Detecting and Explaining Malware Family Evolution Using Rule-Based Drift Analysis
Olha Jurečková 1 , and Martin Jureček 1 1 Faculty of Information Technology, Czech Technical University in Prague, Thákurova 9 , Prague, 16000, Czech Republic { jurecolh, martin.jurecek } @fit.cvut.cz · 2026
Read Detecting and Explaining Malware Family Evolution Using Rule-Based Drift Analysis by Olha Jurečková 1 , and Martin Jureček 1 1 Faculty of Information Technology, Czech Technical University in Prague, Thákurova 9 , Prague, 16000, Czech Republic { jurecolh, martin.jurecek } @fit.cvut.cz (2026) in the Tower of Babel, a free online library of public-domain works preserved in clean, searchable text. No sign-up. The full text is served as a plain-text file at a predictable URL, where text is present: https://antarctic-labs.com/tower-of-babel/arxiv-2602-03489.txt.
Description
Malware families mutate to dodge detectors, and that drift quietly degrades machine learning models trained on older samples. Olha Jurečková and Martin Jureček propose an interpretable way to track the change in a 2026 paper. Instead of opaque scores, their method describes malware with a rule-based classifier whose rules a human can read.
The classifier writes rule sets for both original and evolved samples of the same family. A similarity function compares the sets to detect and quantify drift. The comparison names the exact features and values that changed, explaining how the family learned to bypass detection. Experiments show accurate drift detection plus practical insight for analysts defending against evolving malware.
Catalog record
| CREATOR | Olha Jurečková 1 , and Martin Jureček 1 1 Faculty of Information Technology, Czech Technical University in Prague, Thákurova 9 , Prague, 16000, Czech Republic { jurecolh, martin.jurecek } @fit.cvut.cz |
|---|---|
| YEAR | 2026 |
| COLLECTION | PAPERS |
| FORMAT | TXT |
| FILE SIZE | 31 KB |
| VERSION | 1.0 |
| LICENSE | http://creativecommons.org/licenses/by/4.0/ |
| RIGHTS | CC BY |
| SOURCE | arXiv |
Source: https://arxiv.org/abs/2602-03489