TabCL: Continual Malware Classification with Tabular-Aware Generation

Despite advances in machine learning (ML)-based malware detection, the fundamental ML weakness of catastrophic forgetting (CF) has not yet been actively addressed, even though it poses a critical challenge due to the continual emergence of new malware families. While recent work such as MalCL applies generative replay (GR) using Generative Adversarial Networks (GANs), their approach does not account for the unique structural characteristics of tabular malware features or the computational burden of handling extremely high-dimensional feature spaces. To address these challenges, we introduce TabCL, an improved continual learning (CL) framework that adopts a conditional tabular GAN (CTGAN) for malware classification. Furthermore, to reduce the complexity of high-dimensional malware samples, we propose SiMBER, a SimHash-based feature compressor that reduces dimensionality by approximately 60% while preserving or even enhancing classification performance. By integrating a CTGAN with SiMBER, TabCL enables structure-aware modeling of malware samples across both continuous and categorical features while improving training efficiency. TabCL achieved over a 10% accuracy improvement and consistently outperforms all baselines across EMBER 2018, EMBER 2024, and MalDICT (The source code is available on https://github.com/AISec-EWHA/TabCL .).