Metrics
1 Record Views
Preprint
Adapter-Based Few-Shot Continual Learning for Malicious Packet Recognition
08/24/2026
Abstract
The continual evolution of malware variants necessitates detection systems that can adapt to new threats without retraining from scratch. However, continually updating models on new data often leads to catastrophic forgetting, where previously learned knowledge is overwritten. While continual learning has been increasingly explored for malware detection, the specific setting of Few-Shot Class-Incremental Learning (FSCIL), where new malware classes must be learned from only a small number of labeled examples, remains comparatively underexplored. Therefore, this work investigates the FSCIL setting for malware classification. To address the stability-plasticity dilemma, we propose a hybrid framework that leverages a Self-Supervised Learning (SSL) backbone initialized through domain-specific pre-training on malware packets. Our method incorporates Low-Rank Adaptation (LoRA) to efficiently adapt the model during the base session while freezing the core backbone to preserve previously learned representations, alongside a prototype-based classification head for incremental sessions to establish robust decision boundaries from limited samples. Extensive experiments across several datasets demonstrate that our approach consistently outperforms prior malware FSCIL baselines and achieves state-of-the-art performance.
Files and links (1)
Details
- Title
- Adapter-Based Few-Shot Continual Learning for Malicious Packet Recognition
- Resource Type
- Preprint
- Publisher
- arXiv
- Format
- link
- Copyright
- © the author(s)
- Identifiers
- 99381871613806600
- Academic Unit
- Institute for Human and Machine Cognition; Center for Cybersecurity and AI; Intelligent Systems and Robotics; Division of Academic Affairs; Hal Marcus College of Science and Engineering
- Language
- English