A few-shot learning framework for spotting rare and zero-day network attacks from very few labeled samples. Each attack class is summarized by a prototype, and samples are matched to prototypes across several distance measures simultaneously (Euclidean, cosine, Chebyshev, and Wasserstein), combined by a constrained weighting scheme to make the embedding more robust. Prototypes are stabilized using Polyak (running-average) updates and the model is trained episodically for balanced coverage of diverse attack classes, improving detection of novel, low-profile intrusions over single-metric prototypical baselines.
This paper tackles detecting rare and previously unseen (zero-day) network attacks when only a handful of labeled examples per attack type are available. It proposes Multi-Space Prototypical Learning…