Regression-Aware Continual Learning for Android Malware Detection

Machine learning-based malware detectors need frequent updates to handle new threats, but retraining from scratch with billions of samples is impractical, so continual learning (machine learning that learns incrementally from new data without forgetting old knowledge) is used instead. However, this research identifies a critical problem called security regression: even though overall detection performance may improve, some malware samples that were previously caught stop being detected after an update, silently reintroducing old threats. The researchers propose Positive Congruent Training (PCT), a regression-aware framework that integrates with existing continual learning strategies and reduces security regression by about 50% while maintaining strong overall detection performance.