SMETA-ZSL:Semantic Meta-Alignment for Zero-Shot Threat Classification

# SMETA-ZSL: Semantic Meta-Alignment for Zero-Shot Threat Classification
Source: [https://arxiv.org/html/2607.09936](https://arxiv.org/html/2607.09936)
Ivan Alejandro Montoya Sanchez, Anantaa Kotal, Aritran Piplai The University of Texas at El Paso 500 W\. University Avenue El Paso, TX 79968, USA iamontoyasa@miners\.utep\.edu, \{akotal,apiplai\}@utep\.edu

###### Abstract

Cybersecurity systems must adapt rapidly to emerging threats\. However, labeled data for new threat categories is unavailable when those threats first appear\. Generalized zero\-shot learning offers a natural solution by enabling recognition of unseen classes through auxiliary semantic knowledge rather than labeled examples\. Large language models are particularly promising in this setting because they can convert unstructured CTI reports into semantic prototypes for emerging threats\. However, applying language\-driven zero\-shot learning to cybersecurity is difficult due to strong semantic overlap between threat descriptions, heterogeneity between behavioral attributes and text, severe class imbalance, and open\-set conditions where unseen threats are unknown during training\. We propose SMETA\-ZSL, that learns semantic prototypes from overlapping language descriptions through contrastive finetuning, aligns behavioral features through episodic meta\-learning and knowledge distillation, and performs adaptive routing for generalization across seen\-unseen classes\. Across 7 benchmarks, SMETA\-ZSL delivers the strongest overall generalized zero\-shot performance under the strictest inductive setting, surpassing prior methods by 10\.8 points on average, with gains up to 18\.1 points\. Github:[https://github\.com/Security\-And\-Intelligence\-Lab\-UTEP/SMETA\-ZSL](https://github.com/Security-And-Intelligence-Lab-UTEP/SMETA-ZSL)

## 1Introduction

Cyber defense systems rely on large amounts of raw data, such as malware samples or logs, to train and update models, yet this data is often difficult to obtain, slow to analyze, and not always available when new threats emerge\. Consider the task of malware classification: the continuous emergence of new variants and families\(Tanget al\.,[2023](https://arxiv.org/html/2607.09936#bib.bib57)\)necessitates frequent retraining of classifiers, imposing significant computational overhead\(Liet al\.,[2024a](https://arxiv.org/html/2607.09936#bib.bib58)\)and making it difficult to obtain timely, labeled data for adapting models to new threats\(Barroset al\.,[2022](https://arxiv.org/html/2607.09936#bib.bib15); Aurnaet al\.,[2025](https://arxiv.org/html/2607.09936#bib.bib31)\)\. In contrast, Cyber Threat Intelligence \(CTI\) reports are regularly published by analysts and provide timely natural language descriptions of attacker behavior\. However, most defense systems do not operate over natural language, and therefore cannot directly use CTI to adapt or update their behavior, leaving valuable intelligence underutilized\. Large Language Models \(LLMs\) offer a way to process CTI and extract information that can be used by downstream systems\. Prior work\(Chakrabortyet al\.,[2026](https://arxiv.org/html/2607.09936#bib.bib61); Mitraet al\.,[2025](https://arxiv.org/html/2607.09936#bib.bib62); Bertigeret al\.,[2025](https://arxiv.org/html/2607.09936#bib.bib63); Schwartzet al\.,[2025](https://arxiv.org/html/2607.09936#bib.bib65)\)has largely focused on using LLMs to generate rule\-based defenses\. In contrast, leveraging CTI to update data\-driven, black\-box machine learning systems is significantly more difficult, as it requires converting textual descriptions into signals that can influence model behavior without access to raw data\. This gap creates an important language modeling problem:can language models convert unstructured threat reports into representations that are useful for updating non\-linguistic machine learning systems, even when no labeled examples of the new threat exist?Directly using LLMs for zero\-shot malware or attack detection is challenging because cybersecurity artifacts are often too large to analyze in full, making inference costly and frequently exceeding practical context\-window limits\(Qianet al\.,[2025](https://arxiv.org/html/2607.09936#bib.bib4)\)\. Truncating these artifacts into abstract features degrades performance\(Zhouet al\.,[2024](https://arxiv.org/html/2607.09936#bib.bib2)\)\. Instead, the goal is to extract and transfer knowledge from CTI using language models to adapt existing cyber\-defense systems\.

We formulate this problem as a Generalized Zero\-Shot Learning \(GZSL\) setting, where a downstream machine learning model must recognize both seen and unseen classes, with Cyber Threat Intelligence \(CTI\) providing semantic information for unseen threats\. While GZSL with semantic auxiliary information has been extensively explored in generalized settings, such as the vision\-language domain\(Chenet al\.,[2023](https://arxiv.org/html/2607.09936#bib.bib17); Ma and Hu,[2020](https://arxiv.org/html/2607.09936#bib.bib28); Raoet al\.,[2024](https://arxiv.org/html/2607.09936#bib.bib16); Leiet al\.,[2024](https://arxiv.org/html/2607.09936#bib.bib24)\), its application to cybersecurity remains an open and largely unsolved challenge, despite being of critical practical importance\. The unique challenges in this setup are as follows\.

1. 1\.Semantic ambiguity of class prototypes:Unlike generalized domains with distinguishable semantic features, cybersecurity relies on CTI reports whose descriptions often overlap heavily across malware families\. Different families frequently share APIs, behavioral patterns, and attack techniques, making semantic prototypes weakly separable and reducing transfer to unseen classes\. Figure[1](https://arxiv.org/html/2607.09936#S1.F1)illustrates this challenge\.
2. 2\.Cross\-modal heterogeneity:Malware features are derived from behavioral observations such as API calls, system traces, and network traffic \. These features differ substantially from the sparse, high\-level semantics of CTI reports, making alignment between feature and semantic spaces difficult\.
3. 3\.Class imbalance:Seen class dominance is already a major challenge in GZSL \. In cybersecurity, this is amplified by severe imbalance, where benign samples dominate and emerging malware families are rare , biasing predictions toward frequent seen classes\.
4. 4\.Open\-set classification:In practice, the number and identity of unseen malware families are unknown during training\. Models must therefore distinguish between seen and unseen threats without assuming a fixed set of candidate unseen classes in advance\.

We proposeSMETA\-ZSL, a semantically grounded meta\-GZSL framework designed for the realistic cyber threat setting in which unseen classes are not predefined during training, unlabeled unseen instances are unavailable, and adaptation must rely solely on natural\-language CTI reports rather than raw artifacts\. Unlike prior methods that assume closed sets, access to raw unseen\-class data, or predefined unseen prototypes, SMETA\-ZSL operates under a stricteropen\-set, class\-inductive, instance\-inductive setting\. To address the resulting challenges, our framework combines: \(1\) a contrastively fine\-tuned LLM encoder that produces discriminative semantic prototypes from overlapping CTI descriptions; \(2\) a cross\-modal alignment framework that uses episodic meta\-learning to explicitly simulate unseen\-class emergence during training; and \(3\) a parameter\-free gating mechanism for adaptive inference\. Across 7 benchmark datasets, SMETA\-ZSL delivers the strongest overall generalized zero\-shot performance under the strictest inductive setting\.

![Refer to caption](https://arxiv.org/html/2607.09936v1/images/CTI.png)Figure 1:CTI reports for two distinct malware families: Mobidash and Dowgin, share substantial lexical overlap in behavioral descriptions, illustrating why cybersecurity class prototypes are weakly separable in semantic space\.
## 2Background

