Chapter 4: Recent techniques and attacks (draft)¶

Status: draft written by Claude Code for the researcher to rewrite, verify and defend. Fact-checked on 22 Oct 2026: every statistic below was compared with the abstract of its source (the arXiv abstract text, a publisher or proceedings page, or a Crossref record) and carries a literature claim id (docs/CLAIMS.md, rows L-01 to L-31) with the source and the access date. None of the full papers was read, so a sentence says what an abstract says, not what the paper proves; where a reading of the full paper is needed, the sentence says so. The chapter is written from the defender’s side: it says what kinds of techniques exist and what they imply for evaluation, and it contains no recipe for building evasive malware (hard rule 12; docs/ETHICS.md). Target length: about 12 pages; this draft is shorter on purpose, because it reports abstracts and not full papers.

4.1 Why this chapter exists¶

The study measures how long a detector stays useful when labels arrive late. That question sits inside a larger and fast-moving field. This chapter lists what has been published recently on the three things that decide a detector’s lifetime: how drift is handled, how an adversary can shorten the lifetime on purpose, and what language models bring to the analyst’s side of the loop. It exists so that chapter 5 and the discussion in chapter 8 can say which of these the study does not address.

4.2 Handling drift: training, adaptation and detection¶

Three families appear in the 2024 to 2026 abstracts read for this draft.

Training for stability. TIF (Zheng et al., arXiv 2502.05098, submitted 7 Feb 2025, accepted by IEEE Transactions on Software Engineering according to the arXiv comment) groups training data into environments by the date an app was observed and combines multi-proxy contrastive learning with invariant gradient alignment, so that features that are stable across periods are preferred over features that matter only in one. Its abstract reports that it excels on a decade-long dataset, “particularly in early deployment stages” [L-01]. The idea attacks decay at its source and is complementary to buying labels.

Adaptation without, or with few, true labels. ADAPT (Alam, Piplai and Rastogi, arXiv 2507.08597, 11 Jul 2025) uses pseudo-labels from unlabeled data and reports experiments on five datasets across Android, Windows and PDF [L-02]. LFreeDA (Li and Bertino, arXiv 2511.14963, 18 Nov 2025) adapts a Windows detector with pseudo-labels from unsupervised domain adaptation; it reports gains of up to 12.6% in accuracy and 11.1% in F1 over no adaptation, being 4% (accuracy) and 3.4% (F1) below fully supervised upper bounds, and matching methods that are given ground-truth labels for 300 target samples [L-03]. MADCAT (Roh et al., arXiv 2505.18734, 24 May 2025) adapts at test time by training the encoder on a small, balanced subset of the test data [L-04]. These methods spend no analyst time, which makes them a natural zero-budget reference for the budget axis of this study.

Selecting what to label and detecting drift. Chen, Ding and Wagner (USENIX Security 2023) combine contrastive learning with active learning to choose samples for analysts [L-11]. DREAM (He et al., arXiv 2405.04095, 7 May 2024; ACM CCS 2025 according to the arXiv comment) detects drifting samples in a contrastive autoencoder and reports that, for a Drebin classifier, it reaches the same accuracy with 76.6% fewer newly labelled samples than the best existing methods [L-05]. Minnei et al. (arXiv 2603.28396, 30 Mar 2026) combine active and semi-supervised learning on Android and Windows and report annotation cost cut by up to 90% at detection performance comparable to full-label retraining [L-06]. Structure-based drift measures from decision-tree rulesets are studied on EMBER2024 by Kalny et al. (arXiv 2604.22629, 24 Apr 2026), who find that fixed two-month windows with feature-level Pearson correlation were the most reliable configuration and that no single method dominates [L-07].

What these abstracts do not say is how late the labels are or what a fixed per-period budget costs; the delay and the budget enter the study as parameters.

4.3 Evaluation: benchmarks and the evaluation trap¶

LAMDA, the Android benchmark used here, spans 12 years (2013 to 2025, without 2015) with over one million samples, about 37% malware and 1,380 malware families according to its arXiv abstract; an ICLR 2026 poster page for it exists [L-08]. The sizes used in this study, counted from the data, are in CLAIMS D-01 and D-02. McNdroid (Kamol et al., arXiv 2605.06894, 7 May 2026) covers the same years with static, dynamic and call-graph features and reports degradation over growing train-test gaps [L-09]. For Windows PE, the datasets used here are BODMAS and, if Tier 3 were run, EMBER2024 [L-30].

