🤖 AI

Adapter-Based Few-Shot Continual Learning for Malicious Packet Recognition

This paper proposes a hybrid framework combining a self-supervised learning backbone, Low-Rank Adaptation (LoRA), and a prototype-based classification head to address catastrophic forgetting and achieve state-of-the-art performance in few-shot class-incremental learning for malicious packet recognition.

Original authors: Kyle Stein, Guillermo Francia, III Eman El-Sheikh, Andrew Arash Mahyari

Published 2026-08-25

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Kyle Stein, Guillermo Francia, III Eman El-Sheikh, Andrew Arash Mahyari

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the digital world, security systems act as constant sentinels, scanning the flow of data that moves through our networks to spot malicious code. For years, these systems relied on training with massive libraries of known threats, learning to recognize specific patterns of bad behavior. However, the landscape of cyber threats is not static; it is a moving target. New families of malware emerge constantly, often appearing in small numbers before they spread widely. Traditional security models struggle with this reality because they are built to learn from vast amounts of data all at once. When forced to learn a new threat without forgetting the old ones, these systems often suffer from a phenomenon known as catastrophic forgetting, where the new learning overwrites the old, leaving the system blind to previous dangers. Furthermore, strict privacy and security rules often prevent organizations from keeping copies of the malicious code they have already seen, making it impossible to use past examples to help teach the system about new ones. This creates a difficult puzzle: how can a security system learn new threats from just a handful of examples, without losing its memory of the past, and without ever storing the dangerous code it has already processed?

Researchers at the University of West Florida and the Florida Institute for Human and Machine Cognition have tackled this challenge by developing a new method for recognizing malicious network packets. Their approach focuses on a specific scenario called few-shot class-incremental learning, where a system must adapt to new categories of malware using only a few labeled examples, while retaining its ability to identify all previous categories. To solve the problem of forgetting without the ability to store past data, the team built a framework that relies on a two-step process of learning. First, they trained a deep learning model from scratch using a self-supervised technique. Instead of feeding the model labeled examples of specific malware types, they let it study the raw structure of millions of network packets, teaching it to understand the underlying language of internet traffic without needing to know what specific attack each packet represented. This created a robust foundation, a general-purpose understanding of how malicious data looks.

Once this foundation was established, the researchers introduced a method to teach the system new threats without altering the core knowledge it had already learned. They used a technique called low-rank adaptation, which allows the system to learn new information by adding small, efficient layers of adjustment rather than rewriting the entire model. Imagine a library where the books are already written and bound; instead of rewriting the existing volumes to add new chapters, the researchers simply attach new, lightweight index cards that guide the reader to the new information. In their system, the core "brain" of the model remains frozen and unchanged, preserving the knowledge of all previously learned malware families. When a new threat appears, the system uses this frozen brain to extract features from the few available examples of the new threat and creates a simple reference point, or prototype, for it. This allows the system to recognize the new threat by comparing incoming data against these reference points, all while keeping the original knowledge perfectly intact.

The team tested this method on two well-known datasets of network traffic, containing thousands of samples from various types of cyber attacks. They set up a rigorous test where the system first learned a large set of common attacks, and then had to learn new, distinct types of attacks in subsequent rounds, seeing only five examples of each new type. The results showed that their approach significantly outperformed previous methods designed for this task. In the final round of testing, their system achieved an accuracy of over 61 percent on one dataset and nearly 59 percent on the other, surpassing the next best methods by a margin of more than eight percentage points. Perhaps more importantly, the system demonstrated remarkable stability. While other methods that tried to learn new information by adjusting their internal weights often forgot up to 22 percent of what they had previously learned, this new approach reduced that forgetting to less than nine percent. This indicates that by keeping the core model frozen and only making small, targeted adjustments, the system can adapt to new threats without erasing its memory of old ones.

The researchers also explored whether keeping a small buffer of past examples would help, a common strategy in other fields. They found that while storing a few past examples did allow the system to learn new threats slightly faster, it came at a steep cost: the system forgot significantly more of its previous knowledge. More critically, storing even a small amount of live malicious code poses a severe security risk, as it could accidentally be executed or leaked. The team's findings suggest that for cybersecurity, where the stakes of data retention are high, a static, robustly pre-trained system is superior to one that relies on replaying past data. Their work demonstrates that it is possible to build adaptive security systems that respect privacy constraints and handle the rapid evolution of threats, proving that a model can remain flexible enough to learn the new while staying solid enough to remember the old.

Technical Summary: Adapter-Based Few-Shot Continual Learning for Malicious Packet Recognition

Problem Statement
The paper addresses the challenge of detecting evolving malware variants in real-world cybersecurity deployments. Traditional deep learning classifiers struggle when new malware families emerge faster than large labeled datasets can be curated. While Continual Learning (CL) and Class-Incremental Learning (CIL) offer frameworks for adapting to new classes over time, they typically assume balanced sessions with ample data per class. The specific setting of Few-Shot Class-Incremental Learning (FSCIL), where new malware classes must be learned from only a few labeled examples, remains underexplored in the malware domain.

