Evidence drift analytics for long-term malware investigations: A causal and survival-theoretic framework for forensic validity optimizations

Abstract Advanced malware investigations frequently extend over prolonged periods, during which operating-system updates, software patches, logging-framework modifications, benign software evolution, and adversarial adaptations continuously alter the statistical characteristics of digital forensic artifacts. These temporal changes introduce evidence drift that affects registry traces, process lineage structures, executable metadata, memory layouts, network flows, and system-call distributions, thereby reducing the reliability and long-term validity of forensic evidence. Although existing concept-drift approaches improve predictive performance under evolving data distributions, they rarely assess whether forensic artifacts remain evidentially valid, reproducible, and operationally reliable throughout extended investigations. To address this limitation, this paper proposes a five-stage Evidence Drift Analytics (EDA) framework for long-term forensic-validity optimization in evolving malware environments. The framework integrates the Temporal Forensic Evidence Divergence Field (TFEDF) for multi-resolution drift estimation, the Causal Artifact Lineage Graph Transformer (CALGT) for SCM-guided estimation of attribution confidence under explicit intervention assumptions, the Forensic Integrity Preservation Index using Bayesian Evidence Survival Modeling (FIPI-BESM) for evidentiary survivability forecasting, the Drift-Aware Counterfactual Re-Anchoring Engine (DACRE) for learning drift-invariant representations while preserving malicious behavioural semantics, and the Forensic Validity Optimization Network (FVON) for reinforcement-learning–based forensic decision optimization. The proposed framework was evaluated using five publicly available cybersecurity datasets, including CICIDS2017, EMBER, LANL authentication logs, Android API streams, and IoT telemetry datasets. Experimental results demonstrate that the proposed approach achieves 94.8% drift sensitivity with a 4.2% false-positive rate, attains 91.7% accuracy for the operational drift-source attribution task under the stated SCM intervention assumptions, and maintains a survival stability index of 0.92 during long-term evidentiary forecasting. Furthermore, the proposed drift-aware representation learning reduces embedding variance to 0.062 while preserving 96.1% reconstruction fidelity across temporal windows. The integrated framework also achieves a cumulative forensic validity score of 0.95 and a reproducibility index of 0.94, indicating improved cross-temporal consistency, evidentiary robustness, and operational reliability under evolving cybersecurity environments. Overall, the proposed Evidence Drift Analytics framework provides a unified evidence-centric methodology for modelling temporal evidence drift, preserving forensic validity, and supporting reliable long-term malware investigations through the integration of temporal drift analysis, SCM-guided causal reasoning, Bayesian evidence survival modelling, drift-invariant representation learning, and reinforcement-learning–based forensic optimization. These performance results were obtained under the offline experimental settings evaluated in this study using temporally segmented benchmark datasets and may vary under real-time, high-throughput operational environments. The CALGT outputs represent estimated attribution confidence obtained under assumptions of temporal ordering, reliable metadata observability, and correctly identified operating-system update pathways; they should not be interpreted as definitive causal discovery or experimental proof of causality. .