ZSL addresses the problem of recognizing instances from classes never observed during training\(Pourpanahet al\.,[2022](https://arxiv.org/html/2607.09936#bib.bib35); Wanget al\.,[2019](https://arxiv.org/html/2607.09936#bib.bib34)\)\. In GZSL, the classifier must operate over the union of both seen and unseen classes simultaneously\(Liet al\.,[2024b](https://arxiv.org/html/2607.09936#bib.bib25); Vermaet al\.,[2020](https://arxiv.org/html/2607.09936#bib.bib21)\), compounding the difficulty with seen\-class dominance — where the posterior probability of seen classes systematically overwhelms that of unseen classes at inference time\(Kwon and Al Regib,[2022](https://arxiv.org/html/2607.09936#bib.bib60); Bhatet al\.,[2025](https://arxiv.org/html/2607.09936#bib.bib59); Xianet al\.,[2017](https://arxiv.org/html/2607.09936#bib.bib36)\)\. Since unseen classes are never observed during training, ZSL methods rely on auxiliary semantic information to bridge the gap\. Drawing inspiration from human cognition, where unfamiliar concepts are recognized through background knowledge relating them to familiar ones\(Fuet al\.,[2015](https://arxiv.org/html/2607.09936#bib.bib39); Romera\-Paredes and Torr,[2015](https://arxiv.org/html/2607.09936#bib.bib33); Tanget al\.,[2024](https://arxiv.org/html/2607.09936#bib.bib27); Liet al\.,[2024b](https://arxiv.org/html/2607.09936#bib.bib25); Sanchezet al\.,[2025](https://arxiv.org/html/2607.09936#bib.bib3)\), existing approaches broadly fall into three families: learning a joint embedding space between modalities and semantic representations\(Ali and Khan,[2023](https://arxiv.org/html/2607.09936#bib.bib32); Nawazet al\.,[2022](https://arxiv.org/html/2607.09936#bib.bib26); Chenet al\.,[2023](https://arxiv.org/html/2607.09936#bib.bib17); Leiet al\.,[2024](https://arxiv.org/html/2607.09936#bib.bib24)\), synthetically generating unseen\-class data from semantic descriptions\(Mishraet al\.,[2018](https://arxiv.org/html/2607.09936#bib.bib37); Ma and Hu,[2020](https://arxiv.org/html/2607.09936#bib.bib28); Tanget al\.,[2024](https://arxiv.org/html/2607.09936#bib.bib27); Wu and Bergman,[2025b](https://arxiv.org/html/2607.09936#bib.bib23);[Marszałeket al\.,](https://arxiv.org/html/2607.09936#bib.bib18)\), and learning semantic prototypes\(Wanget al\.,[2025a](https://arxiv.org/html/2607.09936#bib.bib19); Fuet al\.,[2017](https://arxiv.org/html/2607.09936#bib.bib55); Wanget al\.,[2021](https://arxiv.org/html/2607.09936#bib.bib56); Raoet al\.,[2024](https://arxiv.org/html/2607.09936#bib.bib16); Fanet al\.,[2026](https://arxiv.org/html/2607.09936#bib.bib30); Gill and others,[2026](https://arxiv.org/html/2607.09936#bib.bib20)\)\. Among these, the semantic prototype approach is particularly well\-suited for settings where class\-level descriptions are available but instance\-level data for unseen classes is absent\. ZSL has also been adapted to domain\-specific settings, including cybersecurity, where specialized frameworks address malware detection under data scarcity\(Barroset al\.,[2022](https://arxiv.org/html/2607.09936#bib.bib15); Wanget al\.,[2025b](https://arxiv.org/html/2607.09936#bib.bib29); Aurnaet al\.,[2025](https://arxiv.org/html/2607.09936#bib.bib31)\)\.

## 3Methodology

We propose SMETA\-ZSL, a semantically grounded GZSL framework for tabular data classification\. Our core hypothesis is that language models, when appropriately fine\-tuned, can serve as a reliable semantic bridge between overlapping natural language descriptions and fine\-grained behavioral attributes, enabling zero\-shot recognition of unseen classes through episodic meta\-training that explicitly aligns heterogeneous modalities\. Figure[2](https://arxiv.org/html/2607.09936#S3.F2)gives an overview of our proposed framework\.

![Refer to caption](https://arxiv.org/html/2607.09936v1/images/Architecture.png)Figure 2:Overview of our proposed SMETA\-ZSL framework that uses semantic prototype for GZSL, when semantic descriptions are overlapping and at a higher level of abstraction\.### 3\.1Preliminaries

In Zero\-shot learning there are two disjoint sets of classes: the seen classes𝒮\\mathcal\{S\}, for which labeled training instances are available, and the unseen classes𝒰\\mathcal\{U\}, for which no labeled instances exist at training time\. Specifically in GZSL, the classifierf​\(⋅\):𝒳→𝒮∪𝒰f\(\\cdot\):\\mathcal\{X\}\\rightarrow\\mathcal\{S\}\\cup\\mathcal\{U\}must operate over the union of both seen and unseen classes\. Each classc∈𝒮∪𝒰c\\in\\mathcal\{S\}\\cup\\mathcal\{U\}is represented by a prototype vectort∈𝒯⊆ℝMt\\in\\mathcal\{T\}\\subseteq\\mathbb\{R\}^\{M\}, encoded via a prototyping functionπ​\(⋅\):𝒮∪𝒰→𝒯\\pi\(\\cdot\):\\mathcal\{S\}\\cup\\mathcal\{U\}\\rightarrow\\mathcal\{T\}\. This yields prototype sets𝒯s=\{tis\}i=1Ns\\mathcal\{T\}\_\{s\}=\\\{t^\{s\}\_\{i\}\\\}\_\{i=1\}^\{N\_\{s\}\}and𝒯u=\{tiu\}i=1Nu\\mathcal\{T\}\_\{u\}=\\\{t^\{u\}\_\{i\}\\\}\_\{i=1\}^\{N\_\{u\}\}for seen and unseen classes respectively, serving as the semantic bridge through which knowledge is transferred from𝒮\\mathcal\{S\}to𝒰\\mathcal\{U\}\. Given a test instancexix\_\{i\}, a projection networkfθ:𝒳→𝒯f\_\{\\theta\}:\\mathcal\{X\}\\rightarrow\\mathcal\{T\}maps it into the shared semantic space, and the predicted class is determined by nearest\-prototype matching:

y^i=arg⁡maxc∈𝒮∪𝒰⁡fθ​\(xi\)⋅tc‖fθ​\(xi\)‖​‖tc‖\\hat\{y\}\_\{i\}=\\arg\\max\_\{c\\in\\mathcal\{S\}\\cup\\mathcal\{U\}\}\\frac\{f\_\{\\theta\}\(x\_\{i\}\)\\cdot t\_\{c\}\}\{\\\|f\_\{\\theta\}\(x\_\{i\}\)\\\|\\\|t\_\{c\}\\\|\}\(1\)
The cybersecurity setting introduces two additional structural constraints that go beyond standard GZSL\. First, we operate under the open\-set assumption: unlike closed\-set GZSL where𝒮∪𝒰\\mathcal\{S\}\\cup\\mathcal\{U\}is fully predefined, only𝒮\\mathcal\{S\}is known at training time\. The unseen classes𝒰\\mathcal\{U\}, including their cardinality\|𝒰\|=Nu\|\\mathcal\{U\}\|=N\_\{u\}and identities\{ciu\}i=1Nu\\\{c^\{u\}\_\{i\}\\\}\_\{i=1\}^\{N\_\{u\}\}, are revealed only at inference, reflecting the real\-world scenario where novel malware families cannot be anticipated in advance\. Second, we adopt the Class\-Inductive, Instance\-Inductive \(CIII\) setting\(Pourpanahet al\.,[2022](https://arxiv.org/html/2607.09936#bib.bib35)\), under which the model is trained using only𝒟t​r\\mathcal\{D\}\_\{tr\}and𝒯s\\mathcal\{T\}\_\{s\}, without access to𝒯u\\mathcal\{T\}\_\{u\}during training\. The unseen prototypes are made available only at inference, serving as the semantic bridge through which the model generalizes to novel unseen classes\. In the cybersecurity domain, this bridge is constructed from cyber threat intelligence \(CTI\) reports, unstructured expert\-authored documents describing behavioral signatures, tactics, and techniques of each threat class\. Our goal is to ensure that knowledge transfers reliably from𝒮\\mathcal\{S\}to𝒰\\mathcal\{U\}despite the semantic overlap and cross\-modal heterogeneity these reports introduce, a challenge addressed directly by SMETA\-ZSL\.

### 3\.2Discriminative Semantic Prototype Learning with LLM

LLM for Semantic Prototyping:LLMs are natural candidates for semantic prototype construction: given a natural language description of a class, a pretrained encoder can map the text into a dense vector that captures its semantic content\. These vectors serve as class prototypes in𝒯\\mathcal\{T\}, providing a representation of each class However, naively encoding CTI reports with a pretrained language model yields weakly separable prototypes, as threat descriptions across different classes frequently share structural vocabulary and domain\-specific terminology, causing their embeddings to cluster around a shared centroid rather than reflect class\-discriminative structure\.

