A Classification Framework and Research Progress on Adaptation Methods for Concept Drift in Malicious Code Detection Models

Abstract

With the development of artificial intelligence technologies, various models have become mainstream methods in malicious code detection. The application of these models brings significant advantages in automation, intelligence, and proactivity. However, as malicious code continuously evolves and updates, discrepancies emerge between the distribution of malicious code characteristics and those in the model’s training dataset. This leads to a decline in the model’s detection performance, a phenomenon known as concept drift. Existing research still lacks a systematic review that comprehensively explains how concept drift impacts malicious software detection models and how to effectively address this issue. Therefore, this paper reviews and analyzes the current research on this topic in five aspects: enhanced machine learning methods, deep neural network models, graph neural network models, continual learning strategies, and meta-learning strategies. By analyzing, comparing, summarizing, and discussing the various methods, this paper aims to provide insights into future improvements for reducing concept drift in malicious code detection models. This paper helps researchers understand the basic principles behind concept drift, current mitigation techniques, existing challenges, and future development directions, providing support for further research and improvement of existing methods.

1. Introduction

In recent years, the economic losses caused by cybercrime have grown rapidly, with the large-scale spread and rapid iteration of malicious software being one of the key contributing factors. This has made the challenges faced by traditional malicious software detection systems increasingly severe [1]. Government and commercial organizations in nearly all sectors are at risk or have already been attacked. According to a 2024 report, the annual global cost of cybercrime was projected to reach $9.5 trillion in 2024 and $10.5 trillion in 2025 [2].

With the rapid development of artificial intelligence technologies, an increasing number of models have been applied to the field of malicious code detection. These models often exhibit high detection accuracy during the initial deployment phase. However, as time progresses, the performance of these models gradually declines. The reason behind this phenomenon is the occurrence of concept drift.

The accumulation of concept drift significantly increases the model’s false positive (FP) and false negative (FN) rates, leading to a decline in model performance. The process of this change is illustrated in Figure 1. In the first stage, it is characterized by CS (Covariate Shift), where the input marginal distribution (P(X)) changes, but the relationship between the input and output labels remains the same. This is followed by the second stage, CDS (Conditional Distribution Shift), where the conditional distribution (P(Y|X) of features and labels changes. Further, it can evolve into the third stage, RC (Representation Collapse), where the original high-weight patterns are generalized or imitated, causing a reduction in separability [3]. Finally, this leads to the fourth stage, DBD (Decision Boundary Drift), which results in a significant increase in false positives and false negatives. Research has shown that in one case, an Android malware detection model experienced a dramatic drop in its F1 score (the harmonic mean of Precision and Recall) from 0.99 to 0.76 after just six months of deployment [4].

Figure 1. Concept Drift Progression Diagram.

Concept drift is triggered by the continuous evolution of malware families. From the perspective of joint distribution, concept drift can be defined as the existence of a change in distribution at two different time points t0 and t1, such that ∃X:P_t0(X, y) ≠ P_t1(X, y) [5]. In the context of malware detection, this phenomenon is also referred to as decision boundary drift, where the distribution of test samples gradually deviates from the training distribution [6,7].

After summarizing prior definitions of concept drift, concept drift in malware detection can be articulated as follows: Over time, the data-generating mechanisms for both malware and benign samples evolve, causing the joint distribution P_t(X, Y) associated with the detection task to change with t. This drift can manifest as a change in the conditional distribution P_t(Y|X), i.e., a shift in the decision boundary, or as a change in the input distribution P_t(X). In the context of malware, such changes are typically induced by factors like the evolution of malware families, obfuscation/packing techniques, adversarial adaptation by attackers, and shifts in the platform ecosystem or labeling strategies, consequently leading to the performance degradation of deployed detectors over time.

Research on concept drift has undergone a gradual evolution from initial problem identification to the establishment of a formalized framework. Widmer and Kubat systematically introduced the challenge of concept drift in the context of online learning in non-stationary environments, emphasizing the necessity for models to continuously adapt to changes in the data-generating mechanism [8]. Subsequently, research focus shifted towards drift detection (centered on statistical tests, sliding windows, and change point detection), alongside the development of adaptive learning strategies for data streams (such as incremental updates and ensemble frameworks) to mitigate performance degradation [8]. Entering the 2010s, the field began to form a relatively mature methodological review framework organized around “drift type–detection–adaptation–evaluation” [9]. Concurrently, addressing the issue of inconsistent terminology and definitions, recent scholarly efforts have sought to integrate drift categories based on rigorous probabilistic definitions, establish unified taxonomies, and introduce new approaches for drift detection based on model performance degradation [10].

Existing survey papers predominantly focus on malicious code detection techniques themselves, leaving a gap in comprehensive reviews addressing the concept drift problem specific to this domain. To the best of our knowledge, we are the first to conduct a systematic review that traces the emergence, evolution, and progression of concept drift in malicious code detection, alongside the techniques and methods designed to counteract it. This survey provides an in-depth examination of the state-of-the-art and most reliable concept drift detection methods, categorizing them according to their characteristics, followed by a comparative analysis and discussion.

The contributions of this study are as follows:

• To the best of our knowledge, this is the first survey paper to comprehensively investigate the emergence, evolution, and progression of concept drift;
• This review proposes a novel taxonomy that categorizes existing solutions for concept drift based on differences in their modeling paradigms and adaptation mechanisms;
• This review attempts to discuss the strengths and limitations of existing solutions, serving as a comprehensive reference for advanced techniques employed to counteract concept drift;
• We discuss open issues and challenges that remain to be addressed and suggest potential directions for future research.

The remainder of this paper is organized as follows: Section 2 outlines the review methodology employed in this study and presents the research questions. Section 3 introduces the proposed taxonomy and provides a comparative summary of the latest concept drift solutions in malware detection based on this classification. Section 4 presents the discussion and research findings. Section 5 summarizes the current challenges and suggests potential research directions. Section 6 concludes the paper.

2. Methods

In this section, we describe the search methodology, keywords, and criteria employed in this review. Additionally, we formulate several research questions to define the scope of this study.

2.1. Search Methodology

This study conducted an extensive literature search across the ACM Digital Library, IEEE Xplore, Web of Science and Elsevier. The ACM Digital Library provides access to journals, conference proceedings, and meeting records from the Association for Computing Machinery (ACM). IEEE Xplore offers access to conference papers and journals from the Institute of Electrical and Electronics Engineers (IEEE). Both ACM and IEEE are highly authoritative databases in the field of cybersecurity. Web of Science, with its stringent selection process for source journals and conferences, offers stable and reproducible field searches and citation networks, facilitating quality control and forward/backward “snowballing” methods for literature expansion. Elsevier provides access to high-quality, peer-reviewed journals and conference proceedings. In this study, we use it exclusively to retrieve review articles, leveraging its rigorous editorial standards to ensure reliable and comprehensive literature synthesis. Beyond these major databases, this paper also selected articles from prominent venues over the past five years, including conferences such as the ACM Conference on Computer and Communications Security (CCS), the USENIX Security Symposium (USENIX Security), and the Network and Distributed System Security Symposium (NDSS), as well as journals like the IEEE Transactions on Information Forensics and Security (TIFS) and the IEEE Transactions on Dependable and Secure Computing (TDSC). This approach enhances the reliability and comprehensiveness of this study. In principle, this review focuses on articles published after 2019 to better concentrate on the latest advancements in the field. However, to gain a more thorough understanding of the historical development of concept drift, this study also selectively includes some earlier research.