Two evaluation points recur. First, results depend strongly on how time is cut: the extended TESSERACT paper and Chow et al. (arXiv 2506.23814, discussed in chapter 5) identify factors that move reported performance even with temporal splits [L-22, L-23]. Second, confidence is not free: Aurora (Herzog, Eusebi and Cavallaro, arXiv 2505.22843, 28 May 2025, revised 21 Jan 2026) asks whether the confidence estimates that selective and active methods rely on are trustworthy, and reports fragility in state-of-the-art frameworks across datasets of varying drift severity [L-10]. That is a caution for any uncertainty- or credibility-based selector, including those of RQ3, and chapter 7 section 7.5 reports that E3 does not show that credibility adds anything over uncertainty (the two selectors’ advantages over random, CLAIMS E-43).

A third point concerns drift detectors themselves. Cerqueira et al. (arXiv 2606.07789) benchmark 14 drift detection methods on 7 real-world datasets and score them with timing-aware criteria such as an F1 detection score and a normalised detection time [L-31]. The monitor scores of this study (alarm precision, recall and detection delay against drop events in F1, chapter 6 section 6.12) follow the same idea of scoring detectors by whether and how soon they fire, but they are not that paper’s metrics, and the study does not claim they are comparable with its numbers.

4.4 Adversaries¶

An adversary does not wait for drift. In the problem space, an attacker modifies a malicious file so that it keeps its behaviour but changes what the classifier sees; in the feature space, the change is applied to the features directly, which is easier to study and usually less realistic. Surveys organise the literature by attack domain and generation technique (Aryal, Gupta, Abdelsalam, Kunwar and Thuraisingham, “A Survey on Adversarial Attacks for Malware Analysis”, IEEE Access 13:428-459, 2025 issue, record created 18 Dec 2024; the arXiv text 2111.08223 is an earlier version by three of the authors [L-26]) and by the assumptions, attacks and defenses of the “arms race” (Li, Li, Ye and Xu, arXiv 2005.11671; ACM Computing Surveys 55(1), article 15). One finding of the latter’s abstract is that the effectiveness of practical evasion depends largely on how much freedom the attacker has in the problem space, and that adversarial training depends on the defender’s ability to identify the most powerful attack [L-25].

What this means for the study: the datasets here record natural time evolution; the study measures decay from drift only and does not model an adaptive adversary. A detector that looks durable here is not thereby robust to evasion. The repository contains no attack code (docs/ETHICS.md).

4.5 Language models on the analyst’s side¶

Recent papers (read at abstract level on 22 Oct 2026) evaluate language models for malicious-code analysis: a benchmark of 13 models on 4,070 PyPI packages that recommends them for initial triage, because they detect a malicious package better than they pinpoint its indicators (arXiv 2602.16304) [L-27]; a study of Windows executables decompiled with Ghidra, which concludes that standard models cannot yet replace traditional anti-virus software and that a fine-tuned model degrades on newer malware (arXiv 2601.09035) [L-28]; and a retrieval-augmented system for JAR files (arXiv 2510.15567) [L-29]. For this study the relevance is on the label side: if language models shorten the time an analyst needs to label a sample, the delay shrinks and the budget grows, which the grid can read. No language model is used here, and none of these papers measures labelling time.

4.6 What remains open in this chapter¶

The statistics are abstract-level. Opening each paper and checking the quoted statistic against the paper would turn “the abstract reports” into “the paper shows”; that is the researcher’s reading, and the sentences above are worded so that they stay true either way.
A 2025 or 2026 survey on problem-space attacks and defenses was not found in a search on 2026-10-15; the two surveys above are the ones read.
Section 4.5 was cut to one paragraph on 22 Oct 2026 at the researcher’s decision, because it adds no evidence to the study. If the faculty report has a page limit, the guide allows compressing chapters 2 to 4 first; the rest of this chapter can be cut to a page by keeping the three family headings and one sentence each.