Explaining concept drift in windows PE malware with integrated gradients and behavioral analysis

Abstract Concept drift poses a major challenge for long-lived malware family classifiers. While drift-aware systems have been proposed, most remain opaque, flagging or adapting to drift but rarely explaining why it occurs. This study extends a triplet-autoencoder and DBSCAN-based drift detection framework with explainability and validation components designed to analyze feature- and behavior-level changes underlying drift decisions. Static Windows PE binaries are represented using EMBER features and embedded into a discriminative latent space, where family-specific DBSCAN clusters define decision regions and per-family distance thresholds. We apply Integrated Gradients (IG) to explain drift decisions at the feature level and introduce a counterfactual validation strategy to assess whether these explanations correspond to causally meaningful changes. We define the Drift Correction Rate (DCR) to quantify explanation consistency. IG is compared against the model-agnostic baselines LIME and SHAP. Separately, we conduct an independent behavioral analysis using capabilities extracted by CAPA and their mappings to MITRE ATT& CK techniques to examine whether samples flagged as drifted also exhibit observable behavioral differences. Experiments on a malware dataset spanning multiple Windows families show that the detector flags covariate drift in approximately 30% of post-training samples. IG-based explanations achieve near-perfect drift correction across families and consistently outperform SHAP and LIME. Behavioral similarity metrics based on the Jaccard index and Jensen–Shannon divergence further indicate that drifted samples diverge from the training distribution not only in feature space but also in extracted capabilities and MITRE ATT& CK techniques. Overall, the results show that the proposed framework provides empirically validated feature-level explanations of latent-space drift, while the independent behavioral analysis offers additional evidence that many drifted samples also differ in observable malware capabilities and MITRE ATT& CK techniques.