FARM通过少样本自适应，应对恶意软件家族分类中的概念漂移问题。
FARM: Few-shot Adaptive Malware Family Classification under Concept Drift
- 用三元组自编码器将恶意软件映射到可区分的隐空间，实现无监督漂移检测。
- 在未见家族上达0.85平均F1，少样本适配后提升至0.94，漂移下性能提升5.6%。
- 适合动态威胁环境下需快速响应、标注资源有限的恶意软件检测场景。
恶意软件分类模型常因威胁环境演变和新型家族出现而面临概念漂移导致性能下降。本文提出FARM（少样本自适应恶意软件家族识别）框架，统一应对Windows可移植执行文件（PE）恶意软件家族分类中的协变量漂移与标签漂移。FARM采用三元组自编码器将样本投影至判别性隐空间，通过DBSCAN聚类与动态阈值实现无监督漂移检测。为支持快速适应，该框架引入少样本策略，仅需少量标注样本即可引入新类别；当漂移样本积累足够时，也支持全量重训练以实现长期更新。在BenchMFC数据集上的实验表明，FARM在协变量漂移下分类性能提升5.6%，对未见恶意软件家族的平均F1达到0.85，经少样本适配后升至0.94。结果表明，FARM为动态环境中标注受限的漂移感知恶意软件家族分类提供了有效方案。
原文摘要 · Abstract (English)
Malware classification models often suffer performance degradation under concept drift due to evolving threat landscapes and the emergence of novel malware families. This paper presents FARM (Few-shot Adaptive Recognition of Malware), a unified framework for detecting and adapting to both covariate drift and label drift in Windows Portable Executable (PE) malware family classification. FARM uses a triplet autoencoder to project samples into a discriminative latent space, enabling unsupervised drift detection through DBSCAN clustering and dynamic thresholding. To enable rapid adaptation, the framework employs a few-shot strategy that can incorporate new classes from only a small number of labeled samples. FARM also supports full retraining when sufficient drifted samples accumulate, allowing longer-term model updating. Experiments on the BenchMFC dataset show that FARM improves classification performance under covariate drift by 5.6%, and achieves an average F1 score of 0.85 on unseen malware families using few-shot adaptation, increasing to 0.94 after retraining. These results indicate that FARM provides an effective approach for drift-aware malware family classification in dynamic environments with limited supervision.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。