# Zero Day Threat Detection Using Metric Learning Autoencoders

arXiv: https://arxiv.org/abs/2211.00441 · HTML: https://mlsanity.com/paper/2211.00441/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 3 of its 22 references that are in the map.
- First posted on arXiv 1 Nov 2022.

## Builds on (most cited first, 3 of 3)

- [Deep metric learning using Triplet network](https://mlsanity.com/paper/1412.6622/) (2014)
- [From Zero-Shot Machine Learning to Zero-Day Attack Detection](https://mlsanity.com/paper/2109.14868/) (2021)
- [Zero Day Threat Detection Using Graph and Flow Based Security Telemetry](https://mlsanity.com/paper/2205.02298/) (2022)

## Built on by (most cited first, 1 of 1)

- [CSTS: A Canonical Security Telemetry Substrate for AI-Native Cyber Detection](https://mlsanity.com/paper/2603.23459/) (2026)

## Abstract (arXiv)

The proliferation of zero-day threats (ZDTs) to companies' networks has been immensely costly and requires novel methods to scan traffic for malicious behavior at massive scale. The diverse nature of normal behavior along with the huge landscape of attack types makes deep learning methods an attractive option for their ability to capture highly-nonlinear behavior patterns. In this paper, the authors demonstrate an improvement upon a previously introduced methodology, which used a dual-autoencoder approach to identify ZDTs in network flow telemetry. In addition to the previously-introduced asset-level graph features, which help abstractly represent the role of a host in its network, this new model uses metric learning to train the second autoencoder on labeled attack data. This not only produces stronger performance, but it has the added advantage of improving the interpretability of the model by allowing for multiclass classification in the latent space. This can potentially save human threat hunters time when they investigate predicted ZDTs by showing them which known attack classes were nearby in the latent space. The models presented here are also trained and evaluated with two more datasets, and continue to show promising results even when generalizing to new network topologies.