[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-117887-en":3,"doc-seo-117887-105":30,"detail-sidebar-cat-0-en-105":92},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},117887,8796095360427,"Lucas Martin","https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d",8,"Research & Report","Rapidrift: Elementary Techniques to Improve Machine Learning-Based Malware Detection","Artificial intelligence and machine learning are widely used in modern environments, yet malware authors increasingly evade traditional signature detection. As new malware samples appear, machine learning models face concept drift, causing detection performance to degrade over time. This work analyzes time-based degradation of machine learning malware detectors and presents Rapidrift, a Python framework for granular concept-drift analysis. The study also introduces two malware datasets, TRITIUM and INFRENO, from distinct sources and threat profiles, and evaluates fundamental methods to mitigate concept drift effects.","computers   \nArticle  \nRapidrift: Elementary Techniques to Improve Machine Learning-Based Malware Detection  \nAbishek Manikandaraja *, Peter Aaby * and Nikolaos Pitropakis *  \nCitation: Manikandaraja, A.; Aaby, P.;  \nPitropakis, N. Rapidrift: Elementary Techniques to Improve Machine Learning-Based Malware Detection. Computers 2023, 12, 195. [https://](https://)[ ](https://)[doi.org/10.3390/computers12100195](doi.org/10.3390/computers12100195)  \nAcademic Editor: Paolo Bellavista  \nReceived: 6 August 2023  \nRevised: 11 September 2023  \nAccepted: 19 September 2023  \nPublished: 28 September 2023  \nCopyright: © 2023 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license ([https://](https://)[ ](https://)[creativecommons.org/licenses/by/](creativecommons.org/licenses/by/)[ ](creativecommons.org/licenses/by/)[4.0/](4.0/)) .  \nSchool of Computing, Engineering & the Built Environment, Edinburgh Napier University, Edinburgh EH10 5DT, UK  \n* Correspondence: [40450966@live.napier.ac.uk](40450966@live.napier.ac.uk) (A.M.); [p.aaby@napier.ac.uk](p.aaby@napier.ac.uk) (P.A.);  \n[n.pitropakis@napier.ac.uk](n.pitropakis@napier.ac.uk) (N.P.)  \nAbstract: Artificial intelligence and machine learning have become a necessary part of modern living along with the increased adoption of new computational devices. Because machine learning andartificial intelligence can detect malware better than traditional signature detection, the development of new and novel malware aiming to bypass detection has caused a challenge where models may experience concept drift. However, as new malware samples appear, the detection performance drops. Our work aims to discuss the performance degradation of machine learning-based malware detectors with time, also called concept drift. To achieve this goal, we develop a Python-based framework, namely Rapidrift, capable of analysing the concept drift at a more granular level. We also created two new malware datasets, TRITIUM and INFRENO, from different sources and threat profiles to conduct a deeper analysis of the concept drift problem. To test the effectiveness of Rapidrift, various fundamental methods that could reduce the effects of concept drift were experimentally explored.  \nKeywords: malware; machine learning; PE malware; Rapidrift; inferno; tritium; windows malware; malware dataset  \n1. Introduction  \nThe increased adoption of Internet of Things (IoT) devices and the introduction of artificial intelligence (AI) to people's everyday lives has created an unbreakable bond. Machine learning (ML) solutions are continuously being integrated into devices and software solutions, making them more popular than they have ever been in the past. However, this increased attention has also attracted malicious parties who take advantage of the existing threat landscape to serve their cause. Computational infrastructures around the globe are susceptible to attacks. Recently, a cyber-attack on a major Yorkshire Coast Company has been thwarted by officers from North Yorkshire Police [1], while a cyber-attack has hit twelve Norwegian government ministries [2] .  \nMalicious applications or malware have become popular with new technological artefacts, frameworks, and applications. Malware is a class of programs developed and propagated to gain illicit access to systems, exfiltrate information, and perform other tasks without the user's consent. The delivery of payloads could occur through various techniques such as VBA, APK files, PE files, HTA files, PDF, and others. Moreover, some malware uses uncommon file types to attack [3] .  \nThe increasing variety of methods to deliver malicious payloads makes it harder to prepare datasets for training machine learning/deep learning models. The difference in feature representation is the reason behind such limitations. For instance, features used in Windows malware cannot be applie","cbCainCA71t9aMat","https://ap.wps.com/l/cbCainCA71t9aMat","pdf",1831343,1,16,"English","en",105,"# Introduction\n## Malware and the challenge of evolving threats\n## Concept drift in malware detection\n# Rapidrift and dataset creation\n## Python-based Rapidrift framework\n## TRITIUM and INFRENO malware datasets\n# Evaluating mitigation methods\n## Fundamental approaches to reduce concept drift","[{\"question\":\"What problem does Rapidrift focus on in machine learning-based malware detection?\",\"answer\":\"Rapidrift targets performance degradation caused by concept drift when new malware samples emerge over time.\"},{\"question\":\"How does the study analyze concept drift?\",\"answer\":\"The work proposes Rapidrift, a Python framework that analyzes concept drift at a more granular level.\"},{\"question\":\"What are TRITIUM and INFRENO, and why are they created?\",\"answer\":\"TRITIUM and INFRENO are new malware datasets collected from different sources and threat profiles to support deeper analysis of the concept-drift problem.\"}]","Rapidrift: Elementary Techniques to Improve Machine Learning-Based Malware Detection | PDF",1785680179,40,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":87,"head_meta":89,"extra_data":91,"updated_unix":28},"rapidrift-elementary-techniques-to-improve-machine-learning-based-malware-detection","",{"@graph":36,"@context":86},[37,54,69],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/rapidrift-elementary-techniques-to-improve-machine-learning-based-malware-detection/117887/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":63,"encodingFormat":61,"isAccessibleForFree":64,"interactionStatistic":65},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-05","2026-08-02",true,{"@type":66,"interactionType":67,"userInteractionCount":20},"InteractionCounter",{"@type":68},"ViewAction",{"@type":70,"mainEntity":71},"FAQPage",[72,78,82],{"name":73,"@type":74,"acceptedAnswer":75},"What problem does Rapidrift focus on in machine learning-based malware detection?","Question",{"text":76,"@type":77},"Rapidrift targets performance degradation caused by concept drift when new malware samples emerge over time.","Answer",{"name":79,"@type":74,"acceptedAnswer":80},"How does the study analyze concept drift?",{"text":81,"@type":77},"The work proposes Rapidrift, a Python framework that analyzes concept drift at a more granular level.",{"name":83,"@type":74,"acceptedAnswer":84},"What are TRITIUM and INFRENO, and why are they created?",{"text":85,"@type":77},"TRITIUM and INFRENO are new malware datasets collected from different sources and threat profiles to support deeper analysis of the concept-drift problem.","https://schema.org",{"og:url":52,"og:type":88,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":90,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":93},[94,98,102,106,111,116,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":95,"show_sort_weight":96,"slug":97},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":99,"show_sort_weight":100,"slug":101},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":103,"show_sort_weight":104,"slug":105},"Exam",70,"exam",{"id":107,"doc_module":4,"doc_module_name":46,"category_name":108,"show_sort_weight":109,"slug":110},5,"Comic",60,"comic",{"id":112,"doc_module":4,"doc_module_name":46,"category_name":113,"show_sort_weight":114,"slug":115},6,"Technology",50,"technology",{"id":117,"doc_module":4,"doc_module_name":46,"category_name":118,"show_sort_weight":29,"slug":119},7,"Healthcare","healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":107,"slug":138},19,"General","general"]