A Classification Framework and Research Progress on Adaptation Methods for Concept Drift in Malicious Code Detection Models

With the development of artificial intelligence technologies, various models have become mainstream methods in malicious code detection. The application of these models brings significant advantages in automation, intelligence, and proactivity. However, as malicious code continuously evolves and updates, discrepancies emerge between the distribution of malicious code characteristics and those in the model’s training dataset. This leads to a decline in the model’s detection performance, a phenomenon known as concept drift. Existing research still lacks a systematic review that comprehensively explains how concept drift impacts malicious software detection models and how to effectively address this issue. Therefore, this paper reviews and analyzes the current research on this topic in five aspects: enhanced machine learning methods, deep neural network models, graph neural network models, continual learning strategies, and meta-learning strategies. By analyzing, comparing, summarizing, and discussing the various methods, this paper aims to provide insights into future improvements for reducing concept drift in malicious code detection models. This paper helps researchers understand the basic principles behind concept drift, current mitigation techniques, existing challenges, and future development directions, providing support for further research and improvement of existing methods.