# A Grassmannian Approach to Zero-Shot Learning for Network Intrusion Detection

arXiv: https://arxiv.org/abs/1709.07984 · HTML: https://mlsanity.com/paper/1709.07984/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 23 Sep 2017.

## Built on by (most cited first, 5 of 5)

- [On Generalisability of Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2205.04112/) (2022)
- [In Search of netUnicorn: A Data-Collection Platform to Develop Generalizable ML Models for Network Security Problems](https://mlsanity.com/paper/2306.08853/) (2023)
- [A Novel Contrastive Loss for Zero-Day Network Intrusion Detection](https://mlsanity.com/paper/2601.09902/) (2026)
- [Contrastive Self-Supervised Network Intrusion Detection using Augmented Negative Pairs](https://mlsanity.com/paper/2509.06550/) (2025)
- [Few-Shot Network Intrusion Detection Using Online Triplet Mining](https://mlsanity.com/paper/2605.17530/) (2026)

## Abstract (arXiv)

One of the main problems in Network Intrusion Detection comes from constant rise of new attacks, so that not enough labeled examples are available for the new classes of attacks. Traditional Machine Learning approaches hardly address such problem. This can be overcome with Zero-Shot Learning, a new approach in the field of Computer Vision, which can be described in two stages: the Attribute Learning and the Inference Stage. The goal of this paper is to propose a new Inference Stage algorithm for Network Intrusion Detection. In order to attain this objective, we firstly put forward an experimental setup for the evaluation of the Zero-Shot Learning in Network Intrusion Detection related tasks. Secondly, a decision tree based algorithm is applied to extract rules for generating the attributes in the AL stage. Finally, using a representation of a Zero-Shot Class as a point in the Grassmann manifold, an explicit formula for the shortest distance between points in that manifold can be used to compute the geodesic distance between the Zero-Shot Classes which represent the new attacks and the Known Classes corresponding to the attack categories. The experimental results in the datasets KDD Cup 99 and NSL-KDD show that our approach with Zero-Shot Learning successfully addresses the Network Intrusion Detection problem.