# Towards Novel Malicious Packet Recognition: A Few-Shot Learning Approach

arXiv: https://arxiv.org/abs/2409.11254 · HTML: https://mlsanity.com/paper/2409.11254/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 26 references that are in the map.
- First posted on arXiv 17 Sep 2024.

## Builds on (most cited first, 7 of 7)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Prototypical Networks for Few-shot Learning](https://mlsanity.com/paper/1703.05175/) (2017)
- [Deep Packet: A Novel Approach For Encrypted Traffic Classification Using Deep Learning](https://mlsanity.com/paper/1709.02656/) (2017)
- [On Episodes, Prototypical Networks, and Few-shot Learning](https://mlsanity.com/paper/2012.09831/) (2020)
- [A Transformer-Based Framework for Payload Malware Detection and Classification](https://mlsanity.com/paper/2403.18223/) (2024)
- [Detecting Unknown Attacks in IoT Environments: An Open Set Classifier for Enhanced Network Intrusion Detection](https://mlsanity.com/paper/2309.07461/) (2023)

## Built on by (most cited first, 4 of 4)

- [Frontier AI's Impact on the Cybersecurity Landscape](https://mlsanity.com/paper/2504.05408/) (2025)
- [Fine-tuned Large Language Models (LLMs): Improved Prompt Injection Attacks Detection](https://mlsanity.com/paper/2410.21337/) (2024)
- [Packet Inspection Transformer: A Self-Supervised Journey to Unseen Malware Detection with Few Samples](https://mlsanity.com/paper/2409.18219/) (2024)
- [Adapter-Based Few-Shot Continual Learning for Malicious Packet Recognition](https://mlsanity.com/paper/2608.23536/) (2026)

## Abstract (arXiv)

As the complexity and connectivity of networks increase, the need for novel malware detection approaches becomes imperative. Traditional security defenses are becoming less effective against the advanced tactics of today's cyberattacks. Deep Packet Inspection (DPI) has emerged as a key technology in strengthening network security, offering detailed analysis of network traffic that goes beyond simple metadata analysis. DPI examines not only the packet headers but also the payload content within, offering a thorough insight into the data traversing the network. This study proposes a novel approach that leverages a large language model (LLM) and few-shot learning to accurately recognizes novel, unseen malware types with few labels samples. Our proposed approach uses a pretrained LLM on known malware types to extract the embeddings from packets. The embeddings are then used alongside few labeled samples of an unseen malware type. This technique is designed to acclimate the model to different malware representations, further enabling it to generate robust embeddings for each trained and unseen classes. Following the extraction of embeddings from the LLM, few-shot learning is utilized to enhance performance with minimal labeled data. Our evaluation, which utilized two renowned datasets, focused on identifying malware types within network traffic and Internet of Things (IoT) environments. Our approach shows promising results with an average accuracy of 86.35% and F1-Score of 86.40% on different malware types across the two datasets.