Mark Stamp

The paper proposes a structural method using decision tree rulesets and multiple complementary metrics to detect concept drift in evolving malware families, finding that fixed-interval windowing with feature-level Pearson correlation is the most reliable approach.