A security analyst is reviewing an ML model used for identifying malicious files and notices it performs poorly on a new malware campaign. The model was trained 18 months ago. Which ML concept best explains this degradation?

• A.Class imbalance - the proportion of malware samples has changed in production; class imbalance is corrected automatically by mini-batch shuffling, which equalizes the classes seen per gradient step
• B.Overfitting - the model memorized training data and cannot generalize
• C.Concept drift - the statistical relationship between input features and the target label has changed over time as malware techniques evolve, causing the trained model to no longer accurately represent current threat patterns
• D.Underfitting - the model was not complex enough to learn the training data