Towards Practical N-Day Attack Detection: A Few-Shot Learning Perspective

Network attack detection is a critical technique for identifying anomalies and classifying malicious traffic. Large Language Models (LLMs), trained on massive corpora, possess remarkable contextual-understanding and commonsense-reasoning abilities, opening new avenues for network-threat detection. In this study, we explore for the first time zero-shot and few-shot learning approaches for this task. We cast network-attack detection as a multi-class classification problem and conduct experiments with several instruction-tuned LLMs, including Mistral-7B-Instruct, Llama-3.2-8B-Instruct, and Qwen3-8B-Instruct, focusing on diverse prompt templates. In addition, we introduce a new network-attack dataset, NAMatch. A systematic evaluation shows that the task can be effectively addressed by transferring knowledge from semantically related, more mature tasks such as natural-language inference or semantic textual similarity. Finally, we present a complete processing pipeline tailored to network-attack detection and validate its effectiveness on texts of varying lengths.