# Systematic Review: Malware Detection and Classification in Cybersecurity
## 2 Methodology
### Advanced Malware Detection Techniques
#### 3.6.13 Evaluation of Transfer Learning Techniques for Malware Detection  
The study \"Effectiveness Analysis of Transfer Learning for the Concept Drift Problem in Malware Detection\", published in Expert Systems with Applications, examines the impact of concept drift on malware classification and proposes the use of transfer learning (TL) techniques as an effective solution to address this challenge. [70] Concept drift refers to changes in data distribution that degrade the performance of machine learning models over time, particularly affecting the detection of emerging malware. The approach is based on the use of homogeneous TL to leverage old data (source domain) and improve classification accuracy in new contexts (target domain). Five TL algorithms were implemented and evaluated on six data combinations from different time periods (2015, 2017, 2019, and 2020). Features were extracted through dynamic analysis using the Cuckoo Sandbox tool, incorporating API calls, signatures, and network attributes. Four machine learning models (Random Forest, K-Nearest Neighbors, Extreme Gradient Boosting, and Multi-Layer Perceptron) were also applied to analyze their behavior when integrated with TL. Experimental results demonstrated that techniques such as TrAda, CORAL, and DAE significantly improved malware detection in the presence of concept drift, achieving Matthews correlation coefficients above 0.9. The study concludes that TL is an effective strategy for addressing changes in data distribution, allowing the reuse of previous information and maintaining high levels of accuracy in dynamic and unstable environments. This contribution validates the use of TL as a robust mechanism to strengthen malware classification in real-world scenarios characterized by imbalanced data and constantly evolving threats. Furthermore, complementary research confirms the effectiveness of machine learning in various cybersecurity areas: phishing detection using CNN-LSTM models (99.1% accuracy) [71], malware detection with LSTM and CNN models (98.5% and 97.2%) [72], network anomaly detection with RF and SVM (95.4% and 94.1%) [73], IoT attack detection with RF and DT (96.2% and 94.7%) [74], and ransomware detection with RF, DT, and KNN (97.8%, 96.5%, and 95.2%) [75]. These studies consolidate machine learning and transfer techniques as key approaches to addressing the evolution of threats in contemporary cybersecurity. To contextualize the current landscape of malware detection, Table 3 presents a comparative overview of the most representative studies included in this review. It highlights the key techniques, datasets, and performance outcomes, offering a concise reference for understanding the strengths and focus areas of recent approaches. Based on the analysis of the selected studies, several implementation-oriented frameworks emerge as applicable models for real-world cybersecurity operations. Among them, federated learning architectures stand out for enabling decentralized anomaly detection across IoT networks, ensuring data privacy through local model training without centralized data aggregation. In parallel, computer vision-based techniques convert binary malware files into visual representations, allowing the use of pretrained convolutional neural networks for accurate and scalable classification. Active learning frameworks offer practical advantages by significantly reducing the labeling effort, thus supporting rapid model adaptation in evolving threat environments. Furthermore, hybrid architectures that integrate deep learning models with support vector machines (SVM) demonstrate enhanced generalization capacity, making them suitable for deployment in dynamic and resource-constrained infrastructures. Figure 6 illustrates the distribution of machine learning and deep learning algorithms most frequently employed in recent malware detection studies.