2.2. Key Words

The search criteria used in this review across the various platforms are detailed in Table 1.

Table 1. Database search platforms and criteria.

Database	Search Criteria	Results
ACM Digital Library	[[All: “malicious software”] OR [All: malware] OR [All: “malware detection”] OR [All: “threat detection”] OR [All: “intrusion detection”]] AND [[All: “concept drift”] OR [All: “concept shift”] OR [All: “data drift”] OR [All: “model aging”] OR [All: “distribution shift”] OR [All: “temporal evolution”] OR [All: “model staleness”]] AND NOT [[All: survey] OR [All: review]] AND [E-Publication Date: (01/01/2020 TO 12/31/2025)]	8
IEEE Xplore	(“malicious software” OR “malware detection”) AND (“concept drift” OR “concept shift”) NOT (survey OR review)	66
Web Of Science	(“malicious software” OR “malware detection”) AND (“concept drift” OR “concept shift”) NOT (survey OR review)	35
Elsevier (ScienceDirect)	(malware OR “malware detection” OR “malicious code”) AND (“concept drift” OR “concept shift”) AND (survey OR review)	74

2.3. Inclusion and Exclusion Criteria

To ensure a comprehensive understanding of the latest research progress in addressing concept drift, this review adopted specific inclusion and exclusion criteria. The detailed criteria are presented in Table 2.

Table 2. Inclusion and exclusion criteria.

Inclusion Criteria	Exclusion Criteria
Articles published after 2020	No clear results
Studies focusing on malware detection	Unclear research methodology
Use of real malware samples or real + synthetic datasets as controls	Does not address detection model’s defense/adaptation to drift
Provision of at least one standard metric	Extremely small dataset without validation/control using real-world data
Clear explanation of training/testing time split	Retracted or with records of significant academic misconduct

The identification and screening of relevant literature employed a dual-track strategy designed to capture both original research contributions and high-quality review articles within the field. For the primary body of original research studies, a systematic search was conducted across three major bibliographic databases: the ACM Digital Library, IEEE Xplore, and Web of Science. This initial search yielded a total of 109 records. After removing 19 duplicate entries through automated and manual deduplication procedures, title and abstract screening was performed on the remaining 90 unique records. At this stage, records were processed in accordance with the specified inclusion and exclusion criteria, resulting in the retrieval of 60 full-text articles for detailed eligibility assessment. A rigorous evaluation against the complete inclusion and exclusion parameters was subsequently carried out, leading to the final determination that 61 original research studies met the inclusion criteria.

As a parallel and complementary effort, a targeted supplementary search was conducted within the Elsevier database (ScienceDirect) to specifically identify high-quality review articles capable of providing a broader contextual framework for the analysis. An unrestricted search for review-type literature initially returned 74 candidate articles. A thorough full-text appraisal of these articles was then performed, during which studies exhibiting substantial deviation from the central theme of concept drift in malware detection were excluded, leaving 27 articles. Given the nature of this survey and the necessity of maintaining a focused analytical perspective, a journal-level filter was implemented to prioritize the rigor and depth of the included sources. Inclusion was restricted to review articles published in *Computer Science Review*, a journal widely recognized within the computing disciplines for publishing authoritative and comprehensive surveys. This strategic filtering narrowed the scope to 12 relevant reviews.

Together, these two search streams constitute the final corpus for the overall statistical and trend analyses, comprising a total of 72 studies. To better elucidate the temporal evolution of research activity within this domain, the included studies are aggregated by publication year and presented in Figure 2, thereby illustrating the overarching trends and scholarly trajectory of the field. To further sharpen the analytical focus and ensure a balanced and in-depth discussion within the five conceptual categories delineated in Section 3, a subset of 22 representative works was carefully selected to form the “in-depth discussion set.” The remaining included studies primarily serve to substantiate and enrich the discussion concerning dimensions such as evaluation methodologies, dataset specifications, and extant challenges. To ensure full transparency and reproducibility, a complete list of all 73 included studies is provided in Appendix A Table A1.

Figure 2. Distribution of references by publication year.

2.4. Research Questions

Research questions are crucial for guiding scientific inquiry and providing a clear focus. Through this effort, we address the following research questions concerning concept drift in malware detection:

RQ1: How does concept drift impact the performance of malware detectors?

RQ2: What is the evolutionary trend in the methodological trajectory of research on “concept drift”?

RQ3: What are the mainstream techniques used to address the problem of concept drift in malware detection?

RQ4: How does concept drift relate to the adversarial actions of malware developers (e.g., the continuous evolution of malicious code)? How do existing detection techniques cope with concept drift intentionally induced by attackers?

3. Taxonomy of Concept Drift Adaptation

In this section, we present a classification of existing techniques for addressing concept drift in malware detection, along with an overview of fundamental concepts and characteristics. We also compare and summarize recent studies based on this proposed taxonomy.

3.1. Related Works

The issue of concept drift in the field of malware detection has received some research attention, with several foundational surveys providing comprehensive taxonomies of drift types, detection methods, and adaptation strategies [5,9]. However, these works primarily address concept drift in general machine learning contexts rather than the specific challenges currently faced by malicious code detection. Recent surveys have begun to examine specific aspects of malicious code detection: Brosolo et al. systematically reviewed visualization-based malware detection methods, discussing the performance degradation of visualization models when encountering novel packing or obfuscation techniques and noting the impact of concept drift, yet their classification framework is organized around image generation methods rather than drift adaptation mechanisms [11]. Adhikari et al. comprehensively surveyed anomaly detection techniques for the Internet of Things, explicitly identifying concept drift as a core challenge in time-series data analysis, but their review focuses on the broader domain of IoT anomaly scenarios rather than specifically on malicious code detection [12]. Wani et al. reviewed AI-driven botnet detection methods for IoT networks, pointing out the threat of concept drift to long-term model performance and recommending the adoption of continual learning, yet their scope is limited to the specific malware type of botnets [13].

In summary, to the best of our knowledge, no existing survey systematically focuses on adaptation methods for concept drift specifically in malicious code detection models while covering multiple learning paradigms. Table 3 summarizes representative existing surveys and highlights their differences from our work.

Table 3. Comparison of existing surveys with our work.

Reference	Focus Area	Covers Concept Drift?	Covers Malware Detection?	Provides Adaptation Taxonomy?
[5]	General concept drift	Yes	No	Yes (general)
[9]	General concept drift	Yes	No	Yes (general)
[11]	Visualization-based malware detection	Yes	Yes	No (visualization-specific)
[12]	IoT anomaly detection	Yes	Yes (partial)	No
[13]	IoT botnet detection	Yes	Yes (botnet)	No
Our work	Concept drift adaptation in malware detection	Yes	Yes	Yes

3.2. Categorization of Studies

To systematically understand the current research progress in addressing concept drift, we categorize recent studies into the following five classes based on their modeling paradigms and adaptation mechanisms: (1) detection methods based on traditional machine learning, (2) detection methods based on deep neural networks, (3) detection methods based on graph neural networks, (4) detection frameworks employing continual learning strategies, and (5) detection frameworks incorporating meta-learning strategies. This taxonomy reflects the differences among studies in terms of feature representation, learning paradigm, and approach to modeling temporal evolution, thereby offering a unified structural perspective for subsequent analysis.

