Paper deep dive
Adapter-Based Few-Shot Continual Learning for Malicious Packet Recognition
Kyle Stein, Guillermo Francia, III Eman El-Sheikh, Andrew Arash Mahyari
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:The continual evolution of malware variants necessitates detection systems that can adapt to new threats without retraining from scratch. However, continually updating models on new data often leads to catastrophic forgetting, where previously learned knowledge is overwritten. While continual learning has been increasingly explored for malware detection, the specific setting of Few-Shot Class-Incremental Learning (FSCIL), where new malware classes must be learned from only a small number of labeled examples, remains comparatively underexplored. Therefore, this work investigates the FSCIL setting for malware classification. To address the stability-plasticity dilemma, we propose a hybrid framework that leverages a Self-Supervised Learning (SSL) backbone initialized through domain-specific pre-training on malware packets. Our method incorporates Low-Rank Adaptation (LoRA) to efficiently adapt the model during the base session while freezing the core backbone to preserve previously learned representations, alongside a prototype-based classification head for incremental sessions to establish robust decision boundaries from limited samples. Extensive experiments across several datasets demonstrate that our approach consistently outperforms prior malware FSCIL baselines and achieves state-of-the-art performance.
Tags
Links
- Source: https://arxiv.org/abs/2608.23536v1
- Canonical: https://arxiv.org/abs/2608.23536v1
Trouble viewing inline? Open PDF directly →
Full Text
37,063 characters extracted from source content.
Expand or collapse full text
Adapter-Based Few-Shot Continual Learning for Malicious Packet Recognition Kyle Stein Affiliation: Department of Intelligent Systems and Robotics, University of West Florida, Pensacola, FL, USA Email: ks209@students.uwf.edu Guillermo Francia Email: amahyari@ihmc.org I Affiliation: Center for Cybersecurity, University of West Florida, Pensacola, FL, USA Email: gfranciaiii@uwf.edu Eman El-Sheikh Affiliation: Center for Cybersecurity, University of West Florida, Pensacola, FL, USA Email: eelsheikh@uwf.edu Andrew Arash Mahyari Affiliation: Department of Intelligent Systems and Robotics, University of West Florida, Pensacola, FL, USA Affiliation: Florida Institute For Human and Machine Cognition (IHMC), Pensacola, FL, USA Abstract The continual evolution of malware variants necessitates detection systems that can adapt to new threats without retraining from scratch. However, continually updating models on new data often leads to catastrophic forgetting, where previously learned knowledge is overwritten. While continual learning has been increasingly explored for malware detection, the specific setting of Few-Shot Class-Incremental Learning (FSCIL), where new malware classes must be learned from only a small number of labeled examples, remains comparatively underexplored. Therefore, this work investigates the FSCIL setting for malware classification. To address the stability-plasticity dilemma, we propose a hybrid framework that leverages a Self-Supervised Learning (SSL) backbone initialized through domain-specific pre-training on malware packets. Our method incorporates Low-Rank Adaptation (LoRA) to efficiently adapt the model during the base session while freezing the core backbone to preserve previously learned representations, alongside a prototype-based classification head for incremental sessions to establish robust decision boundaries from limited samples. Extensive experiments across several datasets demonstrate that our approach consistently outperforms prior malware FSCIL baselines and achieves state-of-the-art performance. Index Terms: Few-shot class-incremental learning, parameter-efficient fine tuning, malware classification I Introduction Deep learning has transformed cybersecurity, enabling the detection and classification of malicious network traffic with unprecedented accuracy [1, 2, 3]. However, deployed malware classifiers face a fundamental challenge in the real world when the threat landscape continuously evolves, with new malware families emerging faster than large labeled datasets can be curated [4]. A classifier trained on known threats must possess the ability to rapidly adapt to novel attack patterns without full retraining of the model. In our previous work [5], we showed that a detector can adapt to previously unseen malware