MalTree: Tracing Malware Evolution from Embeddings at Scale

• URL: http://arxiv.org/abs/2606.06570v1
• Date: Thu, 04 Jun 2026 17:51:49 GMT
• Title: MalTree: Tracing Malware Evolution from Embeddings at Scale
• Abstract summary: MalTree is a framework that applies bioinformatics inspired phylogenetic techniques at scale to model malware evolution.<n>Our analysis shows that some families mutate over 10 times faster than others, suggesting that detection strategies should be tailored to family-specific evolutionary tempos.
• Score: 3.147593802429888
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Malware detection remains largely reactive: machine learning models trained on known samples degrade as threats evolve. Understanding evolutionary relationships among malware families can inform proactive defense, but traditional reverse engineering can take months to years to uncover such lineage relationships. We propose MalTree, a framework that applies bioinformatics inspired phylogenetic techniques (UPGMA and Neighbor-Joining) at scale to model malware evolution automatically using structural, behavioral, and image-based features. We introduce temporal validation using VirusTotal timestamps to assess whether inferred trees reflect actual evolutionary order. MalTree achieves 87% temporal consistency, indicating that inferred evolutionary relationships closely align with real-world emergence timelines. Our analysis shows that some families mutate over 10 times faster than others, suggesting that detection strategies should be tailored to family-specific evolutionary tempos. Case studies, including the Mirai botnet, confirm that inferred relationships from our phylogenetic tree align with documented threat intelligence. Our framework provides a foundation for shifting malware analysis from sample-by-sample classification toward lineage-aware evolutionary modeling.

Related papers

• What Does Animal Re-Identification Learn? Linear Biological Concepts and Their Origins in Visual Representations [52.11506532642883]
  We show that sex and age emerge as linear directions that generalize to held-out individuals.<n>We also show that sex direction is causally used by the model, flipping a significant fraction of predictions to the opposite sex.
  arXiv  Detail & Related papers  (2026-09-05T10:46:27Z)
• Applications of temporal graph learning for predicting the dynamics of biological systems [2.1485350418225244]
  We investigate an alternative temporal graph-based perspective in which cellular states are represented through pseudotime-resolved gene regulatory networks.<n>For link prediction and centrality forecasting, temporal graph learning captures non-trivial regulatory dynamics and enables the identification of temporally important gene hubs.
  arXiv  Detail & Related papers  (2026-05-27T15:57:40Z)
• Detecting and Explaining Malware Family Evolution Using Rule-Based Drift Analysis [0.0]
  Malware detection and classification into families are critical tasks in cybersecurity.<n>This evolution introduces concept drift, in which the statistical properties of malware features change over time.<n>We propose an interpretable approach to concept drift detection.
  arXiv  Detail & Related papers  (2026-02-03T13:07:14Z)
• MASCOT: Analyzing Malware Evolution Through A Well-Curated Source Code Dataset [1.4287348604206223]
  This paper introduces a manually-reviewed malware source code dataset containing 6032 specimens.<n>At an overall view, this analysis quantifies the strength and direction of connections among specimens and categories.<n>At a detailed view, it traces the evolutionary histories of individual specimens.
  arXiv  Detail & Related papers  (2025-11-30T05:26:23Z)
• Your Agent May Misevolve: Emergent Risks in Self-evolving LLM Agents [58.69865074060139]
  We study the case where an agent's self-evolution deviates in unintended ways, leading to undesirable or even harmful outcomes.<n>Our empirical findings reveal that misevolution is a widespread risk, affecting agents built even on top-tier LLMs.<n>We discuss potential mitigation strategies to inspire further research on building safer and more trustworthy self-evolving agents.
  arXiv  Detail & Related papers  (2025-09-30T14:55:55Z)
• Deep Learning Models for Robust Facial Liveness Detection [56.08694048252482]
  This study introduces a robust solution through novel deep learning models addressing the deficiencies in contemporary anti-spoofing techniques.<n>By innovatively integrating texture analysis and reflective properties associated with genuine human traits, our models distinguish authentic presence from replicas with remarkable precision.
  arXiv  Detail & Related papers  (2025-08-12T17:19:20Z)
• PhyloGen: Language Model-Enhanced Phylogenetic Inference via Graph Structure Generation [50.80441546742053]
  Phylogenetic trees elucidate evolutionary relationships among species.<n>Traditional Markov Chain Monte Carlo methods face slow convergence and computational burdens.<n>We propose PhyloGen, a novel method leveraging a pre-trained genomic language model.
  arXiv  Detail & Related papers  (2024-12-25T08:33:05Z)
• ADIOS: Antibody Development via Opponent Shaping [49.26728828005039]
  Anti-viral therapies are typically designed to target only the current strains of a virus.<n>However, therapy-induced selective pressures drive the emergence of new viral strains.<n>This evolutionary response presents an opportunity: our therapies could both defend against and actively influence viral evolution.
  arXiv  Detail & Related papers  (2024-09-16T14:56:27Z)
• Learning the Evolutionary and Multi-scale Graph Structure for Multivariate Time Series Forecasting [50.901984244738806]
  We show how to model the evolutionary and multi-scale interactions of time series. In particular, we first provide a hierarchical graph structure cooperated with the dilated convolution to capture the scale-specific correlations. A unified neural network is provided to integrate the components above to get the final prediction.
  arXiv  Detail & Related papers  (2022-06-28T08:11:12Z)
• Biologically-plausible backpropagation through arbitrary timespans via local neuromodulators [1.1744028458220428]
  We propose that extra-synaptic diffusion of local neuroulatormods may afford an effective mode of backpropagation lying within the bounds of biological plausibility. We show that our approximate gradient-based update rule, ModProp, propagates credit information through arbitrary time steps.
  arXiv  Detail & Related papers  (2022-06-02T23:38:10Z)
• Word Embedding Techniques for Malware Evolution Detection [4.111899441919165]
  We perform a variety of experiments aimed at detecting points in time where a malware family has likely evolved. Several malware families are analyzed, each of which includes a number of samples collected over an extended period of time. Our experiments indicate that improved results are obtained using feature engineering based on word embedding techniques.
  arXiv  Detail & Related papers  (2021-03-07T14:55:32Z)
• Adversarial vs behavioural-based defensive AI with joint, continual and active learning: automated evaluation of robustness to deception, poisoning and concept drift [62.997667081978825]
  Recent advancements in Artificial Intelligence (AI) have brought new capabilities to behavioural analysis (UEBA) for cyber-security. In this paper, we present a solution to effectively mitigate this attack by improving the detection process and efficiently leveraging human expertise.
  arXiv  Detail & Related papers  (2020-01-13T13:54:36Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.