To enable a clearer comparison of the efficiency of the methods employed in different studies, we conducted a qualitative assessment of their overhead. Since the computational cost of model detection primarily depends on whether the method meets the requirements of real-time applications, and based on a synthesis of existing research and industry practice, we define an average sample processing time below 100 ms as Low, between 100 ms and 1 s as Medium, and above 1 s as High. Furthermore, for methods where the average sample processing time was not explicitly stated in the original publication, we derived reasonable estimates by considering the model architecture, computational complexity, data scale, and any qualitative descriptions provided by the authors. For instance, in the case of the ASDroid method proposed by Qihua Hu et al., although the inference overhead of the random forest classifier itself is low, the approach requires static decompilation of Android applications and extraction of method call chains. This preprocessing stage consumes approximately 0.3–1.5 s per sample, which is well above the millisecond range. While the final feature dimensionality is fixed and classification time is negligible, the overall detection time falls within the 100 ms to 1 s interval. Moreover, the paper does not mention real-time or lightweight optimizations. Consequently, its overhead is categorized as Medium.

3.3. Detection Approaches Based on ML

Due to the challenge of concept drift caused by system evolution and environmental changes in malware detection, recent academic efforts have shifted from the traditional paradigm of “fixed features plus empirical retraining” towards multiple diversified technical approaches centered on enhancing the robustness of feature representations [14]. To address API semantic changes introduced by Android system version updates, Qihua Hu et al. proposed ASDroid [15], a method that first constructs API source code information graphs and then applies embedding-based clustering to map semantically similar APIs into the same cluster. This approach effectively mitigates performance degradation over a nine-year span of dataset collection. In a highly aligned yet environmentally oriented perspective, Yuchen Yang et al. provided a remarkably insightful solution from the viewpoint of spurious correlation elimination [16]. Their proposed SCRR method does not require prior knowledge of the target environment, but directly filters out fine-grained spurious features irrelevant to malicious behaviors, achieving significantly improved detection accuracy in cross-environment drift scenarios. More importantly, these two approaches complement and reinforce each other, demonstrating that through semantic robustification and feature purification, the adaptability of models to distribution shifts can indeed be enhanced without increasing the frequency of retraining.

This paper clearly and systematically categorizes two types of approaches—multi-source information fusion and dynamic weighting mechanisms—employed to address the complexity and imbalance associated with concept drift. To tackle local concept drift caused by imbalanced malware family distributions, Li et al. proposed fusing multimodal features such as file formats and byte sequences, and then adaptively adjusting the classification loss using a family-weight adaptive mechanism [17]. This approach significantly improves the detection capability for rare families. Complementing this work effectively, Abid et al. designed the ECMT multi-model fusion framework tailored for the IoT environment, integrating memory forensics features with neural networks and ensemble learning models [18]. By fully leveraging the complementarity of different techniques, this framework achieves high accuracy and scalability in persistent threat scenarios. This leads to an important conclusion: expanding feature modalities in conjunction with dynamic learning mechanisms enables models to more effectively extract the intrinsic characteristics of malicious behavior, thereby mitigating performance degradation caused by concept drift.

Furthermore, some existing studies have explicitly modeled and proactively adapted to concept drift from a temporal perspective. Notably, Guerra-Manzanares et al. proposed an elegant solution to the temporal decay problem in Android malware detection [19]. Their method, based on system call features, incorporates dynamic monitoring and incremental updates, effectively overcoming the vulnerability of static features to code obfuscation. By carefully processing timestamps—particularly the last modification time—they achieved consistently stable and high-performance detection results on a dataset spanning seven years. More importantly, they rigorously demonstrated that periodic incremental updates, combined with appropriate temporal modeling, can effectively reduce the frequency of retraining while naturally and efficiently absorbing the impact of concept drift at the data stream level. Consequently, it is evident that the core focus of machine learning approaches to concept drift has shifted from “when to retrain” to “how to design more robust feature representations and update mechanisms.” Although technical routes such as semantic clustering, multi-source fusion, and temporal modeling each possess distinct characteristics, their fundamental objective is highly unified: to delay and more fully adapt to distributional shifts by enhancing the semantic stability, information richness, and temporal sensitivity of features. Of course, these approaches inevitably introduce side effects such as increased preprocessing costs and model complexity, necessitating a reasonable trade-off between robustness and overhead in practical deployments.

Table 4 provides a comparative summary of the representative machine learning-based malware detection approaches reviewed in Section 3.3.

Table 4. Comparison of Representative ML-Based Malware Detection Approaches.

Method/Author	Dataset	Temporal Performance Retention	Overhead	Key Limitations
ASDroid	AndroZoo, VirusShare	Outperforms baselines	Medium	Relies on API semantics; limited cross-platform generalization
SCRR	Drebin, AndroZoo	Stable under temporal and environmental shifts	Low	Difficulty in designing filtering rules
Li et al. [17]	CCF BDCI-21, Microsoft BIG-15	Significantly improves rare families detection	High	High computational cost; feature extraction bottleneck
ECMT	MalMem2022 memory dump dataset	-	Low	Lack of temporal validation; substantial resource overhead

3.4. Detection Approaches Based on DNNs

Recognizing that simply stacking more network layers does not effectively enhance model robustness against concept drift, recent research has systematically explored various technical pathways from the perspectives of data augmentation, feature constraints, and system architecture. Among these, one class of approaches proactively defends against distributional shifts by employing adversarial data augmentation at the input level. The GreedyBlock framework proposed by Lucas et al. [20] serves as an excellent example: it simulates real-world attack patterns to prevent the model from over-relying on a small set of volatile byte features, thereby significantly improving robustness against concept drift without the need for massive adversarial example generation. Notably, by intervening directly at the data source, this method naturally and reasonably achieves a 54% average improvement in robustness while reducing training computation by 91%, effectively balancing enhanced robustness with training efficiency.

In contrast to approaches that solely modify input data, another line of research focuses on optimizing feature representations within the embedding space—specifically, by constraining the structure of the embedding space to enhance model generalization. The ACE method proposed by Huang et al. [21] introduces supervised contrastive learning into the Android malware detection task, making the representations of malware samples from the same family more compact in the feature space. Consequently, even without frequent model updates, its ability to identify new variants remains robust. Complementing this approach effectively, the CADE system designed by Yang et al. [22] approaches the problem from the perspective of measuring sample distribution shifts within a latent space using a contrastive autoencoder. It proactively detects and explains drifted samples through an “external monitor,” demonstrating particular strength in handling novel types of attacks. However, the reviewed literature also clearly and rigorously points out the fundamental challenges faced by current deep learning methods: whether it is ACE, which relies on family labels, or CADE, which requires a monitoring mechanism, both perform admirably during abrupt concept drift. Yet, when dealing with slow, gradual drift, maintaining long-term stability still necessitates appropriate model update mechanisms. Furthermore, both methods exhibit a strong dependence on high-quality labels and sufficient computational resources.

