C-GUARD: Context-Adaptive Conformal Gating for Improving Robustness Against Evasive Windows PE Malware

Machine Learning (ML)-based malware detectors perform exceptionally well on standard benchmarks, but their robustness to evasive malware remains fragile. On EMBER2024, strong tree-based models achieve high accuracy on clean test sets yet miss a large number of evasive Windows PE samples. Through SHAP-based explainability, matched error comparisons, feature-family analysis, and margin diagnostics on the validation split, we identify consistent attribution and decision-margin differences between baseline true negatives and false negatives. We further show that false negatives occur at different decision depths, including both near-boundary cases and samples misclassified with high benign confidence. We propose C-GUARD, a context-adaptive conformal gated detector that preserves the optimized high-performing baseline while selectively invoking an auxiliary rescue detector on a targeted subset of baseline negative predictions. C-GUARD combines out-of-fold rescue learning to distinguish baseline false negatives from true negatives with adaptive gating under an explicit false-positive budget. A one-sided intervention rule preserves all baseline malware decisions. On the EMBER2024 standard test set, C-GUARD recovers 178 additional malware samples at the cost of 82 additional false positives. On the evasive challenge set, it recovers 17 additional evasive malware samples.