cs.CRMay 28, 2025

On the Reliability and Stability of Selective Methods in Malware Classification Tasks

Authors: Alexander Herzog, Aliai Eusebi, Lorenzo Cavallaro

Organizations: University College London and core64 London, United Kingdom · University College London London, United Kingdom

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

The performance figures of modern drift-adaptive malware classifiers appear promising, but does this translate to genuine operational reliability? The standard evaluation paradigm primarily focuses on baseline performance metrics, neglecting confidence-error alignment and operational stability. While prior works established the importance of temporal evaluation and introduced selective classification in malware classification tasks, we take a complementary direction by investigating whether malware classifiers maintain reliable and stable confidence estimates under distribution shifts and exploring the tensions between scientific advancement and practical impacts when they do not. We propose Aurora, a framework to evaluate malware classifiers based on their confidence quality and operational resilience. Aurora subjects the confidence profile of a given model to verification to assess the reliability of its estimates. Unreliable confidence estimates erode operational trust, waste valuable annotation budgets on non-informative samples for active learning, and leave error-prone instances undetected in selective classification. Aurora is further complemented by a set of metrics designed to go beyond point-in-time performance, striving towards a more holistic assessment of operational stability throughout temporal evaluation periods. The fragility we observe in SOTA frameworks across datasets of varying drift severity suggests it may be time to revisit the underlying assumptions.

Figures & tables

Fig. 1: CADE [ 3 ] assumes errors lie far from class centroids (case A ). Hypercube VTT2 risk–coverage evaluation (Fig. 2 a) shows the opposite : errors concentrate at low OOD scores (distances typical of the training group), where confidence is high [ 8 ] (case B ; see also Fig. 4 ).
  BaselineReliabilityStability
BMB_{M}MethodF1 ↑\uparrowE-AURC ↓\downarrowCap 400 ↑\uparrowF1 ∗ ↑\uparrowSen[F1] ↑\uparrowSen[AUROC f ] ↑\uparrowSen[ q∗q^{*} ]
  %×\times 100% of errors%Δ\Delta F1 ∗ (pp)pp/month10−310^{-3} /monthfirst →\to lastpp/monthqˉ∗\bar{q}^{*} (%)
400DeepDrebin38.54.5330.331.1−- 7.4−- 1.23−- 3.60.72 →\to 0.65++ 0.019.9
CADE-OOD38.38.2018.042.5++ 4.2−- 0.81−- 1.40.56 →\to 0.51−- 0.2412.7
CADE-MSP38.37.0421.42.7−- 35.5−- 0.81++ 1.80.54 →\to 0.59−- 0.4823.6
HCC-PL39.17.1217.243.2++ 4.1−- 1.04−- 5.80.62 →\to 0.48++ 0.2316.2
TABLE I: Aurora evaluation on Hypercube VTT2 [ 13 ] at BM=400B_{M}=400 . Gray sub-columns are companion values; bold =best, dark-red italics =worst per ranked column.
Fig. 2: Hypercube VTT2 at BM=400B_{M}=400 , all sixteen rows of Table I . (a) Month-averaged risk–coverage curves, with seven confidence functions highlighted and nine in gray. The dashed line is the pointwise median of the rows’ oracles; each row’s E-AURC is its area above its own oracle. The random level is 8.1% (median across rows of the mean monthly error rate), and the axis is truncated at 12%. (b) F1 (equal-month mean) against E-AURC; right and down are better. Marker color shows Sen[F1] (darker means a shallower decline) and squares mark Transcendent rows. The dashed staircase is the F1 ×\times E-AURC frontier; bold labels mark rows that no other row dominates in F1, E-AURC and Sen[F1] together (unrounded values).
 BaselineReliabilityStability
BMB_{M}F1 ↑\uparrowE-AURC ↓\downarrowCap BM{}_{B_{M}} ↑\uparrowΔ\Delta F1 ∗<0{}^{*}{<}0Sen[F1]
 highest, %lowest, ×\times 100highest, %rowsrange, pp/month
50DRMD 33.1CCE (DD) 4.95RAMDA 7.210/16−1.55-1.55 to −1.15-1.15
100DRMD 36.0DD, CCE (DD) 4.85RAMDA 12.010/16−1.56-1.56 to −1.13-1.13
200DRMD 40.2DD 4.69RAMDA 19.210/16−1.58-1.58 to −1.01-1.01
400DRMD 43.5DD 4.53DRMD 30.69/16−1.61-1.61 to −0.81-0.81
TABLE II: Leaders per budget on Hypercube VTT2; full results in Table I and Table IV (Appendix A ). DD = DeepDrebin.
  BaselineReliabilityStability
DatasetBMB_{M}F1 ↑\uparrowE-AURC ↓\downarrowSen[F1]
  highest, %lowest, ×\times 100range, pp/month
AndroZoo50HCC 75.1CCE (Drebin) 1.24−0.66-0.66 to +1.81+1.81
100HCC 76.9CCE (Drebin) 0.93+0.11+0.11 to +1.17+1.17
200HCC 78.3CCE (Drebin) 0.82+0.65+0.65 to +1.56+1.56
400HCC 84.5CCE (Drebin) 0.63+0.67+0.67 to +1.87+1.87
TABLE III: Leaders per budget on the additional datasets, for the five methods run there; full results in Appendix B (Tables V – VII ); DD = DeepDrebin.
Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

