标题： MalCL：利用基于GAN的生成重放来对抗恶意软件分类中的灾难性遗忘 显示英文标题

标题： MalCL: Leveraging GAN-Based Generative Replay to Combat Catastrophic Forgetting in Malware Classification

摘要： 持续学习（CL）用于恶意软件分类，应对恶意软件威胁的快速演变和新类型频繁出现的问题。 基于生成重放（GR）的CL系统利用生成模型生成过去数据的合成版本，然后将其与新数据结合以重新训练主模型。 该领域传统的机器学习技术通常难以应对灾难性遗忘，即模型在旧数据上的性能会随时间下降。 在本文中，我们引入了一个基于GR的CL系统，该系统采用具有特征匹配损失的生成对抗网络（GANs）来生成高质量的恶意软件样本。 此外，我们根据模型的隐藏表示实现了创新的重放样本选择方案。 我们在Windows和Android恶意软件数据集上进行了全面评估，在类增量学习场景下——其中新类别的数据在多个任务中持续引入——结果表明，我们的方法在性能上显著优于之前的方法。 例如，我们的系统在Windows恶意软件样本上的平均准确率为55%，比其他基于GR的模型高出28%。 这项研究为推进基于GR的恶意软件分类系统提供了实际见解。 实现代码可在\url {https://github.com/MalwareReplayGAN/MalCL}\footnote{代码将在论文发表时公开} 获取。 显示英文摘要

摘要： Continual Learning (CL) for malware classification tackles the rapidly evolving nature of malware threats and the frequent emergence of new types. Generative Replay (GR)-based CL systems utilize a generative model to produce synthetic versions of past data, which are then combined with new data to retrain the primary model. Traditional machine learning techniques in this domain often struggle with catastrophic forgetting, where a model's performance on old data degrades over time. In this paper, we introduce a GR-based CL system that employs Generative Adversarial Networks (GANs) with feature matching loss to generate high-quality malware samples. Additionally, we implement innovative selection schemes for replay samples based on the model's hidden representations. Our comprehensive evaluation across Windows and Android malware datasets in a class-incremental learning scenario -- where new classes are introduced continuously over multiple tasks -- demonstrates substantial performance improvements over previous methods. For example, our system achieves an average accuracy of 55% on Windows malware samples, significantly outperforming other GR-based models by 28%. This study provides practical insights for advancing GR-based malware classification systems. The implementation is available at \url {https://github.com/MalwareReplayGAN/MalCL}\footnote{The code will be made public upon the presentation of the paper}.