# Learning in Multiple Spaces: Few-Shot Network Attack Detection with Metric-Fused Prototypical Networks

arXiv: https://arxiv.org/abs/2501.00050 · HTML: https://mlsanity.com/paper/2501.00050/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 3 of its 34 references that are in the map.
- First posted on arXiv 28 Dec 2024.

## Builds on (most cited first, 3 of 3)

- [Learning Meta Model for Zero- and Few-shot Face Anti-spoofing](https://mlsanity.com/paper/1904.12490/) (2019)
- [Few-shot Weakly-supervised Cybersecurity Anomaly Detection](https://mlsanity.com/paper/2304.07470/) (2023)
- [RoBERTa-Augmented Synthesis for Detecting Malicious API Requests](https://mlsanity.com/paper/2405.11258/) (2024)

## Built on by (most cited first, 1 of 1)

- [CSTS: A Canonical Security Telemetry Substrate for AI-Native Cyber Detection](https://mlsanity.com/paper/2603.23459/) (2026)

## Abstract (arXiv)

Network intrusion detection systems face significant challenges in identifying emerging attack patterns, especially when limited data samples are available. To address this, we propose a novel Multi-Space Prototypical Learning (MSPL) framework tailored for few-shot attack detection. The framework operates across multiple metric spaces-Euclidean, Cosine, Chebyshev, and Wasserstein distances-integrated through a constrained weighting scheme to enhance embedding robustness and improve pattern recognition. By leveraging Polyak-averaged prototype generation, the framework stabilizes the learning process and effectively adapts to rare and zero-day attacks. Additionally, an episodic training paradigm ensures balanced representation across diverse attack classes, enabling robust generalization. Experimental results on benchmark datasets demonstrate that MSPL outperforms traditional approaches in detecting low-profile and novel attack types, establishing it as a robust solution for zero-day attack detection.