  BaselineReliabilityStability
BMB_{M}MethodF1 ↑\uparrowE-AURC ↓\downarrowCap BM{}_{B_{M}} ↑\uparrowF1 ∗ ↑\uparrowSen[F1] ↑\uparrowSen[AUROC f ] ↑\uparrowSen[ q∗q^{*} ]
  %×\times 100% of errors%Δ\Delta F1 ∗ (pp)pp/month10−310^{-3} /monthfirst →\to lastpp/monthqˉ∗\bar{q}^{*} (%)
50DeepDrebin29.95.076.528.3−- 1.5−- 1.38−- 4.70.73 →\to 0.62−- 0.011.1
CADE-OOD c26.98.274.528.2++ 1.3−- 1.28−- 0.60.55 →\to 0.52−- 0.044.0
CADE-MSP c26.97.846.018.9−- 8.2−- 1.28++ 0.40.53 →\to 0.54−- 0.012.3
HCC-PL a27.96.564.328.1++ 0.2−- 1.33−- 4.70.64 →\to 0.53−- 0.011.2
Appendix
TABLE IV: Aurora evaluation on Hypercube VTT2 at the lower monthly budgets BM∈{50,100,200}B_{M}\in\{50,100,200\} , in the layout and metric set of Table I (full initial 2021 training set, calibration Jan–Jun 2022, evaluation Jul 2022–Dec 2024). The Cap batch size and the rejection quota equal BMB_{M} ( ρ=BM\rho=B_{M} ). Values are computed per month within seed, summarized over the 30 months and averaged over five complete seeds (IDs 1–5) for every row. Bold =best, dark-red italics =worst displayed value per ranked column and BMB_{M} block.
Fig. 3: Hypercube VTT2 at BM=50B_{M}=50 with a fixed rejection quota ρ=400\rho=400 under the rolling calibration of § III-A : (a) accepted-set F1 ∗ , (b) Δ\Delta F1 ∗ and (c) realized referrals per month (log scale), averaged over all five seeds of every row in Table IV . Highlighted rows as in Fig. 2 (a). Most rows refer fewer than 400 samples per month (median over rows about 330); CADE-MSP (mean 706, monthly range 33–2,216), CADE-OOD (485) and RAMDA (484) exceed the quota.
  BaselineReliabilityStability
BMB_{M}MethodF1 ↑\uparrowE-AURC ↓\downarrowCap BM{}_{B_{M}} ↑\uparrowF1 ∗ ↑\uparrowSen[F1] ↑\uparrowSen[AUROC f ] ↑\uparrowSen[ q∗q^{*} ]
  %×\times 100% of errors%Δ\Delta F1 ∗ (pp)pp/month10−310^{-3} /monthfirst →\to lastpp/monthqˉ∗\bar{q}^{*} (%)
50DeepDrebin54.25.3414.355.2++ 1.0++ 1.81−- 24.50.76 →\to 0.46−- 0.113.0
CADE-OOD c62.45.954.162.4 †0.0 †−- 0.66−- 4.00.47 →\to 0.42−- 0.15 †1.1 †
CADE-MSP c62.45.4311.160.7−- 1.7−- 0.66−- 2.10.55 →\to 0.50−- 0.074.6
HCC-PL a75.11.2726.876.5++ 1.3++ 0.79++ 7.90.75 →\to 0.85−- 0.312.1
Appendix
TABLE V: AndroZoo (test Jan 2020–Nov 2021; full initial year) in the metric set, threshold protocol and layout of Table I : the first six test months calibrate, the remaining 17 months evaluate, and the Cap batch size and the rejection quota ρ\rho equal BMB_{M} . Values are computed per month within seed, summarized within seed and averaged over seeds; rows with fewer seeds than the complete rows show their count and are not ranked. Bold =best, dark-red italics =worst displayed value per ranked column and BMB_{M} block.
  BaselineReliabilityStability
BMB_{M}MethodF1 ↑\uparrowE-AURC ↓\downarrowCap BM{}_{B_{M}} ↑\uparrowF1 ∗ ↑\uparrowSen[F1] ↑\uparrowSen[AUROC f ] ↑\uparrowSen[ q∗q^{*} ]
  %×\times 100% of errors%Δ\Delta F1 ∗ (pp)pp/month10−310^{-3} /monthfirst →\to lastpp/monthqˉ∗\bar{q}^{*} (%)
