Integrated Gradients and Behavioral Analysis Explain Malware Evolution and Concept Drift

Researchers have introduced an explainable artificial intelligence framework combining Integrated Gradients and post-hoc behavioral analysis to identify and validate the structural and functional changes that trigger concept drift in Windows malware classifiers. Published in the journal Cybersecurity, the study addresses a critical operational limitation in automated threat defense: while modern drift-aware machine learning architectures can flag when incoming malicious binaries diverge from historical training distributions, they typically operate as opaque black boxes that cannot pinpoint the exact features responsible for the shift. To resolve this opacity, the research team developed a three-stage pipeline that couples a family-discriminative latent space detector with gradient-based feature attribution and counterfactual validation, while independently verifying behavioral divergence using automated capability extraction and adversarial technique mapping. Testing the approach on an eight-family Windows Portable Executable dataset from BenchMFC containing eight thousand total binaries demonstrated that the framework consistently explains and reverses model-detected drift decisions across diverse malware lineages, revealing how evolving programs systematically alter their static components and execution patterns over time.

In modern cybersecurity operations, machine learning classifiers provide scalable and automated sorting of executable files, yet their long-term efficacy is continuously challenged by concept drift. According to industry statistics cited from AV-Test, security monitoring systems register more than two hundred thousand new Windows Portable Executable samples every day, presenting an immense volume of structurally or functionally modified software designed to achieve malicious goals while avoiding detection signatures. In the malware domain, concept drift predominantly manifests along two distinct axes: label drift, where entirely novel malware families emerge without historical precedents, and covariate drift, where existing families steadily evolve their internal code or metadata while preserving their core malicious intent. Over extended deployment horizons, this ongoing distributional shift degrades model accuracy and makes static classifiers increasingly unreliable, highlighting the urgent necessity for diagnostic tools that do not merely flag distributional divergence, but provide actionable explanations of the underlying engineering changes driving classifier degradation.

The experimental framework builds upon an unsupervised latent-space drift detection architecture that models malware families through a triplet-loss autoencoder and density-based spatial clustering. Each executable binary is initially converted into a static vector using the standard EMBER representation, which extracts numerical properties across header fields, imported library functions, and section metadata. To standardize feature scales and stabilize training, the researchers apply a QuantileTransformer to map marginal feature distributions to a common range, followed by variance thresholding that discards near-constant dimensions, compressing the raw representation from two thousand three hundred eighty-one dimensions to one thousand eight hundred thirty features. An architecturally symmetric autoencoder then maps these vectors through fully connected encoder layers of dimension one thousand twenty-four, two hundred fifty-six, and thirty-two, regularized with batch normalization, rectified linear units, and dropout. Training simultaneously optimizes a mean squared error reconstruction loss alongside a margin-based triplet loss, forcing latent representations within the same family into tight clusters while enforcing wide geometric separation between distinct family groupings.

Once the thirty-two-dimensional latent space is established, the system characterizes the boundary of each known family by executing the DBSCAN clustering algorithm over training embeddings. For each family cluster, the neighborhood radius parameter is determined through a k-distance elbow heuristic, and the minimum points threshold is configured proportionally to latent dimensionality. Retaining only verified inlier embeddings, the framework calculates the cluster centroid and sets a family-specific boundary threshold equal to the maximum Euclidean distance observed between the centroid and any constituent inlier. During inference on newly observed binaries, the encoder projects each test vector into the thirty-two-dimensional space, and the system evaluates a drift score defined as the minimum difference between the sample’s distance to a family centroid and that family’s calibrated boundary threshold. Whenever this score is non-positive, the binary resides within at least one learned family sphere and is classified as an inlier, but once the score exceeds zero, the binary is formally flagged as drifted.

Because the distance-based drift score is mathematically differentiable end-to-end through the neural encoder, the authors apply Integrated Gradients as a principled white-box feature attribution mechanism. Unlike heuristic approximations, Integrated Gradients provides formal axiomatic guarantees, including sensitivity and implementation invariance, making it well suited for tracking subtle numerical perturbations across high-dimensional static features. To explain a drifted binary, the system establishes a representative in-family baseline chosen as the specific training sample positioned closest to the assigned family centroid in latent space. The attribution algorithm then approximates a path integral of the score’s gradients along a straight-line interpolation between this baseline and the drifted sample using a discrete Riemann sum. Backpropagating through the encoder network and distance metrics yields signed attribution scores for all one thousand eight hundred thirty features, with positive values indicating the specific attributes that pushed the sample beyond the calibrated family boundary.

To verify whether ranked feature attributions reflect genuine causal mechanisms rather than incidental correlations, the framework introduces a counterfactual validation protocol. Starting with a drifted binary, the system constructs a sequence of counterfactual candidates by replacing the most positively attributed features with corresponding values from the representative in-family training reference. Crucially, these replacements are restricted to empirically observed values from real training binaries rather than arbitrary synthetic values, anchoring every edit to authentic malware samples. Following each cumulative substitution, the autoencoder re-evaluates the latent drift score, halting the sequence as soon as the score drops to zero or below, which indicates that the modified representation has moved back inside the family decision region. The researchers formally define the Drift Correction Rate as the proportion of drifted binaries within a family whose drift status is reversed through this ranking, offering a quantitative metric to evaluate explanation relevance and consistency.

