Search papers, labs, and topics across Lattice.
This paper tackles the challenge of Few-Shot Class-Incremental Learning (FSCIL) for malicious packet recognition, addressing the issue of catastrophic forgetting in continually evolving malware detection systems. By proposing a hybrid framework that combines a Self-Supervised Learning (SSL) backbone with Low-Rank Adaptation (LoRA) and a prototype-based classification head, the authors effectively preserve previously learned knowledge while adapting to new malware classes with minimal labeled data. Experimental results across multiple datasets reveal that this approach significantly outperforms existing FSCIL baselines, achieving state-of-the-art performance in malware classification.
Adapting to new malware threats with just a few examples is now feasible without sacrificing previously learned knowledge.
The continual evolution of malware variants necessitates detection systems that can adapt to new threats without retraining from scratch. However, continually updating models on new data often leads to catastrophic forgetting, where previously learned knowledge is overwritten. While continual learning has been increasingly explored for malware detection, the specific setting of Few-Shot Class-Incremental Learning (FSCIL), where new malware classes must be learned from only a small number of labeled examples, remains comparatively underexplored. Therefore, this work investigates the FSCIL setting for malware classification. To address the stability-plasticity dilemma, we propose a hybrid framework that leverages a Self-Supervised Learning (SSL) backbone initialized through domain-specific pre-training on malware packets. Our method incorporates Low-Rank Adaptation (LoRA) to efficiently adapt the model during the base session while freezing the core backbone to preserve previously learned representations, alongside a prototype-based classification head for incremental sessions to establish robust decision boundaries from limited samples. Extensive experiments across several datasets demonstrate that our approach consistently outperforms prior malware FSCIL baselines and achieves state-of-the-art performance.
