Loading...
Overcoming Concept Drift and Catastrophic Forgetting: Designing and Evaluating Deep Learning Architectures for Behavioral Malware Detection using Sysmon Data
Author(s)
Thaibkhuang, Surapit
Laungwilawan, Sorawit
Ruangdech, Suppanat
Pongpisutsopa, Suchittra
Wonggate, Chalermchai
Promwikorn, Waraporn
Date Issued
January 1, 2025
Type
Conference Paper
Abstract
In dynamic cybersecurity environments, traditional signature-based malware detection systems struggle to identify novel threats due to their reliance on static patterns. This study proposes a deep learning-based approach for behavioral malware detection using Sysmon logs, addressing two critical challenges: concept drift and catastrophic forgetting. The main contribution lies in a comprehensive comparative evaluation of four neural architectures CNN-only, CNN-BiLSTM with and without attention were evaluated alongside two continual learning strategies: fine-tuning and rehearsal. Experimental results demonstrate that fine-tuning enhances adaptability to new threats but severely degrades performance on previously learned data. In contrast, rehearsal-based incremental learning effectively mitigates forgetting while maintaining high detection accuracy across evolving datasets. Hybrid models incorporating attention mechanisms showed superior robustness. These findings underscore the importance of combining suitable neural architectures with continual learning techniques to build resilient and adaptive Endpoint Detection and Response (EDR) systems capable of handling real-world malware evolution. Future work includes collecting comprehensive real-world behavioral datasets, applying advanced continual learning strategies and exploring Graph Neural Networks or Transformers to improve detection robustness and adaptability.
Citation
Temscon Aspac 2025 4th IEEE Technology and Engineering Management Conference Asia Pacific, 2025