Title: Learning in Multiple Spaces: Few-Shot Network Attack Detection with Metric-Fused Prototypical Networks Show Chinese title

Title: 多空间学习：基于度量融合原型网络的少量-shot网络攻击检测

Abstract: Network intrusion detection systems face significant challenges in identifying emerging attack patterns, especially when limited data samples are available. To address this, we propose a novel Multi-Space Prototypical Learning (MSPL) framework tailored for few-shot attack detection. The framework operates across multiple metric spaces-Euclidean, Cosine, Chebyshev, and Wasserstein distances-integrated through a constrained weighting scheme to enhance embedding robustness and improve pattern recognition. By leveraging Polyak-averaged prototype generation, the framework stabilizes the learning process and effectively adapts to rare and zero-day attacks. Additionally, an episodic training paradigm ensures balanced representation across diverse attack classes, enabling robust generalization. Experimental results on benchmark datasets demonstrate that MSPL outperforms traditional approaches in detecting low-profile and novel attack types, establishing it as a robust solution for zero-day attack detection. Show Chinese abstract

Abstract: 网络入侵检测系统在识别新兴攻击模式时面临重大挑战，尤其是在可用数据样本有限的情况下。 为了解决这一问题，我们提出了一种新颖的多空间原型学习（MSPL）框架，专门针对少量样本攻击检测设计。 该框架在多个度量空间（欧几里得距离、余弦距离、切比雪夫距离和 Wasserstein 距离）下运行，并通过一种约束加权方案集成，以增强嵌入鲁棒性并改善模式识别效果。 通过利用 Polyak 平均原型生成方法，该框架稳定了学习过程，并有效适应了罕见和零日攻击。 此外，采用情景训练范式确保了不同攻击类别之间的平衡表示，从而实现稳健的泛化能力。 基准数据集上的实验结果表明，MSPL 在检测低频和新型攻击类型方面优于传统方法，确立了其作为零日攻击检测的稳健解决方案的地位。