Moreover, the current academic community has made several commendable attempts to address concept drift from the perspective of change detection. Among these, the MeMalDet framework proposed by Pascal Maniriho et al. [23] provides an elegantly practical approach that transcends the limitations of static file-based analysis. By performing direct analysis on memory dumps and utilizing a deep autoencoder to automatically and reliably extract features from runtime data, this method effectively captures obfuscation behaviors that are difficult to detect through traditional static analysis. As a result, it achieves an exceptionally high detection accuracy of 98.82% when handling concept drift in evolving data streams. This clearly and convincingly demonstrates that adopting a dynamic perspective grounded in system runtime behavior is a highly effective strategy for mitigating concept drift. However, its heavy reliance on memory acquisition and analysis also leads to increased system deployment complexity and higher computational overhead. Therefore, in the pursuit of high robustness, deep learning methods must inevitably face a trade-off between performance and system overhead.

Table 5 provides a comparative summary of the representative deep neural network-based malware detection approaches reviewed in Section 3.4.

Table 5. Comparison of DNN-Based Malware Detection Approaches.

Method/Author	Dataset	Robustness	Interpretability	Overhead	Key Limitation
GreedyBlock	VTFeed	High against adversarial examples	Poor	High	Limited resistance to naturally evolving drift
ACE	AndroZoo	Superior on new samples without updates	Poor	Medium	Heavy reliance on known labels; requires retraining for entirely new families
CADE	Drebin	Excels at handling significant drift	Excellent	High	Weak against gradual, incremental drift
MeMalDet	IDS2018	Stable high detection on obfuscated samples	Good	Low	Dependent on memory dumps; vulnerable to anti-forensic techniques

3.5. Detection Approaches Based on GNNs

Given the inherent capability of Graph Neural Networks (GNNs) to model graph-structured data, they have therefore naturally emerged as a new breakthrough for addressing concept drift in malware detection [24]. Their fundamental advantage is clear: GNNs can effectively capture the relatively stable structural dependencies within programs. That is, regardless of how the behavioral semantics of malware evolve, the corresponding control flow graphs (CFGs) or function call graphs (FCGs) retain topological features that are not easily tampered with. Consequently, current academic research on this issue centers around this “structural invariance,” aiming to extract robust and transferable representations that are resilient across temporal distributions.

A clear and established line of research focuses on constructing heterogeneous graph structures from dynamic behavioral trajectories, thereby naturally enhancing model adaptability to temporal drift. The API2Vec++ method proposed by Lei Cui et al. provides an excellent demonstration of this approach [25]. It first constructs a Temporal Process Graph (TPG) and a Temporal API Property Graph (TAPG), explicitly and directly modeling both cross-process and intra-process API call behaviors as graph structures. Subsequently, it employs heuristic random walks combined with BERT pre-training to obtain vector representations of behavioral sequences. This method demonstrated strong robustness in cross-year data evaluations, naturally leading to the conclusion that transforming behavioral sequences into structured representations helps mitigate distribution shifts caused by temporal drift. Similarly, Runhan Song et al. proposed HeteroNet, a heterogeneous information deep ensemble learning model [26]. It constructs three types of heterogeneous graphs: API call sequence graphs, API resource graphs, and API invocation graphs, using GIN, GCN, and GRU to extract structural features and semantic information. Finally, an ensemble learning method is used to integrate the decision results from different views. Its performance in cross-year detection tasks significantly outperformed all baseline methods, leading to the compelling conclusion that fusing multi-source heterogeneous structural information is beneficial for improving a model’s generalization ability to unknown samples.

Another line of research, grounded in the intrinsic invariance of static control flow structures, introduces adversarial training mechanisms to proactively eliminate domain discrepancies. A typical analysis is provided by Adrian Shuai Li et al. [7] in their work on Windows platform malware detection: they abstract binary code into CFGs, extract node features, and then introduce an adversarial domain adaptation training strategy. This compels the model to learn intermediate representations that are insensitive to temporal drift. This leads to its most prominent advantage: achieving effective cross-temporal adaptation with a very small number of target domain samples, outperforming traditional incremental learning strategies across multiple drift tasks. Furthermore, this approach serves as an excellent complement to the previously discussed dynamic behavior analysis methods. The former uses static structures as an anchor, employing adversarial learning to compress distributional differences, while the latter uses dynamic behaviors as clues, leveraging semantic alignment in heterogeneous graphs to enhance representation robustness. By integrating these two perspectives, it is evident that although current GNN-based methods for handling concept drift still face engineering challenges, such as high graph construction overhead and sensitivity to noise, their potential to leverage structural invariance against distribution shifts has been robustly and clearly validated. Therefore, lightweight modeling and online update mechanisms will naturally become key directions for the practical application of this approach in the future.

Table 6 provides a comparative summary of the representative graph neural network-based malware detection approaches reviewed in Section 3.5.

Table 6. Comparison of GNN-Based Malware Detection Approaches.

Method/Author	Dataset	Core Mechanism	Robustness	Overhead	Key Limitation
API2Vec++	Self-constructed Windows PE dataset	Dynamic graph construction (TPG & TAPG); BERT-based path embedding	Strong cross-temporal	Medium	Relies on dynamic tracing; high computational complexity
HeteroNet	Self-constructed Windows PE dataset	Multi-source heterogeneous graph learning	Robust to future samples	Medium	Complex architecture; high inference cost
Li et al. [7]	Big-15, MB-24, MalwareDrift	Static CFGs; GIN with adversarial domain adaptation	Strong domain adaptation	High	Requires minimal labeled samples from target environment

3.6. Detection Approaches Based on CL

The fundamental purpose of continual learning methods is to address the performance degradation of malware detection models caused by concept drift [27]. The most essential and challenging problem in this area is how to enable models to learn new knowledge while avoiding catastrophic forgetting of previously acquired knowledge. Consequently, current academic research on this “stability–plasticity” dilemma has developed three distinct and well-structured technical pathways, each representing different design choices regarding knowledge retention mechanisms, architecture update strategies, and data efficiency optimization.

The first pathway explores combining experience replay with representation learning to mitigate forgetting. The MalFSCIL framework proposed by Yuhan Chai et al. [28] specifically addresses scenarios with scarce samples and incremental classes. It adopts a decoupled training strategy that strictly separates the feature extraction and classification phases. Critically, this method uses a variational autoencoder to generate “pseudo-features” of old class samples as memory replay content, effectively preserving discriminative ability for old classes when new classes are introduced. Complementing this, the framework incorporates a graph attention network and an additive angular margin loss to dynamically and reasonably optimize class prototype-based decision boundaries. Experimental results clearly demonstrate that it achieves the minimal performance degradation after multiple rounds of incremental learning, indicating excellent stability over long task sequences. However, its effectiveness is inherently influenced by the quality of generated samples, and the employed network structure is relatively complex.

The second pathway stems from the perspective of architectural modularity and online updates, with a clear and reasonable design objective: ensuring the system is lightweight and operates with low interruption. To this end, the TAMD-IL architecture proposed by Anli Yan et al. [29] naturally adopts a two-layer traffic detection mechanism and effectively supports dynamic replacement of sub-models for incremental updates without interrupting service. Consequently, it demonstrates excellent performance in scenarios with prominent resource constraints and high availability requirements, significantly reducing the time and memory overhead associated with model updates. However, solutions oriented towards “engineering-focused smooth switching” generally lack explicitly designed anti-forgetting mechanisms. Therefore, their capacity for knowledge accumulation remains notably limited when encountering long-term, multi-round concept drift.