families in a static few-shot setting, where the set of novel target classes is fixed. In contrast, modern deployments face a sequential, evolving scenario in which new malware families may arrive in multiple sessions over time and the model must incorporate them while retaining performance on all previously learned classes, a setting that naturally results in catastrophic forgetting [6]. The field of continual learning, or class-incremental learning (CIL), formalizes this setting where a learner must adapt to new classes over time without forgetting previously learned ones [7, 8]. Traditional CIL scenarios consist of balanced sessions, where new classes are introduced over time, and where each new class has many samples each to learn from. Many CIL methods have been proposed to address the issue of forgetting, mainly in computer vision and image recognition tasks [8, 9, 10]. However, a more recent field of few-shot class incremental learning (FSCIL) [11] was formulated to address catastrophic forgetting in a new environment: where it is assumed that a model, trained on a robust base session of classes, must adapt to new classes with only few samples for each new class. In both of these scenarios, it is intuitive to rely on rehearsal [12], where the model replays previously seen samples while learning new classes to preserve earlier knowledge and stabilize the feature space of incremental sessions. While rehearsal strategies have traditionally been effective at mitigating forgetting, they introduce significant deployment concerns. In many real-world scenarios, privacy regulations mandate that data be discarded immediately after processing. This constraint is particularly critical in malware analysis, where maintaining a persistent buffer of live malicious code poses a severe security risk, potentially leading to accidental execution or leakage [13, 14]. Consequently, a rehearsal-free framework is essential for secure continual learning, as it allows the system to discard malware samples immediately after model updates. However, the absence of a replay buffer typically hurts the stability and plasticity needed for continual learning models. Without past data to anchor the optimization, updating the model typically degrades the feature space and collapses previously learned decision boundaries [15]. In this work, we propose a multi-faceted approach to rehearsal-free FSCIL for malware detection through a modern, adapter-based strategy. Motivated by recent successes in leveraging pre-trained models for rehearsal-free CIL [15, 8, 16], we first pre-train a transformer from scratch on malware packets using a self-supervised objective [17]. We then adapt the pre-trained backbone to incremental sessions with low-rank adaptation (LoRA) [18] and perform classification using a prototype-based decision rule. Despite its simplicity, our approach outperforms previous continual learning methods for malware classification that rely on complex architectures. Finally, we evaluate under a fine-grained protocol where specific attack subtypes are treated as independent classes. This approach avoids simplifying the task through hierarchical grouping, thereby forcing the model to resolve high inter-class similarity and substantially increasing the difficulty of incremental adaptation. Overall, our contributions can be summarized as follows: • We introduce domain-specific self-supervised pre-training on malware payloads with parameter-efficient LoRA updates on a frozen backbone and a prototype-based classifier to preserve decision boundaries over time. • We propose the first framework to combine self-supervised pre-training from scratch with adapter-based few-shot continual learning for malicious packet recognition, enabling efficient adaptation to emerging malware classes without retaining previously observed samples. • We provide an extensive empirical evaluation across multiple benchmark datasets, achieving state-of-the-art performance in few-shot continual malware classification. I Related Work I-A Few-Shot Class Incremental Learning and Rehearsal FSCIL [11] extends CIL [15, 19] by adapting to novel classes with scarce labeled data. While earlier approaches relied on metric learning [20] or full fine-tuning [21], recent trends leverage frozen pre-trained transformers adapted through Parameter-Efficient Fine-Tuning (PEFT). Common prompt-based PEFT methods [22, 23] often face optimization difficulties [24]. To address this, we utilize an adapter-based strategy [10, 25], injecting lightweight modules into the