用语义对齐提升零样本威胁分类，无需标注数据即可识别新威胁。
SMETA-ZSL:Semantic Meta-Alignment for Zero-Shot Threat Classification
- 通过对比微调从重叠文本中学习语义原型。
- 在7个基准上平均超越现有方法10.8分，最高提升18.1分。
- 适合安全研究者与防御系统开发者快速应对未知威胁。
网络安全系统需快速应对新兴威胁，但新威胁类别常缺乏标注数据。通用零样本学习可通过辅助语义知识识别未见类别，而非依赖标注样本。大语言模型在此场景中尤为有效，能将非结构化的威胁情报报告转化为新兴威胁的语义原型。然而，将语言驱动的零样本学习应用于网络安全面临多重挑战：威胁描述语义高度重叠、行为属性与文本异质性显著、类别严重不均衡，以及开集条件下训练时未知的新威胁。本文提出SMETA-ZSL，通过对比微调从重叠语言描述中学习语义原型，利用周期性元学习与知识蒸馏对齐行为特征，并实现跨已见-未见类别的自适应路由以增强泛化能力。在7个基准上，SMETA-ZSL在最严格的归纳设定下达到最优的通用零样本性能，平均超越先前方法10.8个百分点，最高提升达18.1个百分点。代码开源：https://github.com/Security-And-Intelligence-Lab-UTEP/SMETA-ZSL。
原文摘要 · Abstract (English)
Cybersecurity systems must adapt rapidly to emerging threats. However, labeled data for new threat categories is unavailable when those threats first appear. Generalized zero-shot learning offers a natural solution by enabling recognition of unseen classes through auxiliary semantic knowledge rather than labeled examples. Large language models are particularly promising in this setting because they can convert unstructured CTI reports into semantic prototypes for emerging threats. However, applying language-driven zero-shot learning to cybersecurity is difficult due to strong semantic overlap between threat descriptions, heterogeneity between behavioral attributes and text, severe class imbalance, and open-set conditions where unseen threats are unknown during training. We propose SMETA-ZSL, that learns semantic prototypes from overlapping language descriptions through contrastive finetuning, aligns behavioral features through episodic meta-learning and knowledge distillation, and performs adaptive routing for generalization across seen-unseen classes. Across 7 benchmarks, SMETA-ZSL delivers the strongest overall generalized zero-shot performance under the strictest inductive setting, surpassing prior methods by 10.8 points on average, with gains up to 18.1 points. Github:https://github.com/Security-And-Intelligence-Lab-UTEP/SMETA-ZSL
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。