A critical constraint in this domain is the rehearsal-free requirement. Standard CL methods often rely on "rehearsal" (storing and replaying past data) to prevent catastrophic forgetting. However, in malware analysis, storing raw malicious payloads poses severe security and privacy risks (e.g., accidental execution or data leakage), making rehearsal-based approaches impractical for secure deployments. The core challenge is thus to design a system that adapts to new, scarce malware classes without forgetting previous ones and without retaining historical data.

Methodology
The authors propose a hybrid, rehearsal-free framework that combines domain-specific self-supervised learning with parameter-efficient fine-tuning. The approach operates in three distinct stages:

Self-Supervised Pre-training (SSL): A transformer encoder is trained from scratch on raw malware packet bytes using a Masked Language Modeling (MLM) objective. Unlike NLP models that use word tokens, this model treats each byte (0–255) as a discrete token, expanding the vocabulary to handle padding and masking. This stage learns robust, domain-specific feature representations of protocol semantics without requiring class labels.
Base Session Adaptation with LoRA: Following pre-training, the model is adapted to a base session of known malware classes using Low-Rank Adaptation (LoRA). Instead of full fine-tuning, which risks overfitting and forgetting, the pre-trained backbone weights are frozen. Trainable low-rank matrices are injected into the attention layers (query, key, and value projections) to learn task-specific features efficiently.
Rehearsal-Free Incremental Learning: For subsequent incremental sessions where only $K$ samples per new class are available, the backbone remains frozen. The system employs a prototype-based classification head. For each new class, a prototype vector is computed by averaging the L2-normalized feature vectors of the few available support samples. Inference is performed using a scaled cosine-similarity classifier against these prototypes, eliminating the need for gradient updates during the incremental phase.

To provide a baseline, the authors also implemented a rehearsal-based variant that stores a small buffer of exemplars to compare the trade-offs between stability and plasticity.

Key Contributions

Novel Framework: The paper introduces the first framework combining self-supervised pre-training from scratch with adapter-based FSCIL specifically for malicious packet recognition.
Rehearsal-Free Adaptation: It proposes a method that enables efficient adaptation to emerging malware classes without retaining previously observed samples, addressing critical security and privacy constraints.
Stability-Plasticity Solution: By leveraging a frozen, robustly pre-trained feature space and prototype-based classification, the method preserves decision boundaries for old classes while accommodating new ones, effectively mitigating catastrophic forgetting without data replay.
Fine-Grained Evaluation: The work evaluates the system under a fine-grained protocol where specific attack subtypes are treated as independent classes, increasing the difficulty by forcing the model to resolve high inter-class similarity.

Experimental Results
The method was evaluated on two benchmark datasets: CIC-IDS2017 and UNSW-NB15. The experiments followed a 5-shot FSCIL protocol with a base session (S0) and three incremental sessions (S1–S3).

Performance: The proposed rehearsal-free method significantly outperformed existing baselines (BFS-NID and MalFSCIL). On CIC-IDS2017, it achieved a final session accuracy of 61.05% compared to 52.30% for the best rehearsal-free baseline. On UNSW-NB15, it achieved 58.59% versus 50.44%.
Forgetting: The method demonstrated superior stability, reducing the average forgetting rate by approximately half compared to MalFSCIL (8.59% vs. 17.28% on CIC-IDS2017).
Rehearsal Comparison: While the rehearsal-based variant (with a buffer of 5 samples) achieved comparable final accuracy, it exhibited significantly higher forgetting (19.95% vs. 8.59%). This confirms that the static, frozen feature space of the rehearsal-free approach provides better stability for preserving base class knowledge, validating the hypothesis that data replay is unnecessary and potentially detrimental in this specific security context.

Significance and Claims
The paper claims that a robust, frozen feature space initialized via self-supervised learning is preferable to data replay for malware FSCIL. The authors argue that their approach successfully navigates the stability-plasticity dilemma by freezing the core backbone to preserve representations while using lightweight adapters for the base session and prototype-based rules for incremental sessions.

The significance lies in providing a secure, deployment-ready solution for adaptive intrusion detection systems where data retention is prohibited. The work demonstrates that complex architectures relying on variational autoencoders or data replay are not strictly necessary; instead, a combination of domain-specific pre-training and parameter-efficient tuning can achieve state-of-the-art performance in few-shot continual malware classification. The authors acknowledge limitations, noting the high initial computational cost of pre-training and the assumption that the pre-trained backbone remains sufficiently discriminative even for novel attacks with significant domain shifts.

More like this