frozen backbone to mitigate forgetting without the slow convergence associated with prompting. Rehearsal, or experience replay [12], mitigates forgetting by storing and replaying past exemplars. While effective at maintaining decision boundaries, storing raw malware samples poses severe security and privacy risks, such as accidental execution or leakage [26, 27]. Consequently, the field is shifting toward rehearsal-free methods [23, 25] that rely on pre-trained models rather than stored data. In this work, we explicitly evaluate the performance trade-off between rehearsal-based and rehearsal-free architectures specifically within the malware domain. I-B Continual Learning for Malware Classification An early finding in continual learning for malware classification is that many continual learning techniques, originally developed and benchmarked in computer vision, do not transfer cleanly to malware. Rahman et al. [28] evaluated a broad set of CL methods on malware datasets and found that many approaches fail to prevent catastrophic forgetting. This motivates malware-specific investigations into which continual learning assumptions are actually realistic for security deployments. FSCIL malware detection has also been explored in [29], where a base-stage model is trained with a replay-like variational autoencoder mechanism, and incremental sessions freeze the feature extractor while updating a prototype-based classifier. BFS-NID [30] mitigates forgetting for FSCIL by fixing the feature extractor parameters after the base session and utilizing a branch classifier learning module. In contrast to prior work, we propose the first malicious packet recognition framework to combine domain-specific self-supervised pre-training from scratch with adapter-based FSCIL, enabling rehearsal-free adaptation under scarce incremental data. I Preliminaries Fig. 1: The overall architecture of the proposed rehearsal-free FSCIL approach for malicious packet recognition. I-A FSCIL Problem Setup FSCIL follows a similar sequential structure to CIL, but introduces severe data constraints for later tasks. Learning proceeds over a sequence of T tasks =0,1,…,T−1T=\T_0,T_1,…,T_T-1\, where the first task 0T_0 is denoted as the base session. In the base session, a comprehensive label space (0)Y^(0) is provided along with ample data for each class, establishing a robust feature representation. However, for each subsequent incremental session tT_t (where 1≤t<T1≤ t<T), only a few training samples per class are available. These incremental datasets (t)D^(t) are arranged in an N-way K-shot format, where N new classes are introduced with only K labeled examples each. As in CIL, the class sets are disjoint: (i)∩(j)=∅Y^(i) ^(j)= for any i≠ji≠ j. During inference after session t, the model is evaluated on a query test set test(≤t)D^(≤ t)_test containing samples from the cumulative label set (≤t)=⋃j=0t(j)Y^(≤ t)= _j=0^tY^(j). The goal is to incorporate new classes from scarce examples without catastrophic forgetting of the previously learned classes. IV Proposed Method In this section, we describe the architecture and training protocol of our rehearsal-free malicious packet recognition FSCIL framework. Our approach operates in three distinct stages: self-supervised pre-training of a byte-level transformer encoder to learn protocol semantics from scratch, PEFT on base classes using LoRA, and a rehearsal-free incremental prototype classification stage for novel malware families. The overall framework of our approach is shown in Fig. 1. IV-A Transformer Encoder Adapting pre-trained models to downstream tasks has gained significant traction due to the ability of large-scale models to be efficiently fine-tuned for specialized classification tasks [15, 31]. This is prevalent in computer vision, where transformers are routinely fine-tuned for continual object classification. Motivated by these insights, we propose self-supervised pre-training of a transformer backbone on raw malware packets to learn robust, domain-specific feature representations before the introduction of class labels, shown to be effective in our previous work [2]. We employ a transformer encoder [17] to process network packets as sequences of bytes. Unlike traditional Natural Language Processing (NLP) which operates on word tokens, our model treats each byte value (0-255) as a discrete token. To handle variable-length inputs and masking, we extend the byte token space size to V=258V=258, reserving indices 256 for padding and 257 for masking. The backbone consists of an embedding