Supervised Contrastive Objective:Letzi∈ℝMz\_\{i\}\\in\\mathbb\{R\}^\{M\}denote the L2\-normalized embedding of description sampleiiproduced by the language model\. To enforce intra\-class compactness and inter\-class separation in the language model’s representation space, we optimize it with a Supervised Contrastive loss\(Khoslaet al\.,[2020](https://arxiv.org/html/2607.09936#bib.bib66)\), which pulls descriptions of the same class together while pushing descriptions of different classes apart:

ℒSupCon=∑i∈I−1\|P​\(i\)\|​∑p∈P​\(i\)log⁡exp⁡\(zi⋅zp/τ\)∑a∈A​\(i\)exp⁡\(zi⋅za/τ\)\\mathcal\{L\}\_\{\\text\{SupCon\}\}=\\sum\_\{i\\in I\}\\frac\{\-1\}\{\|P\(i\)\|\}\\sum\_\{p\\in P\(i\)\}\\log\\frac\{\\exp\(z\_\{i\}\\cdot z\_\{p\}/\\tau\)\}\{\\sum\_\{a\\in A\(i\)\}\\exp\(z\_\{i\}\\cdot z\_\{a\}/\\tau\)\}\(2\)whereP​\(i\)P\(i\)is the set of positive samples whose descriptions share the same class label asii,A​\(i\)A\(i\)is the set of all other description samples in the batch, andτ\\tauis a temperature hyperparameter\. Figure[3](https://arxiv.org/html/2607.09936#S3.F3)illustrates the effect of contrastive finetuning on the geometry of the learned semantic space\.

Isotropy Regularization:Optimizing solely onℒSupCon\\mathcal\{L\}\_\{\\text\{SupCon\}\}is insufficient when class descriptions share substantial structural overlap\. The encoder tends to learn the general structure of descriptions rather than class\-discriminative signatures, causing embeddings to collapse toward a shared mean\. To explicitly counteract this, we introduce an isotropy regularization term that penalizes the mean squared cosine similarity of each embeddingziz\_\{i\}to the L2\-normalized batch meanz¯\\bar\{z\}, discouraging the semantic space from collapsing toward a centroid driven by shared boilerplate vocabulary:

ℒIso=1N​∑i=1N\(zi⋅z¯\)2\\mathcal\{L\}\_\{\\text\{Iso\}\}=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\(z\_\{i\}\\cdot\\bar\{z\}\)^\{2\}\(3\)The combined training objective for the semantic encoder isℒsem=ℒSupCon\+γ​ℒIso\\mathcal\{L\}\_\{\\text\{sem\}\}=\\mathcal\{L\}\_\{\\text\{SupCon\}\}\+\\gamma\\mathcal\{L\}\_\{\\text\{Iso\}\}, whereγ≥0\\gamma\\geq 0controls the strength of the isotropy regularization relative to the contrastive objective\.

Prototype Construction:Once the encoder is trained, a class prototypetc∈𝒯t\_\{c\}\\in\\mathcal\{T\}is computed for each classc∈𝒮∪𝒰c\\in\\mathcal\{S\}\\cup\\mathcal\{U\}as the L2\-normalized mean of its constituent embeddings, where𝒮c\\mathcal\{S\}\_\{c\}denotes the set of description samples belonging to classcc\. This yields the prototype sets𝒯s\\mathcal\{T\}\_\{s\}and𝒯u\\mathcal\{T\}\_\{u\}, which serve as fixed semantic anchors for all subsequent alignment and inference\.

![Refer to caption](https://arxiv.org/html/2607.09936v1/images/ANDMAL_PRE.png)

\(a\)Semantic embeddings with Pretrained LLM
![Refer to caption](https://arxiv.org/html/2607.09936v1/images/ANDMAL_FT.png)

\(b\)Semantic embeddings with Contrastively Finetuned LLM

Figure 3:Comparison of semantic embedding quality with and without contrastive finetuning for datapoints in CIC\-AndMal\(Canadian Institute for Cybersecurity \(CIC\) and Canadian Centre for Cyber Security \(CCCS\),[2020](https://arxiv.org/html/2607.09936#bib.bib42)\)dataset\.
### 3\.3Cross\-Modal Alignment via Meta Knowledge Distillation

Even with discriminative semantic prototypes, aligning𝒳\\mathcal\{X\}with𝒯\\mathcal\{T\}remains non\-trivial due to the granularity mismatch between precise instance\-level behavioral observations and coarse, abstract semantic descriptions\. We address this through a novel framework that combines meta\-knowledge distillation\(Panet al\.,[2021](https://arxiv.org/html/2607.09936#bib.bib67)\)with episodic meta\-learning, where the zero\-shot condition is explicitly simulated at every training step\.

Two\-Tower Architecture:The framework operates across two representation spaces\. The Semantic Tower encodes class descriptions into𝒯\\mathcal\{T\}, producing the fixed class prototypes\{tc\}\\\{t\_\{c\}\\\}derived in Section[3\.2](https://arxiv.org/html/2607.09936#S3.SS2)\. The Behavioral Tower consists of a projection networkfθ:𝒳→𝒯f\_\{\\theta\}:\\mathcal\{X\}\\rightarrow\\mathcal\{T\}that learns to map behavioral feature vectors into the shared semantic space, producingz^i=fθ​\(xi\)∈ℝM\\hat\{z\}\_\{i\}=f\_\{\\theta\}\(x\_\{i\}\)\\in\\mathbb\{R\}^\{M\}for each instancexi∈𝒳x\_\{i\}\\in\\mathcal\{X\}\.

Episodic Meta\-Training:To preventfθf\_\{\\theta\}from overfitting to seen\-class alignment and to explicitly enforce generalization to unseen classes, training is structured as a series of meta\-learning episodes that simulate the zero\-shot condition at every step\. At each episode, the set of available training classes𝒞t​r​a​i​n\\mathcal\{C\}\_\{train\}is randomly partitioned into a support set𝒞s​u​p\\mathcal\{C\}\_\{sup\}and a query set𝒞q​r​y\\mathcal\{C\}\_\{qry\}, where𝒞t​r​a​i​n=𝒞s​u​p∪𝒞q​r​y\\mathcal\{C\}\_\{train\}=\\mathcal\{C\}\_\{sup\}\\cup\\mathcal\{C\}\_\{qry\}and𝒞s​u​p∩𝒞q​r​y=∅\\mathcal\{C\}\_\{sup\}\\cap\\mathcal\{C\}\_\{qry\}=\\emptyset\. The query set classes are treated as proxy\-unseen classes, known training classes deliberately withheld at each episode to simulate novel conditions, forcingfθf\_\{\\theta\}to generalize its cross\-modal alignment beyond the classes it is currently supervised on\.

Dual\-Objective Distillation Loss:The loss function balances exact knowledge transfer on support classes with generalization on withheld query classes\. Letsi,c=z^i⋅tc/‖z^i‖​‖tc‖s\_\{i,c\}=\\hat\{z\}\_\{i\}\\cdot t\_\{c\}/\\\|\\hat\{z\}\_\{i\}\\\|\\\|t\_\{c\}\\\|denote the cosine similarity between the projected instance and prototypetct\_\{c\}\. For the support set, the student is supervised via a distillation objective that combines soft knowledge transfer through KL divergence against the teacher’s similarity distribution with a hard cross\-entropy target:

ℒsup=ℒKL​\(σ​\(si,cT\)∥σ​\(s^i,cT\)\)\+ℒCE​\(z^i,yi\)\\mathcal\{L\}\_\{\\text\{sup\}\}=\\mathcal\{L\}\_\{\\text\{KL\}\}\\left\(\\sigma\\\!\\left\(\\frac\{s\_\{i,c\}\}\{T\}\\right\)\\,\\Big\\\|\\,\\sigma\\\!\\left\(\\frac\{\\hat\{s\}\_\{i,c\}\}\{T\}\\right\)\\right\)\+\\mathcal\{L\}\_\{\\text\{CE\}\}\(\\hat\{z\}\_\{i\},y\_\{i\}\)\(4\)whereTTis the distillation temperature,s^i,c\\hat\{s\}\_\{i,c\}are the teacher’s similarity logits, andσ​\(⋅\)\\sigma\(\\cdot\)denotes the softmax function\. The KL divergence transfers the teacher’s soft relational structure across classes, while the cross\-entropy term anchors the student to the correct hard label\. For the query set, no distillation supervision is provided and the student is evaluated purely on prototype matching, acting as a generalization regularizer:ℒqry=ℒCE​\(z^i,yi\),i∈𝒞q​r​y\\mathcal\{L\}\_\{\\text\{qry\}\}=\\mathcal\{L\}\_\{\\text\{CE\}\}\(\\hat\{z\}\_\{i\},y\_\{i\}\),\\ i\\in\\mathcal\{C\}\_\{qry\}\. The combined training objective is:

ℒalign=ℒsup\+λ​ℒqry\\mathcal\{L\}\_\{\\text\{align\}\}=\\mathcal\{L\}\_\{\\text\{sup\}\}\+\\lambda\\mathcal\{L\}\_\{\\text\{qry\}\}\(5\)whereλ≥0\\lambda\\geq 0scales the generalization penalty relative to the distillation objective\.

