---

DRL-Based Malware Detection (DRMD)

This repository is the official release of the code used for the 'DRMD: Deep Reinforcement Learning for Malware Detection under Concept Drift' Paper published in the AAAI Conference on Artificial Intelligence (AAAI-26).

If you plan to use this repository in your projects, please cite the following paper:

@inproceedings{mcfadden2026drmd,
  title = {DRMD: Deep Reinforcement Learning for Malware Detection under Concept Drift},
  author = {McFadden, Shae and Foley, Myles and D'Onghia, Mario and Hicks, Chris and Mavroudis, Vasilios and Paoletti, Nicola and Pierazzi, Fabio},
  booktitle = {Proceedings of the AAAI Conference on Artificial Intelligence},
  year = {2026},
}

---

Disclaimer

Please note that the code in this repository is only a research prototype. This code is released under a "Modified (Non-Commercial) BSD License": see the terms here.

---

Installation

Please note that this project requires tesseract-ml, which can be found here and installed as follows.

cd ${PATH_TO}/tesseract-ml
pip install .

For plotting, this project requires RPAL, which can be found here

cd ${PATH_TO}/RPAL/RPAL
pip install .

Finally, this project can be installed by:

cd ${PATH_TO}/DRMD
pip install .

Datasets and Experiments

The datasets and configs used to conduct the experiments for AAAI 2026 can be found in the following locations:

• Experiments/datasets.zip
• Experiments/configstore.py

To perform the experiments found in the paper, run the following:

cd ${PATH_TO}/DRMD/Experiments
unzip install datasets.zip
python main.py

Note that the config run is chosen by a global variable in main.py.

---