layer, positional encodings, and a stack of multi-head self-attention blocks. Given an input packet sequence =[x1,…,xL]X=[x_1,…,x_L], the embedding layer maps each byte to a vector of dimension dmodel=768d_model=768. Standard positional encodings are added to preserve sequence order information. The self-attention mechanism computes contextual dependencies between bytes through: Attention(,,)=softmax(⊤dk),Attention(Q,K,V)=softmax ( QK d_k )V, (1) where ,,Q,K,V are the query, key, and value projections. We utilize a mean-pooling operation over the final hidden states to extract a fixed-size global representation vector ∈ℝdmodele ^d_model for each packet. IV-B Self-Supervised Pre-training To learn robust packet representations without explicit labeled classes, we train the backbone using a Masked Language Modeling (MLM) objective. Given an unlabelled packet sequence x, we generate a binary mask M∈0,1LM∈\0,1\^L where each position has a 15% probability of being masked. This forces the model to reconstruct the original byte value xix_i solely relying on the contextual information provided by the surrounding unmasked bytes. The model projects the output hidden states of masked positions to the byte token space size V using a linear prediction head. We optimize the parameters θ by minimizing the cross-entropy loss between the predicted probabilities and the original byte indices: ℒMLM=−∑i∈ℳlogP(xi|~;θ),L_MLM=- _i P(x_i| x;θ), (2) where ℳM is the set of masked indices and ~ x represents the masked input sequence. We utilize the AdamW optimizer with a learning rate of 1×10−41× 10^-4 and weight decay to mitigate overfitting during this phase. This yields a general-purpose feature extractor fθ(⋅)f_θ(·) trained on malicious packet bytes. To adapt this extractor to specific malware families without destroying these general features, we proceed with a PEFT strategy with LoRA on the base session. IV-C Base Session Adaptation with LoRA Following pre-training, full fine-tuning on labeled data can lead to catastrophic forgetting of the pre-trained features due to overfitting to the few, newly introduced samples [16]. Therefore, it is important to develop a system that retains knowledge learned during the base session while remaining robust to the few malware samples introduced in later incremental sessions. However, this is a difficult task since we must learn from only K malware samples in incremental sessions due to our FSCIL constraints. To address this, we adopt an adapter-based approach through LoRA [18], which enables efficient adaptation of pre-trained models by freezing the weights learned during pre-training and injecting trainable low-rank matrices into the attention layers. For a pre-trained weight matrix 0∈ℝdout×dinW_0 ^d_out× d_in, LoRA modifies the forward pass as: =0+Δ,y=W_0x+ , (3) where x and y denote the input and output activations, respectively. The update Δ= =AB is decomposed into low-rank matrices ∈ℝr×dinB ^r× d_in and ∈ℝdout×rA ^d_out× r, where r≪min(din,dout)r (d_in,d_out) is a user-chosen rank controlling the capacity of the adaptation. In this paper, we set the rank to 8 for all experiments. By constraining the update to this low-rank structure, LoRA captures the most important task-specific changes while requiring far fewer trainable parameters than updating the full weight matrix. We apply LoRA to the query, key, and value projections of our transformer-based packet encoder. IV-D Rehearsal-Free Incremental Learning While LoRA enables efficient adaptation in the base session, continuing to update the model during incremental few-shot sessions can cause feature drift and degrade previously learned decision boundaries. However, a frozen feature space is viable in our setting because malware packet classes share underlying structural semantics. Our prior work demonstrated that different malware classes share such semantics in their packets [2, 5]. By leveraging SSL during pre-training and LoRA during the base session, we establish a universal feature extractor that does not require further gradient updates to recognize new classes. As previously discussed, reliance on replay buffers would violate rehearsal-free constraints because it requires storing privacy-sensitive historical data. Therefore, we design a lightweight prototype construction phase that simply averages the available features of the newly introduced classes. Prototype Formation: Formally, when K-shot support samples are provided for a new class c, we compute its prototype cp_c by averaging the L2L_2-normalized feature