{"id":"https://openalex.org/W7223484915","doi":"https://doi.org/10.1186/s42400-026-00691-3","title":"Explaining concept drift in windows PE malware with integrated gradients and behavioral analysis","display_name":"Explaining concept drift in windows PE malware with integrated gradients and behavioral analysis","publication_year":2026,"publication_date":"2026-11-04","ids":{"openalex":"https://openalex.org/W7223484915","doi":"https://doi.org/10.1186/s42400-026-00691-3"},"language":"en","primary_location":{"id":"doi:10.1186/s42400-026-00691-3","doi":"https://doi.org/10.1186/s42400-026-00691-3","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-026-00691-3","pdf_url":null,"source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["ccf-b","cwts-core","doaj","dongbi-c","jufo-1","norway-1","oarl","poland-20","russia-white-list-1"],"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"volume":null,"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1186/s42400-026-00691-3","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5007390093","display_name":"Numan Halit Guldemir","orcid":"https://orcid.org/0000-0003-1202-6841","observed_orcids":["https://orcid.org/0000-0003-1202-6841"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Numan Halit Guldemir","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0000-0003-1202-6841","affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072300664","display_name":"Oluwafemi Olukoya","orcid":"https://orcid.org/0000-0003-2771-2553","observed_orcids":["https://orcid.org/0000-0003-2771-2553"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Oluwafemi Olukoya","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5129227322","display_name":"Jesus Martinez-del-Rincon","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jes\u00fas Mart\u00ednez-del-Rinc\u00f3n","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":0,"currency":"USD","value_usd":0},"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.88182423,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"9","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.00039999998989515007,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/concept-drift","display_name":"concept drift","score":0.9570000171661377},{"id":"https://openalex.org/keywords/malware-family-classification","display_name":"malware family classification","score":0.7239999771118164},{"id":"https://openalex.org/keywords/integrated-gradients","display_name":"integrated gradients","score":0.7080000042915344},{"id":"https://openalex.org/keywords/dbscan","display_name":"DBSCAN","score":0.8410000205039978},{"id":"https://openalex.org/keywords/covariate-shift","display_name":"covariate shift","score":0.7870000004768372}],"concepts":[{"id":"https://openalex.org/C60777511","wikidata":"https://www.wikidata.org/wiki/Q3045002","display_name":"Concept drift","level":3,"score":0.833299994468689},{"id":"https://openalex.org/C2777548347","wikidata":"https://www.wikidata.org/wiki/Q5456937","display_name":"Flagging","level":2,"score":0.8271999955177307},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.6421999931335449},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6384000182151794},{"id":"https://openalex.org/C203519979","wikidata":"https://www.wikidata.org/wiki/Q865360","display_name":"Jaccard index","level":3,"score":0.5734000205993652},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5609999895095825},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5449000000953674},{"id":"https://openalex.org/C102944935","wikidata":"https://www.wikidata.org/wiki/Q4953701","display_name":"Bracketing (phenomenology)","level":2,"score":0.48350000381469727},{"id":"https://openalex.org/C2989277270","wikidata":"https://www.wikidata.org/wiki/Q168338","display_name":"Behavioral analysis","level":2,"score":0.42309999465942383},{"id":"https://openalex.org/C97931131","wikidata":"https://www.wikidata.org/wiki/Q5282087","display_name":"Discriminative model","level":2,"score":0.41449999809265137},{"id":"https://openalex.org/C83804111","wikidata":"https://www.wikidata.org/wiki/Q1063558","display_name":"Behavioral pattern","level":2,"score":0.4043000042438507},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3978999853134155},{"id":"https://openalex.org/C103278499","wikidata":"https://www.wikidata.org/wiki/Q254465","display_name":"Similarity (geometry)","level":3,"score":0.38909998536109924},{"id":"https://openalex.org/C207390915","wikidata":"https://www.wikidata.org/wiki/Q1230525","display_name":"Divergence (linguistics)","level":2,"score":0.3790999948978424},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.37599998712539673},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.3734999895095825},{"id":"https://openalex.org/C774472","wikidata":"https://www.wikidata.org/wiki/Q6760393","display_name":"Margin (machine learning)","level":2,"score":0.3628000020980835},{"id":"https://openalex.org/C149441793","wikidata":"https://www.wikidata.org/wiki/Q200726","display_name":"Probability distribution","level":2,"score":0.3458000123500824},{"id":"https://openalex.org/C119043178","wikidata":"https://www.wikidata.org/wiki/Q320723","display_name":"Covariate","level":2,"score":0.3379000127315521},{"id":"https://openalex.org/C42023084","wikidata":"https://www.wikidata.org/wiki/Q5249231","display_name":"Decision boundary","level":3,"score":0.336899995803833},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.3287999927997589},{"id":"https://openalex.org/C97399411","wikidata":"https://www.wikidata.org/wiki/Q825367","display_name":"Coin flipping","level":2,"score":0.32670000195503235},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.3172999918460846},{"id":"https://openalex.org/C108650721","wikidata":"https://www.wikidata.org/wiki/Q1783253","display_name":"Counterfactual thinking","level":2,"score":0.3165000081062317},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.31310001015663147},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.30820000171661377},{"id":"https://openalex.org/C94966114","wikidata":"https://www.wikidata.org/wiki/Q29256","display_name":"Black box","level":2,"score":0.30329999327659607},{"id":"https://openalex.org/C1921717","wikidata":"https://www.wikidata.org/wiki/Q1334846","display_name":"Mahalanobis distance","level":2,"score":0.2994999885559082},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.2962999939918518},{"id":"https://openalex.org/C62354387","wikidata":"https://www.wikidata.org/wiki/Q875399","display_name":"Boundary (topology)","level":2,"score":0.28139999508857727},{"id":"https://openalex.org/C2776836416","wikidata":"https://www.wikidata.org/wiki/Q1364844","display_name":"False alarm","level":2,"score":0.2754000127315521},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.2750000059604645},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.27149999141693115},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.26969999074935913},{"id":"https://openalex.org/C3770464","wikidata":"https://www.wikidata.org/wiki/Q775963","display_name":"Smoothing","level":2,"score":0.26840001344680786},{"id":"https://openalex.org/C95922358","wikidata":"https://www.wikidata.org/wiki/Q5432725","display_name":"False positive rate","level":2,"score":0.2630999982357025},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.2612999975681305},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.26089999079704285},{"id":"https://openalex.org/C170133592","wikidata":"https://www.wikidata.org/wiki/Q1806883","display_name":"Latent semantic analysis","level":2,"score":0.2549000084400177},{"id":"https://openalex.org/C87007009","wikidata":"https://www.wikidata.org/wiki/Q210832","display_name":"Statistical hypothesis testing","level":2,"score":0.25060001015663147}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1186/s42400-026-00691-3","doi":"https://doi.org/10.1186/s42400-026-00691-3","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-026-00691-3","pdf_url":null,"source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["ccf-b","cwts-core","doaj","dongbi-c","jufo-1","norway-1","oarl","poland-20","russia-white-list-1"],"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},{"id":"pmh:oai:pure.qub.ac.uk/portal:publications/054f54b4-c344-4463-80b6-314a6074fc75","doi":null,"is_oa":false,"landing_page_url":"https://pure.qub.ac.uk/en/publications/054f54b4-c344-4463-80b6-314a6074fc75","pdf_url":null,"source":{"id":"https://openalex.org/S4306402319","display_name":"Research Portal (Queen's University Belfast)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I126231945","host_organization_name":"Queen's University Belfast","host_organization_lineage":["https://openalex.org/I126231945"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Guldemir, N H, Olukoya, O & Martinez-del-Rincon, J 2026, 'Explaining concept drift in windows PE malware with integrated gradients and behavioral