The third pathway seeks a balance between data annotation efficiency and model adaptability by using active learning to select high-value samples for updates. In this context, the continual learning framework for Android malware detection proposed by Yizheng Chen et al. [4] serves as an exemplary demonstration of deep integration between contrastive learning and active learning. First, it employs hierarchical contrastive learning to explicitly introduce weak similarities between malware families into the representation space. Subsequently, it proposes an uncertainty estimation method based on “pseudo-loss” to objectively quantify the epistemic uncertainty of the contrastive learning encoder when processing new samples. This leads to a strategy where only a small number of samples with the highest uncertainty are selected for annotation and retraining. Under the extreme condition of annotating only 50 samples per month, this method still maintains stable and high detection performance. This represents an insightful new approach to addressing the challenge of scarce labeled samples in real-world scenarios. However, the computational overhead during training and the reliance on the reliability of the “pseudo-loss” metric are trade-offs that cannot be ignored in practical deployment.

Therefore, given the current clear and well-structured path differentiation in the development of continual learning within the malware detection field—one school pursuing the ultimate in knowledge solidification and stability, another focusing on the lightweight nature of system architecture, and a third striving to maximize information gain when data is sparse—it is reasonable to speculate that future research will focus on how to design a unified framework that balances stability and plasticity, capable of long-term autonomous evolution, under real-world deployment constraints. This will involve considering trade-offs among storage budgets, computational overhead, and annotation costs.

Table 7 provides a comparative summary of the representative continual learning-based malware detection approaches reviewed in Section 3.6.

Table 7. Comparison of CL-Based Malware Detection Approaches.

Method/Author	Dataset	Core Mechanism	Robustness	Overhead	Key Limitation
MalFSCIL	BODMAS, NSFOCUS Real-World Malware	Memory replay; prototype Learning	High stability across multiple class-incremental tasks	Low	Complex architecture; performance limited by generative replay quality
TAMD-IL	Drebin, VirusShare, App market traffic	Model replacement; two-layer filtering	Moderate stability; enables seamless modular updates	Low	Lack of dedicated anti-forgetting mechanism
Chen et al. [4]	APIGraph, AndroZoo	Contrastive learning; active learning with Pseudo-loss	High stability in streaming scenarios with limited labeled data	Low	High training cost; pseudo-loss reliability unvalidated

3.7. Detection Approaches Based on Meta-L

To address the concept drift caused by the dynamic evolution of data streams in malware detection, meta-learning offers a distinct yet powerful adaptation paradigm compared to continual learning: “learning to learn” [30]. By training on constructed sets of related meta-tasks (e.g., data slices from different families, time periods, or malicious environments), the model learns a good initial state or efficient, robust update rules. Consequently, when new variants or families emerge, the model can adjust its parameters with very few samples, demonstrating excellent robustness in scenarios with scarce samples and the emergence of new families. It is worth noting that research on this topic is still limited. However, existing work can generally be categorized into two clear and complementary paths: “representation/metric-driven” approaches and “task-construction-driven” approaches.

The core idea of the former category of methods is to construct a well-discriminative metric structure within the embedding space, making them naturally suitable for fast adaptation in few-shot scenarios. Consequently, Jinting Zhu et al. proposed a rigorous and ingenious few-shot meta-learning model based on a Siamese Neural Network (SNN) for ransomware detection and family classification [31]. This model uses entropy features of binary files directly as input to preserve fine-grained signature information. It introduces a pre-trained VGG-16 network to provide initial weights during the meta-learning training phase and combines center loss with softmax loss in the objective function. This actively reduces intra-class distances for samples of the same family within the embedding space while strictly widening inter-class boundaries, enabling reliable learning of unbiased weights even with very few samples. More notably, such methods are meticulously designed from both feature representation and metric learning perspectives, thus achieving highly effective fast adaptation under specific drift scenarios (e.g., control flow obfuscation). However, they currently still rely heavily on manually engineered features and relatively fixed task formulations, leaving room for improvement when directly generalized to large-scale streaming data and environments with multiple types of drift.

Table 8 provides a comparative summary of the representative meta-learning-based malware detection approaches reviewed in Section 3.7.

Table 8. Comparison of Meta-L-Based Malware Detection Approaches.

Method/Author	Dataset	Core Mechanism	Meta-Task	Limitations
Zhu et al. [31]	Self-constructed	Few-shot Siamese network; entropy-based features; dual-center loss	Few-shot discrimination of ransomware families	Limited dataset size; unknown generalizability
Meta-MAMC	Drebin, AMD	Dual-sampling strategy	Few-/zero-shot classification for multi-family Android malware	Cross-platform generalization not validated

The latter category of methods starts with the strategy for constructing meta-tasks, leveraging task-level diversity to enhance generalization capability to unknown families. Therefore, the Meta-MAMC framework proposed by Yao Li et al. [30], targeting the two major challenges of sample imbalance and zero-day family detection in multi-family Android malware classification, serves as an excellent example. Specifically, this framework introduces application-level and family-level dual-sampling strategies during the meta-learning phase, using a hyperparameter P to rationally control the proportion between them, thereby directly and effectively addressing the sample imbalance across different families in the training set. More notably, the framework deliberately designs “zero-sample” tasks during meta-training to simulate the emergence of zero-day malware, allowing the model to proactively and thoroughly learn cross-family meta-knowledge from several low-sample tasks. The underlying idea is clear: “rehearsing” future drift during the training phase, thereby naturally achieving strong generalization to new families in the deployment phase. However, its performance still depends on the consistency between the sampled tasks and the true zero-day distribution. Furthermore, there is currently room for improvement in the generality of feature extraction and cross-platform generalization.

3.8. Other Approaches

A review of the current literature reveals that a number of approaches addressing concept drift in malware detection do not fall within the aforementioned five mainstream frameworks. Although these methods are not the focus of current mainstream research, they examine the problem from diverse perspectives, offering valuable new ideas for tackling concept drift: moving away from solely relying on frequent model updates or retraining to cope with concept drift, and instead, focusing on improving data representation, incorporating external knowledge, and enhancing feature robustness to enhance the generalization and anti-interference capabilities of detection systems at the source.

Antonio Coscia et al. provided a highly insightful and structured analysis of the “virtual concept drift” problem caused by malware obfuscation techniques [32]. Their approach first tackles the issue from the perspective of enhancing the robustness of detection signatures themselves. Consequently, their proposed YAMME engine begins by performing equivalence rewriting on the assembly code of known malware, simulating typical strategies of obfuscation engines. This naturally and reasonably generates a vast set of YARA signature variants. More notably, the core idea of their method can be aptly summarized as “using attack to aid defense”—proactively training defensive detection features using attackers’ obfuscation techniques to enhance their ability to recognize unknown variants. Experimental results strongly validate this point: the recall of YAMME-augmented rules on a WannaCry variant sample set directly increased from 45.4% to 100%. This naturally leads to a clear and powerful conclusion: enhancing feature robustness is an extremely effective means of countering virtual concept drift.