vectors of the support set ScS_c, followed by a re-normalization step: c=Normalize(1|Sc|∑∈Scfθ()‖fθ()‖2)p_c=Normalize ( 1|S_c| _x∈ S_c f_θ(x)\|f_θ(x)\|_2 ) (4) where fθf_θ represents the frozen, pre-trained feature extractor and Normalize()=/‖2Normalize(v)=v/\|v\|_2. Inference: Unlike traditional Prototypical Networks [32] that utilize Euclidean distance, we employ a scaled cosine-similarity classifier to align with the normalized embedding space. Given the set of class prototypes c\p_c\ and a query embedding q=Normalize(fθ(q))z_q=Normalize(f_θ(x_q)), we compute the similarity scores: sc=γ⋅(q⊤c)s_c=γ·(z_q p_c) (5) where γ is a scaling factor and scs_c represents the logit for class c. These logits are converted into class probabilities via the softmax function: p(y=c∣q)=exp(sc)∑jexp(sj).p(y=c _q)= (s_c) _j (s_j). (6) The predicted label for qx_q is argmaxcp(y=c∣q) _c\,p(y=c _q). Since fθ(⋅)f_θ(·) remains frozen (no gradients are back-propagated) during our incremental testing scenario, we perform inference directly using these computed similarities. IV-E Rehearsal-Based Incremental Learning To provide a comparative baseline, we implement a rehearsal-based variant that relaxes standard privacy constraints to store a small buffer of exemplars. Unlike our proposed method, which relies on a static feature space, this variant continues parameter updates during incremental sessions using a combined dataset of the current few-shot samples and stored exemplars from previously seen classes. The replayed exemplar buffer is mixed with the new samples during training to constrain feature drift and reduce forgetting. After each session, we update the memory bank with exemplars from the newly introduced classes and refresh the prototype set by re-encoding the stored exemplars under the updated model to recompute class centroids. We argue that this strategy is suboptimal since it requires storing sensitive raw payloads, and the overfitting induced by repeated updates on limited data can degrade the generalizability of the SSL and base-session features. TABLE I: Experimental Splits. Both benchmarks (S0S_0 Base, S1−3S_1-3 Incremental) are evaluated under identical 5-shot constraints with 70 query samples per incremental class. Sess. Task Type Samples (Train / Test) Attack Class Composition CIC-IDS2017 UNSW-NB15 S0S_0 Base (Many-Shot) 500 / 200 ∙ DDoS ∙ Generic ∙ Infiltration ∙ Analysis ∙ DoS Slowhttptest ∙ Reconnaissance ∙ FTP-Patator — S1S_1 Inc. (5-Shot) 5 / 70 ∙ SSH-Patator ∙ Shellcode ∙ Heartbleed ∙ DoS ∙ DoS Slowloris — S2S_2 Inc. (5-Shot) 5 / 70 ∙ Web – Brute Force ∙ Backdoor ∙ Web – XSS ∙ Fuzzers ∙ DoS GoldenEye — S3S_3 Inc. (5-Shot) 5 / 70 ∙ Bot ∙ Exploits ∙ PortScan ∙ Worms ∙ DoS Hulk — TABLE I: 5-Shot FSCIL Performance on UNSW-NB15 and CIC-IDS2017. Dataset Strategy Method # Exemplars S0 S1 S2 S3 FGT CIC-IDS2017 No-Rehearsal BFS-NID [30] 0 98.2098.20±0.86± 0.86 75.9175.91±3.13± 3.13 64.6164.61±1.46± 1.46 52.3052.30±5.07± 5.07 22.0522.05±3.98± 3.98 MalFSCIL [29] 0 84.8084.80±1.53± 1.53 65.1165.11±2.09± 2.09 52.9252.92±2.38± 2.38 41.9041.90±2.46± 2.46 17.2817.28±4.98± 4.98 Proposed 0 99.9299.92±0.70± 0.70 83.7983.79±1.69± 1.69 71.0171.01±2.87± 2.87 61.0561.05±2.47± 2.47 8.598.59±1.54± 1.54 Rehearsal Proposed 1 99.8899.88±0.10± 0.10 76.7776.77±3.08± 3.08 58.3058.30±5.09± 5.09 53.2353.23±6.58± 6.58 29.2029.20±8.19± 8.19 Proposed 5 99.9199.91±0.11± 0.11 84.4684.46±3.43± 3.43 70.4670.46±3.74± 3.74 59.5459.54±5.68± 5.68 19.9519.95±2.13± 2.13 UNSW-NB15 No-Rehearsal BFS-NID [30] 0 83.6683.66±0.83± 0.83 74.1974.19±1.04± 1.04 60.5060.50±2.62± 2.62 50.4450.44±6.81± 6.81 13.6713.67±5.48± 5.48 MalFSCIL [29] 0 75.9475.94±12.59± 12.59 51.2251.22±16.55± 16.55 23.1823.18±6.77± 6.77 17.0117.01±4.79± 4.79 34.9134.91±4.63± 4.63 Proposed 0 88.5688.56±0.42± 0.42 74.7774.77±0.88± 0.88 64.6664.66±4.36 4.36 58.5958.59±5.38± 5.38 9.149.14±4.70± 4.70 Rehearsal Proposed 1 85.3985.39±0.89± 0.89 61.5361.53±12.90± 12.90 47.7747.77±9.59± 9.59 40.6640.66±2.62± 2.62 26.8526.85±6.42± 6.42 Proposed 5 88.8988.89±1.15± 1.15 74.7374.73±2.92± 2.92 53.6753.67±2.32± 2.32 50.0150.01±3.27± 3.27 17.7617.76±1.33± 1.33 V Experimental Results Datasets and Metrics. Our method is evaluated on two renowned malicious datasets, specifically CIC-IDS2017 [33] and UNSW-NB15 [34], utilizing the extracted datasets made available through Payload-byte [35]. Table I details the dataset splits across both benchmarks. Furthermore, SSL pre-training is performed using the Session 0 split, which is used to learn the pre-trained encoder initialization. Consistent