A security analyst is reviewing an ML model used for identifying malicious files and notices it performs poorly on a new malware campaign. The model was trained 18 months ago. Which ML concept best explains this degradation?

• A.A. Underfitting - the model was not complex enough to learn the training data
• B.C. Class imbalance - the proportion of malware samples has changed in production
• C.B. Concept drift - the statistical relationship between input features and the target label has changed over time as malware techniques evolve, causing the trained model to no longer accurately represent current threat patterns
• D.D. Overfitting - the model memorized training data and cannot generalize