analysis', Cybersecurity.","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.1186/s42400-026-00691-3","doi":"https://doi.org/10.1186/s42400-026-00691-3","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-026-00691-3","pdf_url":null,"source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["ccf-b","cwts-core","doaj","dongbi-c","jufo-1","norway-1","oarl","poland-20","russia-white-list-1"],"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320328189","display_name":"Milli E\u011fitim Bakanli\u011fi","ror":"https://ror.org/00jga9g46"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7212199172","https://openalex.org/W4412152854","https://openalex.org/W7157506710","https://openalex.org/W7127606376","https://openalex.org/W7125804692","https://openalex.org/W7141839558","https://openalex.org/W4294672413","https://openalex.org/W7160014534","https://openalex.org/W2087211161","https://openalex.org/W4408749888"],"abstract_inverted_index":{"Abstract":[0],"Concept":[1],"drift":[2,25,39,55,91,181,192],"poses":[3],"a":[4,35,69,99,168],"major":[5],"challenge":[6],"for":[7],"long-lived":[8],"malware":[9,169,270],"family":[10],"classifiers.":[11],"While":[12],"drift-aware":[13],"systems":[14],"have":[15],"been":[16],"proposed,":[17],"most":[18],"remain":[19],"opaque,":[20],"flagging":[21],"or":[22],"adapting":[23],"to":[24,48,89,103,109,120,149,154],"but":[26,228],"rarely":[27],"explaining":[28],"why":[29],"it":[30],"occurs.":[31],"This":[32],"study":[33],"extends":[34],"triplet-autoencoder":[36],"and":[37,44,51,66,80,97,132,146,196,200,210,233,272],"DBSCAN-based":[38],"detection":[40],"framework":[41,245],"with":[42],"explainability":[43],"validation":[45,101],"components":[46],"designed":[47],"analyze":[49],"feature-":[50],"behavior-level":[52],"changes":[53],"underlying":[54],"decisions.":[56],"Static":[57],"Windows":[58,173],"PE":[59],"binaries":[60],"are":[61],"represented":[62],"using":[63,141],"EMBER":[64],"features":[65],"embedded":[67],"into":[68],"discriminative":[70],"latent":[71],"space,":[72],"where":[73],"family-specific":[74],"DBSCAN":[75],"clusters":[76],"define":[77,114],"decision":[78],"regions":[79],"per-family":[81],"distance":[82],"thresholds.":[83],"We":[84,113],"apply":[85],"Integrated":[86],"Gradients":[87],"(IG)":[88],"explain":[90],"decisions":[92],"at":[93],"the":[94,115,128,177,207,220,239,243,255],"feature":[95,226],"level":[96],"introduce":[98],"counterfactual":[100],"strategy":[102],"assess":[104],"whether":[105,156],"these":[106],"explanations":[107,189,250],"correspond":[108],"causally":[110],"meaningful":[111],"changes.":[112],"Drift":[116],"Correction":[117],"Rate":[118],"(DCR)":[119],"quantify":[121],"explanation":[122],"consistency.":[123],"IG":[124],"is":[125],"compared":[126],"against":[127],"model-agnostic":[129],"baselines":[130],"LIME":[131],"SHAP.":[133],"Separately,":[134],"we":[135],"conduct":[136],"an":[137],"independent":[138,256],"behavioral":[139,164,257],"analysis":[140,258],"capabilities":[142,232,271],"extracted":[143,231],"by":[144],"CAPA":[145],"their":[147],"mappings":[148],"MITRE":[150,234,273],"ATT&":[151,235,274],"CK":[152,236,275],"techniques":[153],"examine":[155],"samples":[157,217,265],"flagged":[158],"as":[159],"drifted":[160,216,264],"also":[161,229,266],"exhibit":[162],"observable":[163,269],"differences.":[165],"Experiments":[166],"on":[167,206],"dataset":[170],"spanning":[171],"multiple":[172],"families":[174,195],"show":[175,241],"that":[176,215,242,262],"detector":[178],"flags":[179],"covariate":[180],"in":[182,225,230,268],"approximately":[183],"30%":[184],"of":[185,251],"post-training":[186],"samples.":[187],"IG-based":[188],"achieve":[190],"near-perfect":[191],"correction":[193],"across":[194],"consistently":[197],"outperform":[198],"SHAP":[199],"LIME.":[201],"Behavioral":[202],"similarity":[203],"metrics":[204],"based":[205],"Jaccard":[208],"index":[209],"Jensen\u2013Shannon":[211],"divergence":[212],"further":[213],"indicate":[214],"diverge":[218],"from":[219],"training":[221],"distribution":[222],"not":[223],"only":[224],"space":[227],"techniques.":[237,276],"Overall,":[238],"results":[240],"proposed":[244],"provides":[246],"empirically":[247],"validated":[248],"feature-level":[249],"latent-space":[252],"drift,":[253],"while":[254],"offers":[259],"additional":[260],"evidence":[261],"many":[263],"differ":[267]},"counts_by_year":[],"updated_date":"2026-11-06T12:05:46.655746","created_date":"2026-10-25T00:00:00"}