### 3\.4Generalized Inference via Adaptive Confidence Gating

Z\-Score Confidence Estimation:The central observation motivating the gating mechanism is that a seen\-class instance produces a similarity distribution over seen prototypes with one sharply dominant score, while an unseen\-class instance produces a flatter, less discriminative distribution, as empirically confirmed in Figure[4](https://arxiv.org/html/2607.09936#S3.F4)\. Rather than comparing the top seen\-class score against a fixed threshold, we evaluate how statistically dominant it is relative to the per\-sample distribution of all seen\-class similarities\. Given a test instancexix\_\{i\}, we computez^i=fθ​\(xi\)\\hat\{z\}\_\{i\}=f\_\{\\theta\}\(x\_\{i\}\)and the cosine similaritysi,c=z^i⋅tc/‖z^i‖​‖tc‖s\_\{i,c\}=\\hat\{z\}\_\{i\}\\cdot t\_\{c\}/\\\|\\hat\{z\}\_\{i\}\\\|\\\|t\_\{c\}\\\|against every seen prototypetc∈𝒯st\_\{c\}\\in\\mathcal\{T\}\_\{s\}\. The per\-sample meanμi\\mu\_\{i\}and standard deviationσi\\sigma\_\{i\}of this seen\-class similarity distribution are then computed, and the Z\-score of the maximum seen\-class similaritysimax=maxc∈𝒮⁡si,cs^\{\\max\}\_\{i\}=\\max\_\{c\\in\\mathcal\{S\}\}s\_\{i,c\}measures how many standard deviations it lies above the mean:

Zi=simax−μimax⁡\(σi,ϵ\)Z\_\{i\}=\\frac\{s^\{\\max\}\_\{i\}\-\\mu\_\{i\}\}\{\\max\(\\sigma\_\{i\},\\epsilon\)\}\(6\)whereϵ\\epsilonensures numerical stability when all seen\-class similarities are nearly identical\.

Routing Decision:ZiZ\_\{i\}quantifies how statistically dominant the best seen\-class match is for a given sample\. A highZiZ\_\{i\}indicates that one seen prototype produces a sharply dominant response, suggesting the instance belongs to a seen class\. A lowZiZ\_\{i\}indicates a flat similarity distribution, suggesting the instance is out\-of\-distribution with respect to𝒮\\mathcal\{S\}and likely belongs to an unseen class\. The routing decision is formalized as:

y^i=\{arg⁡maxc∈𝒮⁡si,cif​Zi≥τarg⁡maxc∈𝒰⁡si,cif​Zi<τ\\hat\{y\}\_\{i\}=\\begin\{cases\}\\arg\\max\_\{c\\in\\mathcal\{S\}\}\\ s\_\{i,c\}&\\text\{if \}Z\_\{i\}\\geq\\tau\\\\ \\arg\\max\_\{c\\in\\mathcal\{U\}\}\\ s\_\{i,c\}&\\text\{if \}Z\_\{i\}<\\tau\\end\{cases\}\(7\)whereτ\\tauis a confidence threshold optimized on the validation set to maximize the harmonic mean between seen and unseen class accuracy\. This mechanism requires no additional learned parameters and operates entirely on the cosine similarity scores already computed during inference\.

![Refer to caption](https://arxiv.org/html/2607.09936v1/images/sigma_distribution.png)Figure 4:Distribution of per\-sampleσi\\sigma\_\{i\}\(standard deviation of seen\-class cosine similarities\) stratified by ground truth label\.

## 4Experiments

Baselines:We evaluate nine methods capable of zero\-shot tabular data classification — a critical requirement in cybersecurity — spanning three paradigms: generative\(Mishraet al\.,[2018](https://arxiv.org/html/2607.09936#bib.bib37); Vermaet al\.,[2020](https://arxiv.org/html/2607.09936#bib.bib21)\), cybersecurity\-specific\(Wanget al\.,[2025b](https://arxiv.org/html/2607.09936#bib.bib29); Aurnaet al\.,[2025](https://arxiv.org/html/2607.09936#bib.bib31); Barroset al\.,[2022](https://arxiv.org/html/2607.09936#bib.bib15)\), and LLM\-based\(Shiet al\.,[2024](https://arxiv.org/html/2607.09936#bib.bib22); Wanget al\.,[2025a](https://arxiv.org/html/2607.09936#bib.bib19); Ali and Khan,[2023](https://arxiv.org/html/2607.09936#bib.bib32); Yunet al\.,[2024](https://arxiv.org/html/2607.09936#bib.bib41)\)\. We additionally evaluate TabPFN\(Hollmannet al\.,[2023](https://arxiv.org/html/2607.09936#bib.bib12)\), APT\(Wu and Bergman,[2025a](https://arxiv.org/html/2607.09936#bib.bib38)\), and ZEUS\([Marszałeket al\.,](https://arxiv.org/html/2607.09936#bib.bib18)\), which generalise to novel datasets with minimal oversight but still require at least one sample from each unseen class at inference time\. As such, these models do not strictly satisfy our GZSL formulation and are evaluated in the one\-shot setting\. Finally, HistGradBoost\(Pedregosaet al\.,[2011](https://arxiv.org/html/2607.09936#bib.bib14)\)and XGBoost\(Chen and Guestrin,[2016](https://arxiv.org/html/2607.09936#bib.bib13)\)serve as standard tabular classification baselines\. Table[1](https://arxiv.org/html/2607.09936#S4.T1)highlights four axes along which methods differ from SMETA\-ZSL\. ZET\-LLM\(Shiet al\.,[2024](https://arxiv.org/html/2607.09936#bib.bib22)\), ProtoLLM\(Wanget al\.,[2025a](https://arxiv.org/html/2607.09936#bib.bib19)\), and SMELL\(Barroset al\.,[2022](https://arxiv.org/html/2607.09936#bib.bib15)\)require architectural adaptation for zero\-shot inference, while ZEUS, TabPFN, and APT do not support it at all and are therefore included only in the one\-shot comparison\. Only TabPFN and APT require unseen class prototypes at training time\. CLIP\-decoder\(Ali and Khan,[2023](https://arxiv.org/html/2607.09936#bib.bib32)\), P2T\(Yunet al\.,[2024](https://arxiv.org/html/2607.09936#bib.bib41)\), ZEUS, and TZSL\(Wanget al\.,[2025b](https://arxiv.org/html/2607.09936#bib.bib29)\)require unlabelled unseen instances during training\. Only CLIP\-decoder and P2T support open\-set recognition among the baselines\. SMETA\-ZSL is the only method satisfying all four criteria simultaneously\. As baselines differ in which assumptions they relax, we evaluate each under its native setting while holding SMETA\-ZSL to the strictest assumption throughout\.

Table 1:Requirements and capabilities of baseline methods\. Checkmarks indicate whether each method supports zero\-shot classification natively, trains without unseen prototypes or unlabelled instances, and handles open\-set recognition\.MethodArchitectureLearning PrincipleZero\-ShotClassificationTrains w/oUnseenPrototypesTrains w/oUnlabelled UnseenInstancesOpen\-SetCVAE\-ZSL \(Mishraet al\.\([2018](https://arxiv.org/html/2607.09936#bib.bib37)\)\)VAEGenerative, prototype✓✓✓✗MZSL \(Vermaet al\.\([2020](https://arxiv.org/html/2607.09936#bib.bib21)\)\)GAN \+ MLPGenerative, meta\-learning✓✓✓✗CLIP\-decoder \(Ali and Khan \([2023](https://arxiv.org/html/2607.09936#bib.bib32)\)\)ViTTransfer learning✓✓✗✓P2T \(Yunet al\.\([2024](https://arxiv.org/html/2607.09936#bib.bib41)\)\)LLMTransfer learning✓✓✗✓ZET\-LLM \(Shiet al\.\([2024](https://arxiv.org/html/2607.09936#bib.bib22)\)\)LLM \+ MLPFeature extraction✓\(Modified\)✓✓✗ProtoLLM \(Wanget al\.\([2025a](https://arxiv.org/html/2607.09936#bib.bib19)\)\)LLMPrototype, transfer learning✓\(Modified\)✓✓✗ZEUS \([Marszałeket al\.](https://arxiv.org/html/2607.09936#bib.bib18)\)LLMFederated learning✗✓✗✗TabPFN \(Hollmannet al\.\([2023](https://arxiv.org/html/2607.09936#bib.bib12)\)\)LLMTransductive✗✗✓✗APT \(Wu and Bergman \([2025a](https://arxiv.org/html/2607.09936#bib.bib38)\)\)LLMMetric learning✗✗✓✗ZSL for CybersecuritySMELL \(Barroset al\.\([2022](https://arxiv.org/html/2607.09936#bib.bib15)\)\)MLPMetric learning✓\(Modified\)✓✓✗FL\-ZSL \(Aurnaet al\.\([2025](https://arxiv.org/html/2607.09936#bib.bib31)\)\)MLPContinual learning✓✓✓✗TZSL \(Wanget al\.\([2025b](https://arxiv.org/html/2607.09936#bib.bib29)\)\)VQ\-VAETransfer learning✓✓✗✗SMETA\-ZSLLLM \+ MLPPrototype, meta\-learning✓✓✓✓

