Causal Meta-Learning for Few-Shot Threat Detection in NIDS
DOI:
https://doi.org/10.63313/AJET.9013Keywords:
Causal Meta-Learning, Few-Shot Threat Detection, Network Intrusion Detec-tion, zero-day attacksAbstract
In the realm of Network Intrusion Detection Systems (NIDS), detecting novel threats like zero-day attacks or variants poses significant challenges due to the scarcity of labeled samples and the difficulty in rapid model adaptation. This paper introduces a causal meta-learning framework based on Model-Agnostic Meta-Learning (MAML) to enable few-shot threat detection. The core innovation lies in incorporating causal invariance constraints into both the inner and outer loops of MAML, allowing the model to learn how to adapt quickly using causally invariant features that remain stable across varying threat distributions. By leveraging counterfactual reasoning and invariant risk minimization, the model disentangles causal factors from spurious correlations, enhancing robustness and generalization. Experimental evaluations on benchmark datasets, such as NSL-KDD and CIC-IDS2017, demonstrate superior performance in few-shot scenarios, achieving up to 10% higher detection accuracy compared to standard meta-learning baselines. This approach holds promise for real-time NIDS in dynamic environments, paving the way for more resilient cybersecurity defenses.
References
[1] Finn, C., Abbeel, P., & Levine, S. (2017, July). Model-agnostic meta-learning for fast adapta-tion of deep networks. In International conference on machine learning (pp. 1126-1135). PMLR.
[2] Baik, S., Choi, J., Kim, H., Cho, D., Min, J., & Lee, K. M. (2021). Meta-learning with task-adaptive loss function for few-shot learning. In Proceedings of the IEEE/CVF interna-tional conference on computer vision (pp. 9465-9474).
[3] Jamal, M. A., & Qi, G. J. (2019). Task agnostic meta-learning for few-shot learning. In Pro-ceedings of the IEEE/CVF conference on computer vision and pattern recognition (pp. 11719-11727).
[4] Jia, J., Feng, X., & Yu, H. (2024). Few-shot classification via efficient meta-learning with hy-brid optimization. Engineering Applications of Artificial Intelligence, 127, 107296.
[5] Jeong, T., & Kim, H. (2020). Ood-maml: Meta-learning for few-shot out-of-distribution de-tection and classification. Advances in Neural Information Processing Systems, 33, 3907-3916.
[6] Rojas-Carulla, M., Schölkopf, B., Turner, R., & Peters, J. (2018). Invariant models for causal transfer learning. Journal of Machine Learning Research, 19(36), 1-34.
[7] Xu, C., Zhang, F., Yang, Z. et al. A few-shot network intrusion detection method based on mutual centralized learning. Sci Rep 15, 9848 (2025). https://doi.org/10.1038/s41598-025-93185-0
[8] Yang, J., Li, H., Shao, S., Zou, F., & Wu, Y. (2022). FS-IDS: A framework for intrusion detec-tion based on few-shot learning. Computers & Security, 122, 102899.
[9] Li, P., Wang, Y., Li, Q., Liu, Z., Xu, K., Ren, J., ... & Lin, R. (2023, November). Learning from limited heterogeneous training data: Meta-learning for unsupervised zero-day web attack detection across web domains. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (pp. 1020-1034).
[10] Chen, J., Gao, Z., Wu, X., & Luo, J. (2023). Meta-causal learning for single domain generaliza-tion. In Proceedings of the IEEE/CVF conference on computer vision and pattern recogni-tion (pp. 7683-7692).
[11] Zayaan, S. (2025). Causal-Symbolic Meta-Learning (CSML): Inducing Causal World Models for Few-Shot Generalization. arXiv e-prints, arXiv-2509.
[12] Wu, H., Shi, W., & Wang, M. D. (2024). Developing a novel causal inference algorithm for personalized biomedical causal graph learning using meta machine learning. BMC Medical Informatics and Decision Making, 24(1), 137.
[13] Nilforoshan, H., Moor, M., Roohani, Y., Chen, Y., Šurina, A., Yasunaga, M., ... & Leskovec, J. (2023). Zero-shot causal learning. Advances in Neural Information Processing Systems, 36, 6862-6901.
[14] Bengio, Y., Deleu, T., Rahaman, N., Ke, R., Lachapelle, S., Bilaniuk, O., ... & Pal, C. (2019). A meta-transfer objective for learning to disentangle causal mechanisms. arXiv preprint arXiv:1901.10912.
[15] Bing, S., Wahl, J., Ninad, U., & Runge, J. (2023). Invariance & causal representation learning: Prospects and limitations. arXiv preprint arXiv:2312.03580.
[16] Cao, Q. P. X., Tran, D. D., Ngo, S. T. T., Nghi, K. H., Phan, D. T., & Pham, H. V. (2025, February). A study on Few-shot Learning approach for Intrusion Detection System with Class Incre-mental Learning. In Proceedings of the 2025 10th International Conference on Intelligent Information Technology (pp. 113-120).
[17] Ton, J. F., Sejdinovic, D., & Fukumizu, K. (2021, May). Meta learning for causal direction. In Proceedings of the AAAI conference on artificial intelligence (Vol. 35, No. 11, pp. 9897-9905).
[18] Alrayes, F. S., Amin, S. U., & Hakami, N. (2025). An Adaptive Framework for Intrusion De-tection in IoT Security Using MAML (Model-Agnostic Meta-Learning). Sensors (Basel, Switzerland), 25(8), 2487.
[19] Xu, C., Zhan, Y., Chen, G., Wang, Z., Liu, S., & Hu, W. (2025). Elevated few-shot network in-trusion detection via self-attention mechanisms and iterative refinement. PLoS One, 20(1), e0317713.
[20] Wang, Z., Hu, Y., Bühlmann, P., & Guo, Z. (2024). Causal invariance learning via efficient op-timization of a nonconvex objective. arXiv preprint arXiv:2412.11850.
Downloads
Published
Issue
Section
License
Copyright (c) 2025 by author(s) and Erytis Publishing Limited.
This work is licensed under a Creative Commons Attribution 4.0 International License.
How to Cite