with standard FSCIL protocols [11], we divide the training process into a robust base session (S0S_0) and sequential incremental sessions (S1,…,SNS_1,…,S_N). For the base session, we assume sufficient data availability and utilize 500 training samples per class to establish a discriminative initial feature space. For all subsequent incremental sessions, we enforce a N-way, K-Shot format, where the model must learn new attack patterns using only K support samples. We evaluate on a cumulative test set containing query samples from all classes observed up to the current session. All results are averaged over three random seeds. We employ two standard metrics: Accuracy on the cumulative test set at the current session and Average Forgetting measures the decline in knowledge retention. For each previously learned class, we calculate the difference between peak accuracy (the highest accuracy ever achieved for the class in any prior session) and the current accuracy. We report the average of these drops across all old classes. All experiments are performed on a single NVIDIA H100 GPU. V-A Main Experimental Results In this section, we discuss our main experimental results presented in Table I. On both CIC-IDS2017 and UNSW-NB15, our proposed rehearsal-free method significantly outperforms existing baselines. Against the SOA Rehearsal-Free baseline methods, our method achieves a final session (S3S_3) accuracy improvement of +8.75%+8.75\% on CIC-IDS2017 (61.05%61.05\% vs 52.30%52.30\%) and +8.15%+8.15\% on UNSW-NB15 (58.59%58.59\% vs 50.44%50.44\%). Furthermore, our method demonstrates superior stability, reducing the average forgetting rate by roughly half compared to MalFSCIL. This indicates that the combination of SSL pre-training and LoRA adapters establishes a far more robust feature space than the variational autoencoder approach used in prior work. A key observation in our results is the performance trade-off between our Rehearsal-Based (Buffer=5) and Rehearsal-Free (Buffer=0) variants. As shown in Table I, both methods achieve comparable global accuracy in the final session (e.g., 61.05%61.05\% vs 59.54%59.54\% on CIC-IDS2017). However, their underlying behavior differs fundamentally regarding average forgetting. The rehearsal-based variant exhibits significantly higher forgetting (19.95%19.95\% on CIC-IDS2017) compared to the Rehearsal-Free approach (8.59%8.59\%). This illustrates the classic stability-plasticity dilemma. The rehearsal-based method allows for plasticity (updating LoRA weights), which enables it to learn new incremental classes effectively, but this weight update causes a drift in the feature space, leading to the forgetting of base classes. However, our rehearsal-free method enforces strict stability by freezing the weights. While the incremental sesssions remain static, the robust SSL-initialized backbone ensures that the base classes are preserved with minimal degradation. The rehearsal-free method achieves superior or equivalent overall performance without the security risks associated with storing a replay buffer, validating our hypothesis that a static, robustly pre-trained feature space is preferable for malware FSCIL. VI Limitations While this work advances the state of FSCIL for malware detection, it is important to discuss the limitations associated with this field. First, our approach relies on the self-supervised pre-training of a transformer backbone from scratch which incurs significant initial computational costs. Although improvements in GPUs and hardware makes this manageable, and the use of SSL eliminates the need for labeled data during this phase, the quality of the resulting model remains heavily dependent on the diversity of the unlabeled malware corpus used for pre-training. Next, our rehearsal-free strategy enforces a static feature space during incremental sessions to prevent catastrophic forgetting. While effective for stability, this design assumes that the pre-trained backbone and base-session adapters yield sufficiently discriminative features for all future malware variants. If novel attacks exhibit a significant domain shift relative to the pre-training distribution, the frozen encoder may limit plasticity compared to methods that continuously fine-tune the backbone. However, we empirically address this concern in our experiments by injecting diverse classes during incremental sessions, thereby demonstrating the robustness of our feature space to significant semantic shifts. Finally, the proposed framework is specifically optimized for dynamic