Datasets:We evaluate SMETA\-ZSL on seven benchmark datasets spanning four cybersecurity domains CIC\-AndMal\-2020 \(Canadian Institute for Cybersecurity \(CIC\) and Canadian Centre for Cyber Security \(CCCS\) \([2020](https://arxiv.org/html/2607.09936#bib.bib42)\)\), BODMAS \(Yanget al\.\([2021](https://arxiv.org/html/2607.09936#bib.bib43)\)\), APIGRAPH \(Zhanget al\.\([2020](https://arxiv.org/html/2607.09936#bib.bib44)\)\), AVASTCTU \(Bošanskỳet al\.\([2022](https://arxiv.org/html/2607.09936#bib.bib45)\)\) and three general\-domain tabular datasets GOODREADS \(Wan and McAuley \([2018](https://arxiv.org/html/2607.09936#bib.bib46)\); Wanet al\.\([2019](https://arxiv.org/html/2607.09936#bib.bib47)\)\), PETFINDER \(PetFinder\.my \([2018](https://arxiv.org/html/2607.09936#bib.bib48)\)\), FAKEDDIT \(Nakamuraet al\.\([2020](https://arxiv.org/html/2607.09936#bib.bib49)\)\)\. Dataset details including the class distributions are provided in Table[2](https://arxiv.org/html/2607.09936#S4.T2)\.

Table 2:Overview of evaluation datasets spanning cybersecurity and general\-domain benchmarksImplementation Details:Semantic prototypes are encoded using LLaMA\-3\.1\-8B, loaded in 4\-bit precision viabitsandbytesand fine\-tuned with LoRA to embed per\-class behavioral descriptions into 4,096\-dimensional prototype vectors\. The projection networkfθf\_\{\\theta\}is a two\-block residual MLP with hidden size 1,024, GELU activations, BatchNorm, and dropout \(p=0\.1p\{=\}0\.1\), mapping tabular features into𝒯\\mathcal\{T\}with L2\-normalized outputs\. All hyperparameters are tuned on the validation set; sensitivity analysis is provided in Appendix[9](https://arxiv.org/html/2607.09936#A1.T9)\.

CTI Report Collection:CTI reports were collected from two open\-source repositories: the ORKL Community CTI Library \(ORKL \([2024](https://arxiv.org/html/2607.09936#bib.bib53)\)\), a searchable corpus of public threat intelligence reports, and the APT\_REPORT archive \(CyberMonitor \([2024](https://arxiv.org/html/2607.09936#bib.bib52)\)\), a community\-maintained collection of vendor and government CTI documents\. To ensure semantic coverage across all malware families, particularly for unseen classes with limited report availability, we employed a structured augmentation pipeline: a LLM was prompted to generate synthetic CTI variants conditioned on relevant MITRE ATT&CK technique descriptors \(TTPs\) corresponding to each malware family \(The MITRE Corporation \([2024](https://arxiv.org/html/2607.09936#bib.bib54)\)\)\. LLM\-based generation of CTI has been explored as a viable approach to address report scarcity in threat intelligence workflows \(Ranadeet al\.\([2021](https://arxiv.org/html/2607.09936#bib.bib51)\)\)\.

Evaluation Protocol:For finetuning of the LLM we use a 90/10 split for training and validation\. Unseen classes are selected previously and held out during the whole fine\-tuning process\. During the meta\-learning stage, we hold out 15% of the seen samples as validation and 15% for test\.The number of unseen families varies between 3 and 2 depending on the dataset label size\. We follow the standard GZSL evaluation protocol, reporting accuracy on seen classes \(S\), accuracy on unseen classes \(U\), and their harmonic mean \(H\) as the primary metric\. The harmonic mean is used as the primary ranking criterion as it penalizes methods that trivially favour either seen or unseen classes\. Results are averaged over five random splits and reported with standard deviation\.

## 5Results

GZSL Baseline Comparison:Table[3](https://arxiv.org/html/2607.09936#S5.T3)reports GZSL results across 5 runs for seven tabular benchmarks spanning both cybersecurity and general\-domain datasets\. On average, SMETA\-ZSL improves the harmonic mean by approximately 10\.8 points over the strongest baseline on the datasets where it leads, with the largest gains observed on CIC\-AndMal \(\+18\.1 over MZSL\), GOODREADS \(\+11\.6 over ProtoLLM\), AVASTCTU \(\+12\.5 over FL\-ZSL\) and APIGRAPH \(\+19\.4 over TZSL\)\. On FAKEDDIT, ProtoLLM leads \(47\.80 vs\. 44\.45\), where prototype\-based alignment appears particularly well\-suited to the dataset’s multimodal label structure\. SMETA\-ZSL is the only method that performs consistently well across all seven datasets under strict inductive assumptions\. Figure[5](https://arxiv.org/html/2607.09936#S5.F5)further illustrates this trend: SMETA\-ZSL attains the highest average unseen accuracy across all seven benchmarks while maintaining competitive seen accuracy\. The full results for seen, unseen and mean accuracy across all 5 runs are given in Appendix\.

Table 3:GZSL results across seven tabular datasets\. SMETA\-ZSL is evaluated under the strictest inductive assumptions; baselines under their native settings\. Best results \(inblue\) indicate the highest harmonic mean between seen and unseen class accuracy\.![Refer to caption](https://arxiv.org/html/2607.09936v1/images/seen-vs-unseen.png)Figure 5:Average seen and unseen class accuracy across all benchmark datasets\. Our proposed SMETA\-ZSL achieves the highest unseen accuracy among all compared methods while maintaining competitive seen accuracy\.One\-Shot Baseline Comparison:Table[4](https://arxiv.org/html/2607.09936#S5.T4)compares SMETA\-ZSL \(zero\-shot\) against few\-shot and standard tabular baselines\. SMETA\-ZSL achieves the best harmonic mean on five of seven benchmarks, with margins of \+15\.0 on GOODREADS, \+10\.4 on PETFINDER, and \+7\.1 on APIGRAPH\. On BODMAS and AVASTCTU, HistGradBoost and ZEUS respectively benefit from labelled support examples unavailable to SMETA\-ZSL\. Despite strictly zero\-shot assumptions, SMETA\-ZSL remains the most consistently strong method across the suite\. Fully supervised upper\-bound results are in Appendix[8](https://arxiv.org/html/2607.09936#A1.T8)\.

Table 4:One\-shot classification results across seven tabular benchmarks\. SMETA\-ZSL is compared against methods designed for few\-shot tabular generalisation and standard tabular classifiers\. Best results inblue\.Effect of Embedding Model:Table[5](https://arxiv.org/html/2607.09936#S5.T5)reports the effect of substituting the semantic encoder on GZSL performance, holding the remainder of SMETA\-ZSL fixed\. LLaMA3\.1\-8B is the best\-performing encoder overall, achieving the highest scores on both CIC\-AndMAL \(56\.70 ± 1\.6\) and BODMAS \(50\.19 ± 3\.61\)\. It also exhibits relatively low variance, suggesting stable semantic prototypes across splits\.

Table 5:Effect of language model on SMETA\-ZSLAblation Studies:Table[6](https://arxiv.org/html/2607.09936#S5.T6)reports each component’s contribution via systematic ablation\. Removing LLM semantic embeddings drops the harmonic mean by 9\.3 points on average, confirming prototype quality as the primary performance driver\. Replacing episodic meta\-learning with standard training degrades unseen\-class accuracy substantially \(−5\.11\-5\.11on APIGRAPH,−4\.88\-4\.88on AVASTCTU\), validating that simulating the zero\-shot condition during training is critical\. Removing knowledge distillation yields a more moderate but consistent drop, indicating soft relational transfer provides complementary signal beyond hard label supervision\.

