  In the application of deep learning for malware classification, it is crucial
to account for the prevalence of malware evolution, which can cause trained
classifiers to fail on drifted malware. Existing solutions to combat concept
drift use active learning: they select new samples for analysts to label, and
then retrain the classifier with the new labels. Our key finding is, the
current retraining techniques do not achieve optimal results. These models
overlook that updating the model with scarce drifted samples requires learning
features that remain consistent across pre-drift and post-drift data.
Furthermore, the model should be capable of disregarding specific features
that, while beneficial for classification of pre-drift data, are absent in
post-drift data, thereby preventing prediction degradation.
  In this paper, we propose a method that learns retained information in
malware control flow graphs post-drift by leveraging graph neural network with
adversarial domain adaptation. Our approach considers drift-invariant features
within assembly instructions and flow of code execution. We further propose
building blocks for more robust evaluation of drift adaptation techniques that
computes statistically distant malware clusters. Our approach is compared with
the previously published training methods in active learning systems, and the
other domain adaptation technique. Our approach demonstrates a significant
enhancement in predicting unseen malware family in a binary classification task
and predicting drifted malware families in a multi-class setting. In addition,
we assess alternative malware representations. The best results are obtained
when our adaptation method is applied to our graph representations.