Several recent studies leverage external knowledge or the semantic understanding capabilities of pre-trained models, presenting a clear and elegant approach to improving the stability of feature representations. Notably, Pei Yan et al. [33] addressed the concept drift problem in API call sequences within dynamic analysis exceptionally well, proposing a detection framework based on GPT-4 prompt engineering. Specifically, instead of employing predefined feature extraction on individual API calls, they prompt GPT-4 to automatically generate explanatory text for each API call, subsequently using BERT and CNN for semantic mapping and classification. Due to GPT-4’s strong generalization capability in interpreting unknown APIs, their method achieves zero-shot detection, naturally and aptly resolving the drift problem caused by API evolution, and attaining 100% recall in few-shot and cross-database scenarios. Complementing this work effectively, Xiaohan Zhang et al. [34] designed the API-Graph system from the perspective of feature space reconstruction. They first construct a knowledge graph encompassing entities like APIs and permissions and their relationships, then map APIs into a semantic vector space for clustering. Consequently, semantically similar APIs are positioned closely together in the feature space. Thus, even when new APIs emerge or original ones are replaced, the classifier can still make stable and reliable judgments based on semantic associations. In large-scale temporal evaluations spanning 2012 to 2018, this system reduced the required volume of samples for relabeling by 33% to 96%, and significantly slowed the rate of model performance degradation over time.

4. Findings and Discussion

In this section, we will first address the research questions posed in Section 2.4. Subsequently, we will present the findings of this review and engage in a discussion concerning the methodology itself, as well as the specific approaches employed within each category.

4.1. Responses to RQs

Response to RQ1: Concept drift can lead to a significant degradation in the performance of malware detection models over time [35]. As malware continuously evolves, the feature representations that were initially effective for the model gradually become obsolete, and newly emerging malicious samples cannot be correctly identified using old rules, resulting in increased false positive and false negative rates [36]. Ultimately, this accumulated drift undermines the model’s original decision boundary. If a high-performance detector is not adapted to concept drift, its detection accuracy will drop substantially, and it may even fail to recognize malware that has undergone “drifting” [37]. Therefore, concept drift is identified as the primary cause of the “aging” degradation in malware detection models, and mitigating it is essential to sustain model performance.

Response to RQ2: Research on concept drift in malware detection has undergone continuous evolution and paradigm shifts. In the early stage, researchers primarily focused on passively detecting the occurrence of drift: by monitoring the model’s prediction error rate, a significant increase would indicate the presence of concept drift and trigger model updates; concurrently, mechanisms like fixed or adaptive sliding windows were employed to cope with changes in data distribution. Subsequently, research emphasis shifted towards leveraging deep learning for representation alignment and domain adaptation techniques to mitigate the impact of temporal distribution shifts on model performance [38]. The idea of causal invariance modeling was also introduced to extract features that remain stable across different environments, thereby enhancing model robustness over time. Around 2020, a new approach of test-time adaptation emerged, enabling models to self-calibrate during deployment using unlabeled new data, thus bridging the gap between the training distribution and current data on the fly. In the current phase, defenses against concept drift have further integrated continuous learning and meta-learning paradigms, forming a closed-loop system for proactive adaptation: models continuously learn new concepts and avoid forgetting old knowledge through mechanisms like experience replay, while leveraging meta-learning to glean insights from historical drift patterns for rapid adjustment upon encountering future drifts [4]. In summary, the trajectory of concept drift research in malware detection has evolved from passive detection to proactive adaptation, from shallow rule-based features to deep representation invariance, and further towards continuous learning and a systematic closed-loop architecture.

Response to RQ3: In our review of the literature, we observe that current research in the field addresses the problem of concept drift in malware detection from multiple perspectives. At the process level, temporally aware data processing is primarily used to establish reliable baselines. At the deployment level, drift detection and explainability techniques are employed to prioritize samples for labeling. At the model level, approaches such as active learning combined with few-shot retraining, or deep representation learning coupled with test-time adaptation, are used to enhance generalization capabilities. More specifically, at the structural representation level, Graph Neural Networks (GNNs) and domain adaptation techniques have been introduced to learn cross-domain invariant features [4]. For long-term evolution scenarios, continual learning strategies utilizing replay and regularization techniques have been adopted to prevent catastrophic forgetting. For highly dynamic environments, meta-learning strategies have been introduced to enable rapid adaptation with very few samples. At the engineering level, knowledge enhancement and signature enhancement have been explored. Currently, enhanced machine learning methods, deep neural network models, and the application of continual learning strategies are the most commonly employed approaches. Although GNN and meta-learning methods show significant potential, the number of related studies is currently limited, necessitating further validation and implementation in real-world temporal and cross-platform scenarios.

Response to RQ4: Concept drift in the malware domain is intertwined with the evolution of adversarial attack strategies. Attackers continuously modify the features and carriers of malicious code to deliberately induce performance degradation in detection models, which constitutes a form of adversarially driven concept drift [39]. To counter this, detection systems need to integrate techniques such as adversarial training and concept drift detection. This approach aims to enhance model robustness against known adversarial strategies and strengthen its resistance to perturbations, while continuously monitoring for anomalous shifts in the input data distribution to promptly identify new drifts potentially caused by attackers and trigger model updates. A key challenge lies in distinguishing between normal concept evolution and adversarially driven distribution shifts, and making corresponding adjustments accordingly [39]. Future research could explore developing more sensitive drift detection algorithms, introducing online adversarial training mechanisms to improve model robustness, and enhancing threat intelligence analysis to anticipate potential attacker strategies. This would enable the preemptive deployment of countermeasures to mitigate the impact of malicious concept drift on detection systems.

4.2. Findings and Discussion from the Review

As illustrated in Figure 3a, enhanced Machine Learning (ML), Deep Neural Networks (DNN), and Continual Learning (CL) remain the dominant approaches in the 61 pieces of literature we reviewed. Together, these three constitute the main body of current research on defending against concept drift. In contrast, Graph Neural Networks (GNN) and Meta-Learning are in their infancy, showing a slow upward trend and primarily serving exploratory and supplementary roles. Figure 3b further presents the annual publication trends for various methods from 2020 to 2025. On one hand, the overall number of papers is steadily increasing, indicating that “how to defend against concept drift” is evolving from a niche issue into a routine research topic in malware detection. On the other hand, the trend lines for each method generally show an upward trajectory. Specifically, ML and DNN maintain a consistently high volume and proportion throughout the entire period. CL has exhibited significant growth in recent years, while GNN and Meta-Learning, though lower in number, demonstrate a slowly rising characteristic. This distribution reflects not only the research popularity of different technical routes but also the disparities in the accessibility of data, resources, and deployment conditions associated with these diverse methods.

Figure 3. Methodology distribution and temporal trends in ransomware detection research.

From a methodological perspective, this trend is highly correlated with the maturity of toolchains, training costs, and the reproducibility of annotation and evaluation protocols. ML and DNN, benefiting from mature toolchains and extensive experience in security scenarios, are more easily and rapidly iterated upon within existing detection systems, thus demonstrating greater operability in most research settings. The accelerated growth in CL reflects a gradual shift in the academic community’s mindset from “offline retraining” to “long-term online maintenance,” viewing concept drift as a temporal issue requiring continuous management. In contrast, although GNNs and Meta-Learning are theoretically better suited to addressing key challenges against drift, such as “modeling structural invariance” and “few-shot rapid adaptation,” their high model complexity, prohibitive training and evaluation costs, as well as the absence of unified benchmarks and mature engineering practice, currently limit the deployment of these models to a small set of high-complexity scenarios and prototype systems. This also implies that Figure 3a,b reveal a future research priority: rather than continuing to propose more complex models, efforts should focus on establishing unified evaluation and engineering validation pipelines for emerging approaches, ensuring their advantages can be reliably reproduced in real-world temporal environments.

