DriftWatch

DriftWatch is an open-source study of how long a malware detector stays useful as malware changes. It applies one time-aware evaluation protocol (TESSERACT constraints C1 to C3, reported with AUT and A-AUT) to pre-extracted feature files from LAMDA (Android) and BODMAS (Windows PE), and asks how label delay, a fixed analyst budget and conformal drift monitoring change a detector’s lifetime.

It never downloads, runs or redistributes malware. It describes how detectors decay, not how to evade them (ethics).

Start here

The study

Architecture

Decisions and evidence

Data, licences and ethics

Operating the project