Retrofit: 二进制安全检测与分析中的受控遗忘持续学习
Retrofit: Continual Learning with Controlled Forgetting for Binary Security Detection and Analysis
AI总结：
Retrofit通过受控遗忘机制在持续学习中平衡知识保留与适应性，无需历史数据，在恶意软件检测和二进制摘要任务中提升了性能和泛化能力。
摘要：
二进制安全日益依赖深度学习来推断恶意软件行为和程序语义。然而，随着威胁环境演变和代码表示变化，性能往往下降。持续学习（CL）通过顺序更新提供自然解决方案，但现有方法依赖数据回放或无约束更新，限制了其在数据敏感的安全环境中的应用。我们提出RETROFIT，通过在每次更新中调节知识保留与适应，无需历史数据。核心思想是通过回顾自由参数合并整合先前训练和新微调模型，作为传统和新兴知识的教师。通过约束参数变化到低秩和稀疏子空间以近似正交性，以及使用基于置信度的仲裁机制动态聚合来自两个教师的知识来实现遗忘控制。在两个代表性应用中的评估表明，RETROFIT在保持适应性的同时有效缓解了遗忘。在时间漂移下的恶意软件检测中，其保留分数从20.2%提高到38.6%，超过CL基线，并在新数据上超越了理想上界。在跨反编译层级的二进制摘要任务中，其中分析剥离二进制尤其具有挑战性，RETROFIT在BLEU分数上超过先前工作的两倍，并在跨表示泛化中超越所有基线。
英文摘要：
Binary security has increasingly relied on deep learning to reason about malware behavior and program semantics. However, the performance often degrades as threat landscapes evolve and code representations shift. While continual learning (CL) offers a natural solution through sequential updates, most existing approaches rely on data replay or unconstrained updates, limiting their applicability and effectiveness in data-sensitive security environments. We propose RETROFIT, which regulates knowledge retention and adaptation with controlled forgetting at each update, without requiring historical data. Our key idea is to consolidate previously trained and newly fine-tuned models, serving as teachers of legacy and emergent knowledge, through retrospective-free parameter merging. Forgetting control is achieved by 1) constraining parameter changes to low-rank and sparse subspaces for approximate orthogonality, and 2) employing a confidence-guided arbitration mechanism to dynamically aggregate knowledge from both teachers. Our evaluation on two representative applications demonstrates that RETROFIT consistently mitigates forgetting while maintaining adaptability. In malware detection under temporal drift, it substantially improves the retention score, from 20.2% to 38.6% over CL baselines, and exceeds the oracle upper bound on new data. In binary summarization across decompilation levels, where analyzing stripped binaries is especially challenging, RETROFIT achieves over 2x the BLEU score of transfer learning used in prior work and surpasses all baselines in cross-representation generalization.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
