基于适配器的小样本持续学习用于恶意数据包识别
Adapter-Based Few-Shot Continual Learning for Malicious Packet Recognition
- University of West Florida（西佛罗里达大学）
- Florida Institute For Human and Machine Cognition (IHMC)（佛罗里达人机认知研究所）
机构由 AI 辅助整理，请以论文原文为准。
AI总结：
本研究针对恶意软件分类的小样本类增量学习（FSCIL）设置，提出结合自监督学习（SSL）骨干网络与低秩适配（LoRA）及原型分类头的混合框架，实验显示其性能优于现有基线达到最先进水平。
AI中文摘要：
恶意软件变体的持续演化要求检测系统能够在不从头重新训练的情况下适应新威胁。然而，在新数据上持续更新模型往往会导致灾难性遗忘，即先前学习的知识被覆盖。尽管持续学习已越来越多地应用于恶意软件检测，但小样本类增量学习（FSCIL）这一特定设置——必须仅从少量标注样本中学习新的恶意软件类别——仍相对未被充分探索。因此，本研究针对恶意软件分类的FSCIL设置展开研究。为解决稳定性-可塑性困境，我们提出一种混合框架，该框架利用通过恶意软件数据包的特定领域预训练初始化的自监督学习（SSL）骨干网络。我们的方法结合低秩适配（LoRA），在基础会话期间高效调整模型，同时冻结核心骨干网络以保留先前学习的表示，并在增量会话中采用基于原型的分类头，以从有限样本中建立鲁棒决策边界。在多个数据集上进行的大量实验表明，我们的方法始终优于现有的恶意软件FSCIL基线，且达到了最先进的性能。
英文摘要：
The continual evolution of malware variants necessitates detection systems that can adapt to new threats without retraining from scratch. However, continually updating models on new data often leads to catastrophic forgetting, where previously learned knowledge is overwritten. While continual learning has been increasingly explored for malware detection, the specific setting of Few-Shot Class-Incremental Learning (FSCIL), where new malware classes must be learned from only a small number of labeled examples, remains comparatively underexplored. Therefore, this work investigates the FSCIL setting for malware classification. To address the stability-plasticity dilemma, we propose a hybrid framework that leverages a Self-Supervised Learning (SSL) backbone initialized through domain-specific pre-training on malware packets. Our method incorporates Low-Rank Adaptation (LoRA) to efficiently adapt the model during the base session while freezing the core backbone to preserve previously learned representations, alongside a prototype-based classification head for incremental sessions to establish robust decision boundaries from limited samples. Extensive experiments across several datasets demonstrate that our approach consistently outperforms prior malware FSCIL baselines and achieves state-of-the-art performance.