threat landscapes where retraining is prohibitive. In static environments where the set of malware families changes infrequently, the complexity of a continual learning system may exceed that of simpler, static classifiers. VII Conclusion In this paper, we proposed a rehearsal-free FSCIL framework for malware classification that leverages SSL pre-training and LoRA to address catastrophic forgetting. By selectively updating only the self-attention layers from the domain specific SSL objective, our method effectively integrates new classes from scarce samples while preserving robust base representations. Extensive experiments on CIC-IDS2017 and UNSW-NB15 demonstrate that our approach significantly outperforms previous baselines in stability, showing that a robust frozen feature space is preferable to data replay in security-sensitive domains. Our findings underscore the advantages of targeted parameter tuning for deploying adaptive intrusion detection systems where data retention is prohibited. VIII Acknowledgment This work is partially supported by the UWF Argo Cyber Emerging Scholars (ACES) program funded by the National Science Foundation (NSF) CyberCorps® Scholarship for Service (SFS) award under grant number 1946442. Any opinions, findings, and conclusions or recommendations expressed in this document are those of the authors and do not necessarily reflect the views of the NSF. References [1] M. J. De Lucia, P. E. Maxwell, N. D. Bastian, A. Swami, B. Jalaian, and N. Leslie (2021) Machine learning raw network traffic detection. In Artificial intelligence and machine learning for multi-domain operations applications I, Vol. 11746, p. 185–194. Cited by: §I. [2] K. Stein, G. Francia, E. El-Sheikh, and A. A. Mahyari (2025) Packet inspection transformer: a self-supervised journey to unseen malware detection with few samples. IEEE Access 13, p. 196336–196354. Cited by: §I, §IV-A, §IV-D. [3] M. Lotfollahi, M. Jafari Siavoshani, R. Shirali Hossein Zade, and M. Saberian (2020) Deep packet: a novel approach for encrypted traffic classification using deep learning. Soft Computing 24 (3), p. 1999–2012. Cited by: §I. [4] U. Tayyab, F. B. Khan, M. H. Durad, A. Khan, and Y. S. Lee (2022) A survey of the recent trends in deep learning based malware detection. Journal of Cybersecurity and Privacy 2 (4), p. 800–829. Cited by: §I. [5] K. Stein, A. A. Mahyari, G. Francia, and E. El-Sheikh (2024) Towards novel malicious packet recognition: a few-shot learning approach. In MILCOM 2024-2024 IEEE Military Communications Conference (MILCOM), p. 847–852. Cited by: §I, §IV-D. [6] R. M. French (1999) Catastrophic forgetting in connectionist networks. Trends in cognitive sciences 3 (4), p. 128–135. Cited by: §I. [7] M. De Lange, R. Aljundi, M. Masana, S. Parisot, X. Jia, A. Leonardis, G. Slabaugh, and T. Tuytelaars (2021) A continual learning survey: defying forgetting in classification tasks. IEEE transactions on pattern analysis and machine intelligence 44 (7), p. 3366–3385. Cited by: §I. [8] D. Zhou, H. Sun, J. Ning, H. Ye, and D. Zhan (2024) Continual learning with pre-trained models: a survey. In IJCAI, p. 8363–8371. Cited by: §I, §I, §I. [9] J. He and F. Zhu (2022) Exemplar-free online continual learning. In 2022 IEEE International Conference on Image Processing (ICIP), p. 541–545. Cited by: §I. [10] D. Zhou, H. Sun, H. Ye, and D. Zhan (2024) Expandable subspace ensemble for pre-trained model-based class-incremental learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 23554–23564. Cited by: §I, §I-A. [11] X. Tao, X. Hong, X. Chang, S. Dong, X. Wei, and Y. Gong (2020) Few-shot class-incremental learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 12183–12192. Cited by: §I, §I-A, §V. [12] S. Rebuffi, A. Kolesnikov, G. Sperl, and C. H. Lampert (2017) Icarl: incremental classifier and representation learning. In Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, p. 2001–2010. Cited by: §I, §I-A. [13] M. Guri, R. Puzis, K. R. Choo, S. Rubinshtein, G. Kedma, and Y. Elovici (2019) Using malware for the greater good: mitigating data leakage. Journal of Network and Computer Applications 145, p. 102405. Cited by: §I. [14] O. Or-Meir, N. Nissim, Y. Elovici, and L. Rokach (2019) Dynamic malware analysis in the modern era—a state of the art survey. ACM Computing Surveys (CSUR) 52 (5), p. 1–48. Cited by: §I. [15] D. Zhou, Q. Wang, Z. Qi, H. Ye, D. Zhan, and Z. Liu (2024) Class-incremental learning: a survey. IEEE Transactions on Pattern Analysis and Machine Intelligence. Cited by: §I, §I, §I-A, §IV-A. [16] K. Park, K. Song, and G. Park (2024) Pre-trained vision and language transformers are few-shot incremental learners. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 23881–23890. Cited by: §I, §IV-C. [17] J. Devlin, M. Chang, K. Lee, and K. Toutanova (2019) Bert: pre-training of deep bidirectional transformers for language understanding. In Proceedings of the North American Chapter of the Association for Computational Linguistics, Cited by: §I, §IV-A. [18] E. J. Hu, Y. Shen, P. Wallis, Z. Allen-Zhu, Y. Li, S. Wang, L. Wang, W. Chen, et al. (2022) Lora: low-rank adaptation of large language models.. ICLR 1 (2), p. 3. Cited by: §I, §IV-C. [19] W. Liu, X. Wu, F. Zhu, M. Yu, C. Wang, and C. Liu (2025) Class incremental learning with self-supervised pre-training and prototype learning. Pattern Recognition 157, p. 110943. Cited by: §I-A. [20] Y. Yang, H. Yuan, X. Li, Z. Lin, P. Torr, and D. Tao (2023) Neural collapse inspired feature-classifier alignment for few-shot class incremental learning. arXiv preprint arXiv:2302.03004. Cited by: §I-A. [21] C. Peng, K. Zhao, T. Wang, M. Li, and B. C. Lovell (2022) Few-shot class-incremental learning from an open-set perspective. In European Conference on Computer Vision, p. 382–397. Cited by: §I-A. [22] Z. Wang, Z. Zhang, C. Lee, H. Zhang, R. Sun, X. Ren, G. Su, V. Perot, J. Dy, and T. Pfister (2022) Learning to prompt for continual learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 139–149. Cited by: §I-A. [23] J. S. Smith, L. Karlinsky, V. Gutta, P. Cascante-Bonilla, D. Kim, A. Arbelle, R. Panda, R. Feris, and Z. Kira (2023) Coda-prompt: continual decomposed attention-based prompting for rehearsal-free continual learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 11909–11919. Cited by: §I-A, §I-A. [24] N. Ding, Y. Qin, G. Yang, F. Wei, Z. Yang, Y. Su, S. Hu, Y. Chen, C. Chan, W. Chen, et al. (2023) Parameter-efficient fine-tuning of large-scale pre-trained language models. Nature Machine Intelligence 5 (3), p. 220–235. Cited by: §I-A. [25] J. He, Z. Duan, and F. Zhu (2025) CL-lora: continual low-rank adaptation for rehearsal-free class-incremental learning. In Proceedings of the Computer Vision and Pattern Recognition Conference, p. 30534–30544. Cited by: §I-A, §I-A. [26] D. R. Thomas, S. Pastrana, A. Hutchings, R. Clayton, and A. R. Beresford (2017) Ethical issues in research using datasets of illicit origin. In Proceedings of the 2017 Internet Measurement Conference, p. 445–462. Cited by: §I-A. [27] M. Botes and G. Lenzini (2022) When cryptographic ransomware poses cyber threats: ethical challenges and proposed safeguards for cybersecurity researchers. In 2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), p. 562–568. Cited by: §I-A. [28] M. S. Rahman, S. Coull, and M. Wright (2022) On the limitations of continual learning for malware classificationon the limitations of continual learning for malware classification. In Conference on Lifelong Learning Agents, p. 564–582. Cited by: §I-B. [29] Y. Chai, X. Chen, J. Qiu, L. Du, Y. Xiao, Q. Feng, S. Ji, and Z. Tian (2024) Malfscil: a few-shot class-incremental learning approach for malware detection. IEEE Transactions on Information Forensics and Security. Cited by: §I-B, TABLE I, TABLE I. [30] L. Du, Z. Gu, Y. Wang, L. Wang, and Y. Jia (2023) A few-shot class-incremental learning method for network intrusion detection. IEEE Transactions on Network and Service Management 21 (2), p. 2389–2401. Cited by: §I-B, TABLE I, TABLE I. [31] Z. Han, C. Gao, J. Liu, J. Zhang, and S. Q. Zhang (2024) Parameter-efficient fine-tuning for large models: a comprehensive survey. arXiv preprint arXiv:2403.14608. Cited by: §IV-A. [32] J. Snell, K. Swersky, and R. Zemel (2017) Prototypical networks for few-shot learning. Advances in neural information processing systems 30. Cited by: §IV-D. [33] I. Sharafaldin, A. H. Lashkari, A. A. Ghorbani, et al. (2018) Toward generating a new intrusion detection dataset and intrusion traffic characterization.. ICISSp 1 (2018), p. 108–116. Cited by: §V. [34] N. Moustafa and J. Slay (2015) UNSW-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set). In 2015 military communications and information systems conference (MilCIS), p. 1–6. Cited by: §V. [35] Y. A. Farrukh, I. Khan, S. Wali, D. Bierbrauer, J. A. Pavlik, and N. D. Bastian (2022) Payload-byte: a tool for extracting and labeling packet capture files of modern network intrusion detection datasets. In 2022 IEEE/ACM International Conference on Big Data Computing, Applications and Technologies (BDCAT), p. 58–67. Cited by: §V.