis by prioritizing interpretability. Unlike existing statistical or deep-learning approaches that operate as black boxes, this framework:

Explicitly Emphasizes Interpretability: By leveraging rule-based classifiers, it provides human-readable descriptions of both original and evolved malware.
Enables Feature-Level Explanation: It identifies the specific conditions and features responsible for drift, allowing analysts to understand how malware authors are bypassing detection (e.g., specific changes in API usage or header fields).
Quantifies Evolution: It offers a rigorous, quantitative measure of drift while simultaneously explaining the underlying behavioral changes.

The authors position this work as one of the first studies to apply an interpretable, rule-based framework specifically for concept drift detection in malware analysis, aiming to support both detection systems and threat analysis efforts. Future work is noted to potentially extend this framework using decision trees and exploring different distance metrics.