KMITL

Permanent URI for this communityhttps://dspace.kmitl.ac.th/handle/123456789/1

Browse

Settings

Author: search.filters.author.Laungwilawan, SorawitSubject: search.filters.subject.Malware detection

Search Results

Now showing 1 - 1 of 1
  • Loading...
    Thumbnail Image
    Some of the metrics are blocked by your 
    consent settings
    Item type:Publication,
    Overcoming Concept Drift and Catastrophic Forgetting: Designing and Evaluating Deep Learning Architectures for Behavioral Malware Detection using Sysmon Data
    (2025-01-01)
    Thaibkhuang, Surapit
    ;
    Laungwilawan, Sorawit
    ;
    Pomsathit, Auttapon
    ;
    Ruangdech, Suppanat
    ;
    Pongpisutsopa, Suchittra
    In dynamic cybersecurity environments, traditional signature-based malware detection systems struggle to identify novel threats due to their reliance on static patterns. This study proposes a deep learning-based approach for behavioral malware detection using Sysmon logs, addressing two critical challenges: concept drift and catastrophic forgetting. The main contribution lies in a comprehensive comparative evaluation of four neural architectures CNN-only, CNN-BiLSTM with and without attention were evaluated alongside two continual learning strategies: fine-tuning and rehearsal. Experimental results demonstrate that fine-tuning enhances adaptability to new threats but severely degrades performance on previously learned data. In contrast, rehearsal-based incremental learning effectively mitigates forgetting while maintaining high detection accuracy across evolving datasets. Hybrid models incorporating attention mechanisms showed superior robustness. These findings underscore the importance of combining suitable neural architectures with continual learning techniques to build resilient and adaptive Endpoint Detection and Response (EDR) systems capable of handling real-world malware evolution. Future work includes collecting comprehensive real-world behavioral datasets, applying advanced continual learning strategies and exploring Graph Neural Networks or Transformers to improve detection robustness and adaptability.