SMETA-ZSL Boosts Zero-Shot Threat Classification.

Cybersecurity systems constantly face new and evolving threats, for which labeled data is initially unavailable. Generalized zero-shot learning (GZSL) offers a promising solution by enabling the recognition of these unseen classes using auxiliary semantic knowledge. Large Language Models (LLMs) are particularly useful here, as they can convert unstructured threat intelligence reports into semantic prototypes. However, applying GZSL to cybersecurity is challenging due to semantic overlap in threat descriptions, heterogeneity between behavioral attributes and text, class imbalance, and open-set conditions. This paper introduces SMETA-ZSL, a system designed to overcome these difficulties. It learns robust semantic prototypes from overlapping language descriptions through contrastive finetuning. It then aligns behavioral features with these prototypes using episodic meta-learning and knowledge distillation. Finally, it incorporates adaptive routing to generalize effectively across both seen and unseen threat classes. Evaluated across seven benchmarks, SMETA-ZSL demonstrated superior generalized zero-shot performance in the strictest inductive setting. It surpassed previous methods by an average of 10.8 points, with gains up to 18.1 points, proving its effectiveness in rapidly adapting to emerging cybersecurity threats without requiring new labeled examples.