Adapter-Based Few-Shot Continual Learning for Malicious Packet Recognition
2026-08-24 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors study how to teach a malware detection system to recognize new types of malware with only a few examples, without forgetting what it learned before. They use a special training method that first learns from a lot of malware data without labels, then tweaks the model in a way that keeps old knowledge intact. Their system uses a smart way to quickly adapt and classify new malware types with limited data. Experiments show their method works better than previous approaches in this challenging setting.
malware detectionfew-shot learningclass-incremental learningcatastrophic forgettingself-supervised learninglow-rank adaptationprototype-based classificationstability-plasticity dilemma
Authors
Kyle Stein, Guillermo Francia, III Eman El-Sheikh, Andrew Arash Mahyari
Abstract
The continual evolution of malware variants necessitates detection systems that can adapt to new threats without retraining from scratch. However, continually updating models on new data often leads to catastrophic forgetting, where previously learned knowledge is overwritten. While continual learning has been increasingly explored for malware detection, the specific setting of Few-Shot Class-Incremental Learning (FSCIL), where new malware classes must be learned from only a small number of labeled examples, remains comparatively underexplored. Therefore, this work investigates the FSCIL setting for malware classification. To address the stability-plasticity dilemma, we propose a hybrid framework that leverages a Self-Supervised Learning (SSL) backbone initialized through domain-specific pre-training on malware packets. Our method incorporates Low-Rank Adaptation (LoRA) to efficiently adapt the model during the base session while freezing the core backbone to preserve previously learned representations, alongside a prototype-based classification head for incremental sessions to establish robust decision boundaries from limited samples. Extensive experiments across several datasets demonstrate that our approach consistently outperforms prior malware FSCIL baselines and achieves state-of-the-art performance.