KMITL

Permanent URI for this communityhttps://dspace.kmitl.ac.th/handle/kmitl/1

Browse

Settings

Access type: UnknownSubject: search.filters.subject.Incremental learning

Search Results

Now showing 1 - 3 of 3
  • Loading...
    Thumbnail Image
    Some of the metrics are blocked by your 
    consent settings
    Item type:Publication,
    Overcoming Concept Drift and Catastrophic Forgetting: Designing and Evaluating Deep Learning Architectures for Behavioral Malware Detection using Sysmon Data
    (2025-01-01)
    Thaibkhuang, Surapit
    ;
    Laungwilawan, Sorawit
    ;
    Pomsathit, Auttapon
    ;
    Ruangdech, Suppanat
    ;
    Pongpisutsopa, Suchittra
    In dynamic cybersecurity environments, traditional signature-based malware detection systems struggle to identify novel threats due to their reliance on static patterns. This study proposes a deep learning-based approach for behavioral malware detection using Sysmon logs, addressing two critical challenges: concept drift and catastrophic forgetting. The main contribution lies in a comprehensive comparative evaluation of four neural architectures CNN-only, CNN-BiLSTM with and without attention were evaluated alongside two continual learning strategies: fine-tuning and rehearsal. Experimental results demonstrate that fine-tuning enhances adaptability to new threats but severely degrades performance on previously learned data. In contrast, rehearsal-based incremental learning effectively mitigates forgetting while maintaining high detection accuracy across evolving datasets. Hybrid models incorporating attention mechanisms showed superior robustness. These findings underscore the importance of combining suitable neural architectures with continual learning techniques to build resilient and adaptive Endpoint Detection and Response (EDR) systems capable of handling real-world malware evolution. Future work includes collecting comprehensive real-world behavioral datasets, applying advanced continual learning strategies and exploring Graph Neural Networks or Transformers to improve detection robustness and adaptability.
  • Loading...
    Thumbnail Image
    Some of the metrics are blocked by your 
    consent settings
    Item type:Publication,
    A new incremental decision tree learning for cyber security based on ILDA and mahalanobis distance
    (2019-01-01)
    Jaiyen, Saichon
    ;
    Sornsuwit, Ployphan
    A cyber-attack detection is currently essential for computer network protection. The fundamentals of protection are to detect cyber-attack effectively with the ability to combat it in various ways and with constant data learning such as internet traffic. With these functions, each cyber-attack can be memorized and protected effectively any time. This research will present procedures for a cyber-attack detection system Incremental Decision Tree Learning (IDTL) that use the principle through Incremental Linear Discriminant Analysis (ILDA) together with Mahalanobis distance for classification of the hierarchical tree by reducing data features that enhance classification of a variety of malicious data. The proposed model can learn a new incoming datum without involving the previous learned data and discard this datum after being learned. The results of the experiments revealed that the proposed method can improve classification accuracy as compare with other methods. They showed the highest accuracy when compared to other methods. If comparing with the effectiveness of each class, it was found that the proposed method can classify both intrusion datasets and other datasets efficiently.
  • Loading...
    Thumbnail Image
    Some of the metrics are blocked by your 
    consent settings
    Item type:Publication,
    A new streaming learning for stream chunk data classification based on incremental learning and adaptive boosting algorithm
    (2018-01-01)
    Claypo, Niphat
    ;
    Hanskunatai, Anantaporn
    ;
    Jaiyen, Saichon
    Currently, stream data classification is a challenge task to discover new useful knowledge from massive and dynamic data in big data era. This paper proposes a streaming learning method based on the incremental learning using a new adaptive boosting algorithm for stream data. The proposed adaptive boosting consists of a new method for updating distribution weight and the new weight voting. This learning method concentrates on learning from sequential chunks of data stream. The distribution weight updating method uses error of previous hypothesis to update the weight. The learning method uses only one data chunk to create a new hypothesis at a time and after learning, the learned data chunk can be thrown away and can learn the new data chunk without using the previous learned data. The experimental results show that the accuracy of the proposed method is higher than other methods in all datasets.