Few\-Shot Setting:Appendix[16](https://arxiv.org/html/2607.09936#A1.T16)examines how SMETA\-ZSL performs as labeled samples per unseen class increase from zero to five\. Performance generally continues to improve with more shots, with gains of up to 18\.8 points on AVASTCTU atK=5K=5, though with diminishing returns beyondK=2K=2\.

Table 6:Ablation study across cybersecurity datasets\. Each row removes or replaces one component of SMETA\-ZSL\.Effect of Synthetic CTI:Our problem space has a core data scarcity issue: the number of real CTI reports per malware family is too small to provide sufficient within\-class diversity for optimizing the supervised contrastive objective\. Large\-scale paired malware\-CTI data is difficult to obtain in practice, as organizations often release malware artifacts or CTI descriptions, but rarely bothJohnsonet al\.\([2016](https://arxiv.org/html/2607.09936#bib.bib9)\); MISP Project \([2024](https://arxiv.org/html/2607.09936#bib.bib10)\)\. This is precisely the premise of our problem setting: if the malware artifact is available, its corresponding attack description may not be, and conversely, if a CTI report describing an attack is released, the real malware sample may not be shared\.

To verify that training\-time synthetic CTI does not confer an unfair advantage at test time, we ablate synthetic CTI entirely for unseen classes \(i\.e\., classes present only at inference\), constructing unseen\-class prototypes from real CTI descriptions only, while keeping seen\-class training unchanged\. As shown in Table[7](https://arxiv.org/html/2607.09936#S5.T7), unseen accuracy \(UU\) and harmonic mean \(HH\) are statistically indistinguishable with and without synthetic CTI across both datasets, confirming that inference\-time performance is driven by learned cross\-modal alignment rather than synthetic CTI influencing prototype construction\.

Table 7:Ablation on synthetic CTI usage for unseen\-class prototype construction\.SS: seen accuracy,UU: unseen accuracy,HH: harmonic mean\.Reproducibility Statement:All experiments reporting mean ± std are repeated over 5 runs with different seeds\. Per seed result reported in Appendix\. Hyperparameters are listed in Appendix[9](https://arxiv.org/html/2607.09936#A1.T9)\. Semantic prototypes were generated with Llama\-3\.1\-8B and are released as fixed \.npy files to avoid non\-determinism\. Training was performed on 3× NVIDIA RTX ADA 48GB GPUs\. Code, checkpoints, and preprocessing scripts are available at[https://github\.com/Security\-And\-Intelligence\-Lab\-UTEP/SMETA\-ZSL/blob/main/README\.md](https://github.com/Security-And-Intelligence-Lab-UTEP/SMETA-ZSL/blob/main/README.md)

## 6Conclusion

We presented SMETA\-ZSL, a framework for a realistic but underexplored cyber\-defense setting in which new threat classes emerge without labeled behavioral examples, unlabeled unseen instances, or prior knowledge of unseen classes\. In practice, the only available supervision often comes from natural\-language CTI reports\. We show that language models can act as semantic adaptation interfaces for downstream cyber\-defense systems by converting CTI into discriminative semantic prototypes that transfer to structured behavioral data\. Across seven benchmarks spanning four cybersecurity and three general\-domain datasets, SMETA\-ZSL consistently outperforms prior methods under stricter open\-set assumptions, improving baseline by an average of 10\.8 points\.