50DeepDrebin89.70.6128.391.6++ 1.8++ 0.12++ 1.40.85 →\to 0.85−- 0.011.4
CADE-OOD c85.81.944.384.8−- 1.0++ 0.03−- 1.30.69 →\to 0.55++ 0.011.1
CADE-MSP c85.84.155.486.4++ 0.6++ 0.03++ 0.10.38 →\to 0.43−- 0.011.9
HCC-PL a88.61.7819.690.0++ 1.4++ 0.06−- 1.90.78 →\to 0.630.001.4
Appendix
TABLE VI: APIGraph (test Jan 2013–Nov 2018; full initial year) in the metric set, threshold protocol and layout of Table I : the first six test months calibrate, the remaining 65 months evaluate, and the Cap batch size and the rejection quota ρ\rho equal BMB_{M} . Values are computed per month within seed, summarized within seed and averaged over seeds; rows with fewer seeds than the complete rows show their count and are not ranked. Bold =best, dark-red italics =worst displayed value per ranked column and BMB_{M} block.
  BaselineReliabilityStability
BMB_{M}MethodF1 ↑\uparrowE-AURC ↓\downarrowCap BM{}_{B_{M}} ↑\uparrowF1 ∗ ↑\uparrowSen[F1] ↑\uparrowSen[AUROC f ] ↑\uparrowSen[ q∗q^{*} ]
  %×\times 100% of errors%Δ\Delta F1 ∗ (pp)pp/month10−310^{-3} /monthfirst →\to lastpp/monthqˉ∗\bar{q}^{*} (%)
50DeepDrebin82.51.4218.784.4++ 1.9−- 0.02−- 3.20.83 →\to 0.740.001.3
CADE-OOD c68.74.655.866.0−- 2.8−- 0.46−- 0.90.55 →\to 0.520.001.2
CADE-MSP c68.76.115.265.4−- 3.3−- 0.46++ 1.20.48 →\to 0.520.002.7
HCC-PL a82.74.4715.683.8++ 1.1−- 0.05−- 3.00.68 →\to 0.61−- 0.011.4
Appendix
TABLE VII: Transcendent (41 aligned test months, 2015–2018; full initial year) in the metric set, threshold protocol and layout of Table I : the first six test months calibrate, the remaining 35 months evaluate, and the Cap batch size and the rejection quota ρ\rho equal BMB_{M} . Values are computed per month within seed, summarized within seed and averaged over seeds; rows with fewer seeds than the complete rows show their count and are not ranked. Bold =best, dark-red italics =worst displayed value per ranked column and BMB_{M} block.
Fig. 4: Month-averaged risk–coverage curves at BM=50B_{M}=50 on AndroZoo, APIGraph and Transcendent, one curve per row of Tables V – VII , with the colors of Fig. 2 (a). The axis is truncated at 12%; on Transcendent, CADE-MSP and HCC-PL start above it at coverages below 2%.
MetricDefinitionLiteratureExclusion rationaleVTT2 evidence
Reliability
Mean failure AUROC (AUROC f )Probability that an error receives higher uncertainty than a correct prediction; threshold-free ranking.Error-detection baseline [ 33 ] ; AUROC [ 68 ] ; ranking quality [ 37 ] .Omits error frequency and high-confidence error concentration [ 69 , 55 ] ; order-preserving score transforms tie. Retained for Sen[AUROC f ] and its first →\to last companion.rs=−0.71r_{s}=-0.71 with E-AURC.
AUGRCArea under generalized risk (probability of an accepted error) across coverage.Traub et al. [ 53 ] .Weights selective risk by coverage, downweighting the high-confidence region targeted by Aurora .rs=0.91r_{s}=0.91 with E-AURC; DRMD–DeepDrebin gap: 0.87 E-AURC points versus 0.26 AUGRC points.