As shown in Table 9, current methods essentially represent different trade-offs among robustness, labeling cost, and deployment overhead. Enhanced machine learning methods have a low implementation barrier, mature technology, and relatively low computational resource requirements. However, their approach to handling concept drift relies heavily on retraining, necessitating a trade-off between minimizing the detection gap and controlling computational costs. In contrast, deep neural networks possess powerful automatic feature extraction capabilities and can learn high-dimensional features that are stable over time, thus exhibiting a degree of inherent robustness to concept drift and simple obfuscation. Nevertheless, their training and inference processes demand substantial data and computational power, and their decision-making mechanism is inherently a “black box,” resulting in poor interpretability. Continual learning strategies mitigate performance degradation through online incremental updates, enabling knowledge accumulation and helping to avoid catastrophic forgetting. However, they also face challenges related to memory constraints and the risk of error accumulation. Graph neural networks model internal behaviors by leveraging program structure graphs, resisting concept drift by capturing time-invariant graph features and effectively handling complex dependencies. Combined with techniques like domain adaptation and contrastive learning, they help alleviate distributional discrepancies across different environments. Yet, their construction and training processes are highly complex, with significant inference overhead, posing considerable challenges for resource-constrained, practical deployments. Meta-learning strategies aim for rapid adaptation, allowing models to adjust quickly to new distributions with limited samples. However, this technology is still immature, characterized by high training costs and a lack of standardized evaluation paradigms, and remains in the exploratory phase.

Therefore, no single method is universally suitable for all concept drift scenarios, necessitating trade-offs between detection accuracy, real-time adaptability, interpretability, and resource consumption. Currently, most research efforts remain focused on the former categories of relatively mature methods (enhanced machine learning, deep neural networks, and continual learning strategies). In contrast, exploration of emerging directions such as graph neural networks and meta-learning is limited, and their effectiveness in real-world temporal scenarios requires further validation.

A more detailed analysis is presented in Table 10, where we selected representative methods from each category and compared their reported best F1 scores, ACC, and (where available) average detection time per sample, providing a coarse-grained horizontal comparison along the “performance–efficiency” dimension. Overall, most methods achieve high detection performance under their respective datasets and experimental settings—many approaches report F1 or ACC scores close to or exceeding 0.95. This indicates that regardless of the technical route chosen, as long as sufficient tuning is performed for the target scenario, considerable results can be achieved on static metrics. However, the differences in time overhead among methods are significant: the per-sample inference time for some deep learning and graph-based models (e.g., GreedyBlock, CADE, API2Vec++) ranges from hundreds to thousands of milliseconds, whereas some continual learning and architectural approaches (e.g., MalFSCIL, TAMD-IL) can compress the average detection time to milliseconds or even sub-milliseconds. At the same time, there are compromise solutions, such as MeMalDet, which maintains F1/ACC close to 99% while keeping latency at the tens-of-milliseconds level. This phenomenon suggests that in malware detection—a scenario emphasizing online timeliness and resource constraints—different approaches form distinct Pareto frontiers between accuracy and latency. Some lightweight solutions achieve usable performance with limited overhead, while the marginal benefits of certain high-complexity models may be offset by inference latency and maintenance costs. Therefore, simply increasing model complexity is not a universal solution; its effectiveness is highly dependent on deployment constraints and evaluation protocols. Future research should report accuracy, latency, and operational metrics simultaneously on public temporal benchmarks to avoid overestimating practical viability based solely on static indicators.

It should be emphasized that the primary value of Table 10 lies in providing a cross-method performance–efficiency coordinate framework. Since the values in the table are derived from the optimal results reported in the respective original studies, the datasets, experimental protocols, and hardware environments used across different methods are not entirely consistent. Some studies even only report training overhead or lack inference latency details. Therefore, these metrics are more suitable as references for “typical performance ranges” and “resource consumption magnitudes” rather than being simply interpreted as a strict horizontal ranking.

Table 9. Comparison of Malware Detection Methodologies.

Category	Advantages	Limitations	Maturity	Interpretability	Anti-Drift Mechanism	Resource Overhead
ML	Low complexity	Existence of detection gap	High	Strong	Periodic retraining	Proportional to retraining frequency
DNN	Powerful representation capabilities; automatic feature extraction	High cost; black-box nature	High	Poor	Inherent robustness to concept drift	High
GNN	Structural invariance; models software dependencies well	Complex graph construction	High	Medium	Graph structure stability; domain adaptation	High
CL	Online incremental updates	Catastrophic forgetting/error accumulation	Medium	Medium	Online updates; anti-forgetting mechanisms	Medium
Meta-L	Fast adaptation; significant theoretical potential	Immature; high training difficulty	Low	Poor	Prior knowledge from meta-tasks	High

Table 9. Comparison of Malware Detection Methodologies.

Category	Advantages	Limitations	Maturity	Interpretability	Anti-Drift Mechanism	Resource Overhead
ML	Low complexity	Existence of detection gap	High	Strong	Periodic retraining	Proportional to retraining frequency
DNN	Powerful representation capabilities; automatic feature extraction	High cost; black-box nature	High	Poor	Inherent robustness to concept drift	High
GNN	Structural invariance; models software dependencies well	Complex graph construction	High	Medium	Graph structure stability; domain adaptation	High
CL	Online incremental updates	Catastrophic forgetting/error accumulation	Medium	Medium	Online updates; anti-forgetting mechanisms	Medium
Meta-L	Fast adaptation; significant theoretical potential	Immature; high training difficulty	Low	Poor	Prior knowledge from meta-tasks	High

Table 10. Comparison of Method Performance and Efficiency.

	Method/Author	F1-Score	ACC	Avg. Detection Time per Sample (ms)
ML	ASDroid	95.7%	95.8%	-
	ECMT	76%	96%	-
	SCRR	86.5%	95.8%	-
	Li et al.	99.4%	99.7%	140
DNN	GreedyBlock	97.9%	96%	3337.9
	ACE	87.1%	87%	675.89
	MeMalDet	99.7%	99.7%	11.1
	CADE	96%	99.2%	3200
GNN	APIVec2++	99.4%	97.3%	919.9
	HeteroNet	-	97.3%	-
	Li et al.	99.7%	92%	-
CL	MalFSCIL	-	82.9%	0.36
	TAMD-IL	>95%	-	1.14 (Train)
	Chen et al.	93.5%	98.8%	-
Meta-L	Zhu et al.	97.9%	99.2%	-
	Meta-MAMC	94%	-	1113.28

Table 10. Comparison of Method Performance and Efficiency.