## References

- Clip\-decoder: zeroshot multilabel classification using multimodal clip aligned representations\.InProceedings of the IEEE/CVF international conference on computer vision,pp\. 4675–4679\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1),[Table 1](https://arxiv.org/html/2607.09936#S4.T1.1.1.4.4.1),[§4](https://arxiv.org/html/2607.09936#S4.p1.1)\.
- N\. F\. Aurna, Y\. Taenaka, and Y\. Kadobayashi \(2025\)A feedback\-driven federated zero\-shot learning framework for adaptive detection of evolving banking malware\.IEEE Access\.Cited by:[§1](https://arxiv.org/html/2607.09936#S1.p1.1),[§2](https://arxiv.org/html/2607.09936#S2.p1.1),[Table 1](https://arxiv.org/html/2607.09936#S4.T1.1.1.13.13.1),[§4](https://arxiv.org/html/2607.09936#S4.p1.1)\.
- P\. H\. Barros, E\. T\. Chagas, L\. B\. Oliveira, F\. Queiroz, and H\. S\. Ramos \(2022\)Malware\-smell: a zero\-shot learning strategy for detecting zero\-day vulnerabilities\.Computers & Security120,pp\. 102785\.Cited by:[§1](https://arxiv.org/html/2607.09936#S1.p1.1),[§2](https://arxiv.org/html/2607.09936#S2.p1.1),[Table 1](https://arxiv.org/html/2607.09936#S4.T1.1.1.12.12.1),[§4](https://arxiv.org/html/2607.09936#S4.p1.1)\.
- A\. Bertiger, B\. Filar, A\. Luthra, S\. Meschiari, A\. Mitchell, S\. Scholten, and V\. Sharath \(2025\)Evaluating llm generated detection rules in cybersecurity\.arXiv preprint arXiv:2509\.16749\.Cited by:[§1](https://arxiv.org/html/2607.09936#S1.p1.1)\.
- S\. D\. Bhat, A\. More, M\. Soni, and B\. Aggarwal \(2025\)PC\-gzsl: prior correction for generalized zero shot learning\.In2025 IEEE/CVF Winter Conference on Applications of Computer Vision \(WACV\),pp\. 7173–7183\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- B\. Bošanskỳ, D\. Kouba, O\. Manhal, T\. Sick, V\. Lisy, J\. Kroustek, and P\. Somol \(2022\)Avast\-ctu public cape dataset\.arXiv preprint arXiv:2209\.03188\.Cited by:[§4](https://arxiv.org/html/2607.09936#S4.p2.1)\.
- Canadian Institute for Cybersecurity \(CIC\) and Canadian Centre for Cyber Security \(CCCS\) \(2020\)CCCS\-CIC\-AndMal\-2020 Dataset\.University of New Brunswick\.Note:[https://www\.unb\.ca/cic/datasets/andmal2020\.html](https://www.unb.ca/cic/datasets/andmal2020.html)Cited by:[Figure 3](https://arxiv.org/html/2607.09936#S3.F3),[§4](https://arxiv.org/html/2607.09936#S4.p2.1)\.
- A\. Chakraborty, S\. Ho, A\. Cook, and M\. Meléndez \(2026\)CTI\-realm: benchmark to evaluate agent performance on security detection rule generation capabilities\.arXiv preprint arXiv:2603\.13517\.Cited by:[§1](https://arxiv.org/html/2607.09936#S1.p1.1)\.
- T\. Chen and C\. Guestrin \(2016\)XGBoost: a scalable tree boosting system\.InProceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining,pp\. 785–794\.External Links:[Document](https://dx.doi.org/10.1145/2939672.2939785)Cited by:[§4](https://arxiv.org/html/2607.09936#S4.p1.1)\.
- Z\. Chen, Y\. Huang, J\. Chen, Y\. Geng, W\. Zhang, Y\. Fang, J\. Z\. Pan, and H\. Chen \(2023\)Duet: cross\-modal semantic grounding for contrastive zero\-shot learning\.InProceedings of the AAAI conference on artificial intelligence,Vol\.37,pp\. 405–413\.Cited by:[§1](https://arxiv.org/html/2607.09936#S1.p2.1),[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- CyberMonitor \(2024\)APT\_CyberCriminal\_Campagin\_Collections\.GitHub\.Note:[https://github\.com/CyberMonitor/APT\_CyberCriminal\_Campagin\_Collections](https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections)Cited by:[§4](https://arxiv.org/html/2607.09936#S4.p4.1)\.
- J\. Fan, J\. Li, X\. Yan, X\. Zhong, W\. Lu, and L\. Huang \(2026\)CLIP\-driven zero\-shot learning with ambiguous labels\.arXiv preprint arXiv:2603\.05053\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- Z\. Fu, T\. Xiang, E\. Kodirov, and S\. Gong \(2015\)Zero\-shot object recognition by semantic manifold distance\.InProceedings of the IEEE conference on computer vision and pattern recognition,pp\. 2635–2644\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- Z\. Fu, T\. Xiang, E\. Kodirov, and S\. Gong \(2017\)Zero\-shot learning on semantic class prototype graph\.IEEE transactions on pattern analysis and machine intelligence40\(8\),pp\. 2009–2022\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- N\. Gillet al\.\(2026\)LLM\-fs: zero\-shot feature selection for effective and interpretable malware detection\.arXiv preprint arXiv:2602\.09634\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- N\. Hollmann, S\. Müller, K\. Eggensperger, and F\. Hutter \(2023\)TabPFN: a transformer that solves small tabular classification problems in a second\.InProceedings of the 11th International Conference on Learning Representations \(ICLR\),External Links:[Link](https://arxiv.org/abs/2207.01848)Cited by:[Table 1](https://arxiv.org/html/2607.09936#S4.T1.1.1.9.9.1),[§4](https://arxiv.org/html/2607.09936#S4.p1.1)\.
- C\. Johnson, L\. Badger, D\. Waltermire, J\. Snyder, C\. Skorupka,et al\.\(2016\)Guide to cyber threat information sharing\.NIST special publication800\(150\),pp\. 35\.Cited by:[§5](https://arxiv.org/html/2607.09936#S5.p6.1)\.
- P\. Khosla, P\. Teterwak, C\. Wang, A\. Sarna, Y\. Tian, P\. Isola, A\. Maschinot, C\. Liu, and D\. Krishnan \(2020\)Supervised contrastive learning\.Advances in neural information processing systems33,pp\. 18661–18673\.Cited by:[§3\.2](https://arxiv.org/html/2607.09936#S3.SS2.p2.2)\.
- G\. Kwon and G\. Al Regib \(2022\)A gating model for bias calibration in generalized zero\-shot learning\.IEEE Transactions on Image Processing\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- J\. Lei, L\. Li, C\. Wang, J\. Xiao, and L\. Chen \(2024\)Seeing beyond classes: zero\-shot grounded situation recognition via language explainer\.InProceedings of the 32nd ACM International Conference on Multimedia,pp\. 1602–1611\.Cited by:[§1](https://arxiv.org/html/2607.09936#S1.p2.1),[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- A\. S\. Li, A\. Iyengar, A\. Kundu, and E\. Bertino \(2024a\)Revisiting concept drift in windows malware detection: adaptation to real drifted malware with minimal samples\.arXiv preprint arXiv:2407\.13918\.Cited by:[§1](https://arxiv.org/html/2607.09936#S1.p1.1)\.
- Y\. Li, Y\. Luo, Z\. Wang, and B\. Du \(2024b\)Improving generalized zero\-shot learning by exploring the diverse semantics from external class names\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 23344–23353\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- P\. Ma and X\. Hu \(2020\)A variational autoencoder with deep embedding model for generalized zero\-shot learning\.InProceedings of the AAAI conference on artificial intelligence,Vol\.34,pp\. 11733–11740\.Cited by:[§1](https://arxiv.org/html/2607.09936#S1.p2.1),[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- \[24\]P\. Marszałek, T\. Kuśmierczyk, W\. Wydmański, J\. Tabor, and M\. ŚmiejaZEUS: zero\-shot embeddings for unsupervised separation of tabular data\.InThe Thirty\-ninth Annual Conference on Neural Information Processing Systems,Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1),[Table 1](https://arxiv.org/html/2607.09936#S4.T1.1.1.8.8.1),[§4](https://arxiv.org/html/2607.09936#S4.p1.1)\.
- A\. Mishra, S\. Krishna Reddy, A\. Mittal, and H\. A\. Murthy \(2018\)A generative model for zero shot learning using conditional variational autoencoders\.InProceedings of the IEEE conference on computer vision and pattern recognition workshops,pp\. 2188–2196\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1),[Table 1](https://arxiv.org/html/2607.09936#S4.T1.1.1.2.2.1),[§4](https://arxiv.org/html/2607.09936#S4.p1.1)\.
- MISP Project \(2024\)MISP – open source threat intelligence platform & open standards for threat information sharing\.Note:[https://www\.misp\-project\.org/](https://www.misp-project.org/)Cited by:[§5](https://arxiv.org/html/2607.09936#S5.p6.1)\.
- S\. Mitra, A\. Bazarov, M\. Duclos, S\. Mittal, A\. Piplai, M\. R\. Rahman, E\. Zieglar, and S\. Rahimi \(2025\)FALCON: autonomous cyber threat intelligence mining with llms for ids rule generation\.arXiv preprint arXiv:2508\.18684\.Cited by:[§1](https://arxiv.org/html/2607.09936#S1.p1.1)\.
- K\. Nakamura, S\. Levy, and W\. Y\. Wang \(2020\)R/fakeddit: a new multimodal benchmark dataset for fine\-grained fake news detection\.InProceedings of the 12th Language Resources and Evaluation Conference,pp\. 6149–6158\.Cited by:[§4](https://arxiv.org/html/2607.09936#S4.p2.1)\.
- S\. Nawaz, J\. Cavazza, and A\. Del Bue \(2022\)Semantically grounded visual embeddings for zero\-shot learning\.InProceedings of the IEEE/CVF conference on computer vision and pattern recognition,pp\. 4589–4599\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- ORKL \(2024\)The ORKL Community CTI Library\.Note:[https://orkl\.eu/](https://orkl.eu/)Accessed: 2026\-03\-31Cited by:[§4](https://arxiv.org/html/2607.09936#S4.p4.1)\.
- H\. Pan, C\. Wang, M\. Qiu, Y\. Zhang, Y\. Li, and J\. Huang \(2021\)Meta\-kd: a meta knowledge distillation framework for language model compression across domains\.InProceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing \(Volume 1: Long Papers\),pp\. 3026–3036\.Cited by:[§3\.3](https://arxiv.org/html/2607.09936#S3.SS3.p1.2)\.
- F\. Pedregosa, G\. Varoquaux, A\. Gramfort, V\. Michel, B\. Thirion, O\. Grisel, M\. Blondel, P\. Prettenhofer, R\. Weiss, V\. Dubourg,et al\.\(2011\)Scikit\-learn: machine learning in Python\.Journal of Machine Learning Research12,pp\. 2825–2830\.Cited by:[§4](https://arxiv.org/html/2607.09936#S4.p1.1)\.
- PetFinder\.my \(2018\)PetFinder\.my adoption prediction\.Kaggle\.Note:[https://www\.kaggle\.com/c/petfinder\-adoption\-prediction](https://www.kaggle.com/c/petfinder-adoption-prediction)Cited by:[§4](https://arxiv.org/html/2607.09936#S4.p2.1)\.
- F\. Pourpanah, M\. Abdar, Y\. Luo, X\. Zhou, R\. Wang, C\. P\. Lim, X\. Wang, and Q\. J\. Wu \(2022\)A review of generalized zero\-shot learning methods\.IEEE transactions on pattern analysis and machine intelligence45\(4\),pp\. 4051–4070\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1),[§3\.1](https://arxiv.org/html/2607.09936#S3.SS1.p2.10)\.
- X\. Qian, X\. Zheng, Y\. He, S\. Yang, and L\. Cavallaro \(2025\)Lamd: context\-driven android malware detection and classification with llms\.In2025 IEEE Security and Privacy Workshops \(SPW\),pp\. 126–136\.Cited by:[§1](https://arxiv.org/html/2607.09936#S1.p1.1)\.
- P\. Ranade, A\. Piplai, S\. Mittal, A\. Joshi, and T\. Finin \(2021\)Generating fake cyber threat intelligence using transformer\-based models\.In2021 International Joint Conference on Neural Networks \(IJCNN\),pp\. 1–9\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.2102.04351)Cited by:[§4](https://arxiv.org/html/2607.09936#S4.p4.1)\.
- Z\. Rao, J\. Guo, X\. Lu, J\. Liang, J\. Zhang, H\. Wang, K\. Wei, and X\. Cao \(2024\)Dual expert distillation network for generalized zero\-shot learning\.arXiv preprint arXiv:2404\.16348\.Cited by:[§1](https://arxiv.org/html/2607.09936#S1.p2.1),[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- B\. Romera\-Paredes and P\. Torr \(2015\)An embarrassingly simple approach to zero\-shot learning\.InInternational conference on machine learning,pp\. 2152–2161\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- I\. M\. Sanchez, S\. Mitra, A\. Piplai, and S\. Mittal \(2025\)Semantic\-aware contrastive fine\-tuning: boosting multimodal malware classification with discriminative embeddings\.In2025 International Joint Conference on Neural Networks \(IJCNN\),pp\. 1–8\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- Y\. Schwartz, L\. Ben\-Shimol, D\. Mimran, Y\. Elovici, and A\. Shabtai \(2025\)Llmcloudhunter: harnessing llms for automated extraction of detection rules from cloud\-based cti\.InProceedings of the ACM on Web Conference 2025,pp\. 1922–1941\.Cited by:[§1](https://arxiv.org/html/2607.09936#S1.p1.1)\.
- Z\. Shi, J\. Kim, D\. Jeong, and H\. Pfister \(2024\)Surprisingly simple: large language models are zero\-shot feature extractors for tabular and text data\.Cited by:[Table 1](https://arxiv.org/html/2607.09936#S4.T1.1.1.6.6.1),[§4](https://arxiv.org/html/2607.09936#S4.p1.1)\.
- B\. Tang, J\. Zhang, L\. Yan, Q\. Yu, L\. Sheng, and D\. Xu \(2024\)Data\-free generalized zero\-shot learning\.InProceedings of the AAAI conference on artificial intelligence,Vol\.38,pp\. 5108–5117\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- L\. Tang, X\. Chen, S\. Wen, L\. Li, M\. Grobler, and Y\. Xiang \(2023\)Demystifying the evolution of android malware variants\.IEEE Transactions on Dependable and Secure Computing21\(4\),pp\. 3324–3341\.Cited by:[§1](https://arxiv.org/html/2607.09936#S1.p1.1)\.
- The MITRE Corporation \(2024\)MITRE ATT&CK\.Note:[https://attack\.mitre\.org/](https://attack.mitre.org/)Accessed: 2026\-03\-31Cited by:[§4](https://arxiv.org/html/2607.09936#S4.p4.1)\.
- V\. K\. Verma, D\. Brahma, and P\. Rai \(2020\)Meta\-learning for generalized zero\-shot learning\.InProceedings of the AAAI conference on artificial intelligence,Vol\.34,pp\. 6062–6069\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1),[Table 1](https://arxiv.org/html/2607.09936#S4.T1.1.1.3.3.1),[§4](https://arxiv.org/html/2607.09936#S4.p1.1)\.
- M\. Wan and J\. McAuley \(2018\)Item recommendation on monotonic behavior chains\.InProceedings of the 12th ACM Conference on Recommender Systems,pp\. 86–94\.Cited by:[§4](https://arxiv.org/html/2607.09936#S4.p2.1)\.
- M\. Wan, R\. Misra, N\. Nakashole, and J\. McAuley \(2019\)Fine\-grained spoiler detection from large\-scale review corpora\.arXiv preprint arXiv:1905\.13416\.Cited by:[§4](https://arxiv.org/html/2607.09936#S4.p2.1)\.
- C\. Wang, S\. Min, X\. Chen, X\. Sun, and H\. Li \(2021\)Dual progressive prototype network for generalized zero\-shot learning\.Advances in Neural Information Processing Systems34,pp\. 2936–2948\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- P\. Wang, D\. Wang, H\. Zhao, H\. Ye, D\. Guo, and Y\. Chang \(2025a\)LLM empowered prototype learning for zero and few\-shot tasks on tabular data\.arXiv preprint arXiv:2508\.09263\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1),[Table 1](https://arxiv.org/html/2607.09936#S4.T1.1.1.7.7.1),[§4](https://arxiv.org/html/2607.09936#S4.p1.1)\.
- P\. Wang, H\. Li, H\. Lin, W\. Lin, and N\. Xie \(2025b\)A transductive zero\-shot learning framework for ransomware detection using malware knowledge graphs\.Information16\(6\),pp\. 458\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1),[Table 1](https://arxiv.org/html/2607.09936#S4.T1.1.1.14.14.1),[§4](https://arxiv.org/html/2607.09936#S4.p1.1)\.
- W\. Wang, V\. W\. Zheng, H\. Yu, and C\. Miao \(2019\)A survey of zero\-shot learning: settings, methods, and applications\.ACM Transactions on Intelligent Systems and Technology \(TIST\)10\(2\),pp\. 1–37\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- Y\. Wu and D\. L\. Bergman \(2025a\)Zero\-shot meta\-learning for tabular prediction tasks with adversarially pre\-trained transformer\.InProceedings of the 42nd International Conference on Machine Learning,Note:ICMLExternal Links:[Link](https://arxiv.org/abs/2502.04573)Cited by:[Table 1](https://arxiv.org/html/2607.09936#S4.T1.1.1.10.10.1),[§4](https://arxiv.org/html/2607.09936#S4.p1.1)\.
- Y\. Wu and D\. L\. Bergman \(2025b\)Zero\-shot meta\-learning for tabular prediction tasks with adversarially pre\-trained transformer\.InInternational Conference on Machine Learning,pp\. 67111–67127\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- Y\. Xian, B\. Schiele, and Z\. Akata \(2017\)Zero\-shot learning\-the good, the bad and the ugly\.InProceedings of the IEEE conference on computer vision and pattern recognition,pp\. 4582–4591\.Cited by:[§2](https://arxiv.org/html/2607.09936#S2.p1.1)\.
- L\. Yang, A\. Ciptadi, I\. Laziuk, A\. Ahmadzadeh, and G\. Wang \(2021\)BODMAS: an open dataset for learning based temporal analysis of pe malware\.In4th Deep Learning and Security Workshop \(DLS\),Cited by:[§4](https://arxiv.org/html/2607.09936#S4.p2.1)\.
- S\. Yun, J\. Nam, W\. Song, S\. H\. Park, J\. Tack, J\. Kim, K\. H\. Oh, and J\. Shin \(2024\)Tabular transfer learning via prompting llms\.InConference on Language Modeling \(COLM\),pp\. 1–18\.Cited by:[Table 1](https://arxiv.org/html/2607.09936#S4.T1.1.1.5.5.1),[§4](https://arxiv.org/html/2607.09936#S4.p1.1)\.
- X\. Zhang, Y\. Zhang, M\. Zhong, D\. Ding, Y\. Cao, Y\. Zhang, M\. Zhang, and M\. Yang \(2020\)Enhancing state\-of\-the\-art classifiers with api semantics to detect evolved android malware\.InProceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security,pp\. 757–770\.Cited by:[§4](https://arxiv.org/html/2607.09936#S4.p2.1)\.
- X\. Zhou, K\. Kim, B\. Xu, D\. Han, and D\. Lo \(2024\)Out of sight, out of mind: better automatic vulnerability repair by broadening input ranges and sources\.InProceedings of the IEEE/ACM 46th international conference on software engineering,pp\. 1–13\.Cited by:[§1](https://arxiv.org/html/2607.09936#S1.p1.1)\.

