A dynamic embedding strategy using gated ensembles for few-shot attack detection

Network Intrusion Detection Systems (NIDS) are critical for cybersecurity, yet they consistently fail to detect novel, rare attacks due to the extreme scarcity of labeled data. While few-shot learning (FSL) offers a promising solution, existing methods often rely on single, static encoders that develop “blind spots”, failing to generalize across the diverse signatures of modern threats. To overcome this critical challenge, we propose a novel FSL framework built on a robust metric-learning paradigm. We have developed a novel Gated Ensemble Encoder, an architecture that learns a committee of “specialist” feature extractors managed by a dynamic gating mechanism. This design produces a dynamic embedding for each input by adaptively weighting the specialists’ contributions on a per-sample basis, thus eliminating the blind spots of monolithic models. To create a geometrically sound representation space, our architecture is meta-trained using a Prototypical Network strategy on a diverse set of common, high-volume attacks. During evaluation, the model demonstrates the ability to learn and classify entirely new, unseen attack classes from as few as five examples. Tested on the comprehensive NSL-KDD, CIC-IDS 2018, and CIC-ToN-IoT datasets, our framework achieves a Macro F1-Score of up to 0.84 in challenging 4-Way, 5-Shot scenarios and successfully detects attack classes that were previously undetectable. These results validate our dynamic embedding strategy as a highly effective and practical solution for zero-day threat identification in real-world, data-scarce environments.