	Method/Author	F1-Score	ACC	Avg. Detection Time per Sample (ms)
ML	ASDroid	95.7%	95.8%	-
	ECMT	76%	96%	-
	SCRR	86.5%	95.8%	-
	Li et al.	99.4%	99.7%	140
DNN	GreedyBlock	97.9%	96%	3337.9
	ACE	87.1%	87%	675.89
	MeMalDet	99.7%	99.7%	11.1
	CADE	96%	99.2%	3200
GNN	APIVec2++	99.4%	97.3%	919.9
	HeteroNet	-	97.3%	-
	Li et al.	99.7%	92%	-
CL	MalFSCIL	-	82.9%	0.36
	TAMD-IL	>95%	-	1.14 (Train)
	Chen et al.	93.5%	98.8%	-
Meta-L	Zhu et al.	97.9%	99.2%	-
	Meta-MAMC	94%	-	1113.28

5. Challenges and Future Directions

In this section, we identify the following open issues and recommendations for future research aimed at addressing concept drift in malware detection.

A significant amount of existing work is still evaluated using “static random splitting” or weak temporal settings, lacking rigorous temporal partitioning and non-leakage protocols across years, platforms, and scenarios [7]. Furthermore, the coverage of different drift types is uneven, rendering models lacking robustness against various forms of drift. Public benchmarks have not been updated in a timely manner to reflect the latest empirically validated conclusions [40]. Future efforts require researchers to unify standards, establish public temporal benchmarks targeting multiple drift types, and introduce relevant metrics related to risk and operational dimensions to better characterize performance in practical deployment scenarios.

In real-world scenarios, difficulties in data acquisition and high annotation costs have long been a pervasive issue. As security vendors often retain high-value data for themselves, publicly available datasets are scarce and struggle to match target environments, making it challenging to obtain representative, accurately labeled data [41]. Future research urgently needs to develop weakly supervised or unsupervised learning methods. Concurrently, further promoting data sharing within the industry is essential to alleviate the bottlenecks of data scarcity and high annotation costs.

Currently, the datasets used across different studies often vary significantly, and the evaluation metrics are diverse and inconsistent, making horizontal comparison difficult. Future research needs to address this inconsistency in evaluation standards and standardize the evaluation metrics system [40].

The trade-off between high resource overhead and deployment practicality also presents a significant challenge; most high-performance detectors or classifiers entail substantial resource demands, yet practical deployment environments often have limited resources [42]. Future research should explore model compression, distillation, and lightweight network architectures, or combine cloud and edge computing to allocate computational tasks more reasonably and reduce the computational burden.

Research on meta-learning is relatively scarce and the training process is challenging. Future studies could introduce task-level data augmentation and meta-regularization strategies to improve the generalization ability of meta-learning. These approaches could also be combined with other methods, such as transfer learning or multi-task learning, to enrich the distribution of meta-training tasks [43]. It is hoped that future research will pay more attention to this promising direction.

The closed-loop capability of current systems remains insufficient, as most research focuses on specific aspects of drift detection or model updating in isolation, lacking an integrated framework encompassing detection, adaptation, and feedback [44]. Future research could design an integrated detection-learning framework that tightly couples drift detection, incremental training, and quality feedback.

In addition to reinforcement learning, continual learning, and meta-learning, two emerging directions in the malware detection field have recently attracted attention: domain generalization (DG) and test-time adaptation (TTA). Domain generalization emphasizes learning cross-time, cross-platform, or cross-environment stable discriminative representations using only source domain data during training, enabling the model to maintain robustness when deployed in unknown target environments without accessing target domain samples. Test-time adaptation, on the other hand, allows the model to perform lightweight updates or self-calibration using unlabeled test data during deployment, mitigating performance degradation caused by mismatches between the training distribution and the current data distribution. Compared with traditional “retrain after drift is detected” approaches, these two methods represent new paradigms for improving generalization beforehand (DG) and performing unsupervised adaptation on-the-fly (TTA), reflecting that concept drift research is shifting from passive response to proactive robustness [45].

In the context of malware detection, research on domain generalization has advanced in two directions: spurious correlation removal and invariant representation learning. For example, SCRR improves model stability in unknown deployment environments by decoupling and filtering out spurious features irrelevant to malicious behavior [16]. TIF constructs temporal environments based on the observation dates of application samples and explicitly learns temporally stable discriminative representations by combining multi-agent contrastive learning with invariant gradient alignment [46]. In addition, some works incorporate control flow graph representations and adversarial domain adaptation in Windows malware detection to learn drift-invariant features, achieving effective adaptation with only a few post-drift labeled samples [7]. Therefore, future drift-resilient detectors should not rely solely on fixed features or periodic retraining, but should instead place greater emphasis on modeling cross-environment transferability and cross-time invariance.

Regarding test-time adaptation, recent studies have attempted to allow detectors to directly leverage unlabeled incoming data for online calibration during testing. MADCAT adopts a self-supervised objective and performs test-time training on a small, balanced subset of test samples, thereby improving recognition performance for both old and newly arriving samples [37]. DREAM couples explainable drift detection with the adaptation process, significantly reducing the number of newly labeled samples required to achieve a given accuracy in Android malware classification updates [47]. Overall, TTA offers a feasible path for malware detection to rapidly absorb new distribution information at the deployment side without waiting for large-scale manual annotation. However, its long-term stability still depends on further solutions to issues such as pseudo-label quality control, sample arrival order, and error accumulation suppression.

6. Conclusions

This survey provides a comprehensive review of the concept drift problem in malware detection. Although previous studies have addressed concept drift, they have largely focused on specific platforms and lack a systematic and holistic investigation. This study elucidates the process by which concept drift occurs and describes how it progressively degrades detector performance. We also trace the developmental trajectory of concept drift research, covering the technological evolution from early error monitoring and sliding window mechanisms to deep representation learning, causal invariant modeling, and test-time adaptation, thereby providing a chronological reference framework for subsequent technology selection. Furthermore, this study proposes a taxonomy based on different paradigms to systematically categorize existing methods for addressing concept drift. Specifically, we classify current research into categories such as machine learning, deep neural networks, graph neural networks, continual learning, and meta-learning, summarizing these methods at both the methodological and specific research levels. This survey synthesizes state-of-the-art solutions and their evaluation results. We note that most works focus on active detection and continual learning strategies, while research on meta-learning remains significantly underexplored. We call for researchers to pay more attention to meta-learning in the future, as these methods still hold substantial untapped potential. Emerging approaches are beginning to focus on reducing reliance on labeled data and improving the interpretability of results. In summary, although various methods have been developed to improve model performance, significant challenges remain in terms of resource consumption, cross-scenario applicability, and evaluation consistency. This survey identifies current issues and suggests directions for future research, including the scarcity of meta-learning studies, inconsistent evaluation benchmarks and experimental protocols, a lack of real-world datasets and high-quality annotations, discrepancies in evaluation metrics across studies, and the high computational and storage overhead of high-performance models. Based on these findings, we suggest that future work should focus on optimizing and constructing meta-learning paradigms, establishing rigorous temporal evaluation standards, promptly updating public benchmarks, developing weakly supervised or unsupervised adaptation techniques, and designing more lightweight models or integrating cloud-based technologies to alleviate resource pressures.

In summary, this review systematically examines the current state and challenges of concept drift research in malware detection, proposes a novel taxonomy, and provides guidance for future work. As adversarial techniques in malware continue to evolve, ongoing, in-depth research into concept drift will be critical to ensuring long-term security in the years ahead.