## Appendix AAppendix

Table 8:Fully supervised ceiling performance across seven tabular benchmarks\. Each method is trained and evaluated on all classes with full label access, representing the upper bound that zero\-shot methods aspire to approach\. Results are mean±\\pmstandard deviation over five runs\.Table 9:Sensitivity of SMETA to key hyperparameters across cybersecurity datasets\.HH= Harmonic Mean \(%\)\. One parameter is varied at a time while others are fixed to their default values \(marked with⋆\\star\)\. StableHHacross values indicates low sensitivity to that parameter\.Table 10:GZSL results on CIC\-AndMal\-2020\. Seen = Seen Acc \(%\), Unseen = Unseen Acc \(%\), Mean = H\-Mean \(%\)\. Best Mean inbold\.Table 11:GZSL results on BODMAS\. Seen = Seen Acc \(%\), Unseen = Unseen Acc \(%\), Mean = H\-Mean \(%\)\. Best Mean inbold\.Table 12:GZSL results on APIGRAPH\. Seen = Seen Acc \(%\), Unseen = Unseen Acc \(%\), Mean = H\-Mean \(%\)\. Best Mean inbold\.Table 13:GZSL results on AVASTCTU\. Seen = Seen Acc \(%\), Unseen = Unseen Acc \(%\), Mean = H\-Mean \(%\)\. Best Mean inbold\.Table 14:GZSL results on GOODREADS\. Seen = Seen Acc \(%\), Unseen = Unseen Acc \(%\), Mean = H\-Mean \(%\)\. Best Mean inbold\.Table 15:GZSL results on PETFINDER\. Seen = Seen Acc \(%\), Unseen = Unseen Acc \(%\), Mean = H\-Mean \(%\)\. Best Mean inbold\.Table 16:SMETA\-ZSL performance under varying numbers of labeled samples per unseen family \(KK\-shot\) across cybersecurity datasets\.K=0K=0is the zero\-shot setting;SS= Seen Acc \(%\),UU= Unseen Acc \(%\),HH= Harmonic Mean \(%\)\.