The researchers conducted empirical evaluations using the standardized BenchMFC dataset, focusing on eight well-documented Windows malware families: fareit, gandcrab, hotbar, parite, simda, upatre, yuner, and zbot. Each family provided an evenly balanced temporal partition consisting of five hundred historical training samples and five hundred chronologically later evolving samples, creating an eight-thousand-sample corpus curated to examine within-family covariate drift over time. Temporal classification curves without drift filtering confirmed that static classifiers exhibited notable degradation over subsequent time bins, with families like simda, upatre, and fareit showing marked drops in F1 score, precision, and recall, whereas hotbar and yuner remained relatively stable. Evaluating the fixed latent-space detector across all four thousand evolving binaries revealed that one thousand two hundred sixty-one samples—amounting to approximately thirty-one point five percent—were formally flagged as drifted. Drift prevalence varied widely across families, reaching high counts in upatre, zbot, and simda, while hotbar exhibited minimal drift and yuner produced zero drifted samples.

In counterfactual validation experiments without a fixed edit budget, Integrated Gradients demonstrated clear superiority over widely used model-agnostic explanation baselines, including Local Interpretable Model-Agnostic Explanations and Shapley Additive Explanations. Integrated Gradients achieved a near-perfect Drift Correction Rate across all families where drift occurred, successfully guiding almost every drifted sample back across its family threshold using moderate cumulative feature prefixes. While SHAP occasionally reversed drift using very short edit sequences, its overall correction rate was inconsistent across families, and LIME suffered from substantially lower correction rates and diffuse rankings, particularly on complex families such as simda, upatre, and zbot. Furthermore, when assessed under strict edit budgets using the budgeted DCR@k metric against an adapted CADE mask baseline, Integrated Gradients consistently placed decision-reversing features earlier in cumulative replacement sequences. For families such as hotbar, parite, and zbot, Integrated Gradients restored family membership within ten edits with median requirements between one and four substitutions, whereas CADE achieved lower budgeted rates across most families.

The budgeted counterfactual analysis uncovered distinct structural variations in how different malware families evolve over time, showing that drift is not always concentrated within a handful of isolated attributes. While certain families yielded to minimal edits, gandcrab and upatre proved substantially more resistant under tight modification budgets, correcting only thirty-five point four percent and thirty-nine point one percent of their drifted samples within a twenty-edit limit. However, when the allowance expanded to fifty cumulative edits, the Drift Correction Rate for gandcrab and upatre rose sharply to ninety-eight point one percent and ninety-one point nine percent, respectively, with both families exhibiting a median requirement of twenty-five edits. These findings indicate that while some malware variants diverge due to sharp localized adjustments in header or metadata definitions, others undergo broadly distributed covariate drift where decision-level divergence results from coordinated shifts scattered across dozens of individual static components.

To complement static feature attributions with functional context, the authors executed an independent post-hoc behavioral investigation using the CAPA automated capability extraction engine and MITRE ATT&CK technique taxonomies. Importantly, CAPA was executed entirely downstream of drift detection without providing input to the latent detector, attribution models, or counterfactual procedures, preserving complete analytical independence. By parsing code sequences, imports, string constants, and byte patterns, CAPA abstracted binaries into concrete functional capabilities, such as process injection or credential access, and mapped them to standardized adversarial techniques. The researchers quantified behavioral divergence between training baselines, non-drift inliers, and drifted cohorts using Jaccard similarity to assess vocabulary overlap and Jensen-Shannon divergence to measure shifts in relative behavioral prevalence. The evaluation revealed pronounced functional divergence for families such as fareit, gandcrab, and upatre, where drifted partitions displayed diminished Jaccard overlap and elevated divergence relative to historical training profiles. However, this separation was not uniform: parite, hotbar, and simda demonstrated more nuanced behavioral shifts, while zbot exhibited no consistent increase in behavioral distance, and yuner provided no comparison due to an absence of drifted samples. The authors emphasize that these discrepancies stem from fundamental differences in abstraction between low-level EMBER static representations and high-level behavioral taxonomies. Threat actors can refactor underlying binary structures, compilation options, or packing schemes without altering high-level execution behaviors, altering static vectors while preserving functional signatures. Consequently, post-hoc behavioral profiling delivers valuable corroborating intelligence when functional shifts occur, while counterfactual feature attribution remains the foundational mechanism for explaining internal model decisions in static malware classification.

Subject of Research: Explainable artificial intelligence and behavioral analysis for concept drift in Windows malware

Article Title: Explaining concept drift in windows PE malware with integrated gradients and behavioral analysis

Article References: Guldemir, N. H., Olukoya, O., & Martínez-del-Rincón, J. (2026). Explaining concept drift in windows PE malware with integrated gradients and behavioral analysis. Cybersecurity, 9(1), Article 254. https://doi.org/10.1186/s42400-026-00691-3

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00691-3

Keywords: malware detection, concept drift, integrated gradients, explainable artificial intelligence, cybersecurity, counterfactual validation, CAPA, MITRE ATT&CK, Explaining, concept, drift, windows