Technical Summary: FreeMOCA

Problem Statement

Malware detection systems face a critical challenge in adapting to the evolving threat landscape, where over 200 million new malware samples are identified annually. Traditional machine learning approaches that retrain solely on new data suffer from catastrophic forgetting (CF), where knowledge of previously observed threats is overwritten. Conversely, retraining on the entire historical dataset incurs prohibitive computational and memory costs. While Continual Learning (CL) offers a framework for incremental adaptation, existing malware-specific CL methods (e.g., MalCL, MADAR) rely heavily on replay mechanisms—storing exemplars, generating synthetic samples, or distilling soft outputs. These approaches introduce significant memory and computational overhead, rendering them impractical for resource-constrained deployment environments like endpoint security and mobile devices. Furthermore, standard CL methods often fail to prevent CF in the malware domain due to complex feature representations and high class imbalance.

Methodology: FreeMOCA

The authors propose FreeMOCA (Memory-Free Continual Learning for Malicious Code Analysis), a framework designed to preserve prior knowledge without storing past data or using generative replay. The core methodology relies on Linear Mode Connectivity (LMC) within a warm-started optimization setting.

Core Principles

1. Warm-Started Connectivity: Unlike independent training where task optima may be disconnected by high-loss barriers, FreeMOCA initializes each new task $t$ from the optimum of the previous task $\theta_{t-1}$. The authors posit that this warm-starting induces local linear connectivity, meaning consecutive task optima lie within a low-loss region of the parameter space and can be connected by a low-loss path.
2. Parameter-Space Interpolation: Instead of operating in data space (replay), FreeMOCA operates directly in parameter space. After training on a new task to obtain $\theta_{cur}$, the model is consolidated by interpolating between the previous solution $\theta_{prev}$ and the current solution $\theta_{cur}$.
3. Adaptive Layer-wise Interpolation: Recognizing that different network layers adapt at different rates (lower layers often serving as stable feature extractors while higher layers adapt rapidly), FreeMOCA does not apply a uniform mixing coefficient. Instead, it assigns a layer-specific coefficient $\lambda_\ell$ to each layer $\ell$.
   • The coefficient is derived from the magnitude of parameter shifts ($s_\ell$) between the previous and current models.
   • Layers with significant updates (high plasticity) are assigned smaller $\lambda_\ell$ to prioritize stability (retaining the previous weights).
   • Layers with minimal updates (high stability) are assigned larger $\lambda_\ell$ to favor adaptation to the new task.
   • The formula used is $\lambda_\ell = \lambda_{min} + (1 - \hat{s}_\ell)(\lambda_{max} - \lambda_{min})$, where $\hat{s}_\ell$ is the normalized shift magnitude.

Algorithm

The process involves:

1. Initializing $\theta_{prev}$ from the previous task optimum.
2. Training on the current task dataset $D_t$ to obtain $\theta_{cur}$.
3. Calculating layer-wise shift magnitudes.
4. Computing adaptive $\lambda_\ell$ for each layer.
5. Interpolating: $\theta_t^{(\ell)} = (1 - \lambda_\ell)\theta_{prev}^{(\ell)} + \lambda_\ell\theta_{cur}^{(\ell)}$.
6. Setting $\theta_t$ as the initialization for the next task.

Key Contributions

1. Memory- and Compute-Efficient Framework: FreeMOCA is the first CL framework for malware analysis that eliminates the need for exemplar buffers or generative replay, relying solely on geometric interpolation in parameter space.
2. Theoretical Analysis of Warm-Started CL: The paper analyzes LMC in the context of warm-started CL, demonstrating that recursive optimization induces local parameter alignment between consecutive task optima, making direct interpolation effective without explicit neuron permutation.
3. Adaptive Layer-wise Interpolation: The introduction of a mechanism to dynamically set layer-specific interpolation weights based on parameter shifts, effectively balancing stability and plasticity.
4. Comprehensive Evaluation: Extensive experiments on large-scale Windows (EMBER) and Android (AZ) malware benchmarks in both Class-Incremental (Class-IL) and Domain-Incremental (Domain-IL) settings.

Experimental Results

The authors evaluated FreeMOCA against 11 baselines (including EWC, SI, iCaRL, MalCL, and WSC) on EMBER and AZ datasets.

• Class-Incremental (Class-IL) Performance:
  • FreeMOCA achieved substantial gains, outperforming 11 baselines.
  • On EMBER-Class, it reached 65.2% average accuracy (vs. 22.9% for fine-tuning only), outperforming the next best baseline (WSC) by a margin and achieving a 42% improvement over the "None" baseline.
  • On AZ-Class, it reached 66.1% average accuracy, improving by 37% over the "None" baseline.
  • It achieved the lowest forgetting (F) and highest remembering (REM) across all baselines. Notably, on AZ-Class, it achieved zero forgetting ($F=0.000$) and perfect retention ($REM=1.000$), along with positive backward transfer.
• Domain-Incremental (Domain-IL) Performance:
  • FreeMOCA matched or exceeded baselines, reaching 93.6% on EMBER-Domain and 97.0% on AZ-Domain.
• Efficiency:
  • Memory: FreeMOCA uses significantly less memory than replay-based methods (e.g., MalCL). It retains only a single classifier checkpoint, resulting in 0% memory increase over time, whereas MalCL's memory grew by 86.3% and WSC by 45.4% across tasks.
  • Training Time: FreeMOCA reduced per-epoch training time by 92.79–98.71% compared to MalCL and WSC.
• Diagnostics:
  • Loss-Barrier Analysis: Confirmed that after an initial transition, the loss barriers between consecutive solutions remain low and flat, validating the low-loss path assumption.
  • Variance Collapse: Analysis of Batch Normalization statistics showed that warm-started interpolation mitigates variance collapse, preserving feature geometry without requiring re-estimation or permutation.

Significance and Claims

The paper claims that FreeMOCA provides a scalable and effective alternative to replay for continual malware detection. By leveraging the geometric alignment inherent in warm-started optimization, the method achieves state-of-the-art performance in retaining knowledge of past threats while adapting to new ones, all without the storage or computational costs associated with replay buffers.

The authors emphasize that this approach is particularly significant for deployment settings with constrained resources (e.g., mobile devices, endpoint security) where storing past samples or generating synthetic data is infeasible. They assert that their findings suggest continual learning can benefit from viewing sequential optimization trajectories as connected regions of the loss landscape rather than isolated optima.

The paper maintains a modest scope, acknowledging that the method relies on local connectivity between adjacent tasks and may face challenges if task drift becomes too large or if the underlying representation changes substantially. It does not claim to solve fully task-free or streaming CL settings without observable boundaries, but rather addresses the specific regime of sequential malware family expansion where feature continuity is naturally preserved.