NAURCExcess area normalized by its ceiling: 0 for oracle ranking, 1 for an uninformative score; removes error-rate dependence.Proposed by Cattelan and Silva [ 52 ] ; used by Heng and Soh [ 57 ] .Closely tracks failure AUROC on this cohort; E-AURC retains error weighting and is interpreted alongside F1.rs=−0.90r_{s}=-0.90 with mean failure AUROC, 0.830.83 with E-AURC.
SR 10Error rate among the 10% most confident monthly predictions.Fixed-coverage risk [ 39 , 70 ] ; partial AURC [ 56 ] .Covers the region E-AURC weights most; reported with E-AURC in the results text.rs=0.90r_{s}=0.90 with E-AURC (13 rows); range 3.4–7.0% versus about 8% overall error.
AURC[F1] ∗Area under 1−1- accepted-set F1 over target coverages 5–100%; thresholds fixed after calibration on the preceding window.No prior precedent; Transcend reports accepted-set F1 at one rate [ 45 , 5 ] .F1 is non-additive over coverage; drift separates target from realized coverage. Excluding months with fewer than 20 accepted samples gives methods different support. Replaced by F1 ∗ at the single calibrated operating point.Largest ∣rs∣|r_{s}| with a headline metric: 0.68 ( Δ\Delta F1 ∗ , per-seed values); distinct but not interpretable.
Appendix
TABLE IX: Candidate metrics not adopted as headline metrics in Table I . rsr_{s} : Spearman rank correlation across the sixteen seed-mean rows of Table I (Hypercube VTT2, BM=400B_{M}=400 ). Cells marked “13 rows” exclude HCC-PL and the two CADE rows. AUGRC uses Traub et al.’s closed form from monthly failure AUROC (AUROC f ) and accuracy.
More in this topic

Malware Classification

Malware classification uses features of files, apps, and behavior to identify malicious code and assign it to families or types.

See all 44 papers

Explore similar work

CardsList

  1. Detecting Concept Drift in Evolving Malware Families Using Rule-Based Classifier Representations

    Apr 24, 2026Tomáš Kalný, Martin Jureček, Mark StampConcept DriftRule-Based Classification

    Faculty of Information Technology Czech Technical University, Thakurova 9, Prague, Czech · Department of Computer Science, San Jose State University, San Jose, CA, USA

  2. Concept Drift Detection and Adaptive Retraining of Malware Classification Models

    Aug 13, 2026Christofer Washington Berruz Chungata, Martin Jurecek, Katerina Potika +2Concept DriftMalware Classification

    Department of Computer Science, San Jose State University · Faculty of Information Technology, Czech Technical University in Prague

  3. Label-efficient Training Updates for Malware Detection over Time

    Mar 30, 2026Luca Minnei, Cristian Manca, Giorgio Piras +6Malware DetectionActive Learning

    Department of Electrical and Electronic Engineering, University of Cagliari, Italy · Department of Computer, Control and Management Engineering, Sapienza University, Rome, Italy · CINI, Rome, Italy