Recent studies suggest that few-shot and zero-shot learning methods, drawing on meta-learning, self-supervised approaches and metric-learning ideas, can classify encrypted traffic (TLS 1.3 and QUIC) with competitive accuracy across different protocol conditions. This systematic literature review (SLR) investigates 22 studies selected from an initial pool of 500 papers using PRISMA 2020, focusing on current methodologies for non-stationary network traffic classification, with particular attention to few-shot, zero-shot, and meta-learning approaches. The research addresses four questions: (1) Which approaches have been employed for non-stationary network traffic classification and threat detection? (2) How do hybrid or cross-domain models improve adaptation, detection and overall efficiency? (3) What benchmarking standards exist for the datasets and evaluation metrics in use? (4) How do these methods address concept drift? This review identifies a range of approaches for capturing and analysing non-stationary network traffic but also reveals a significant gap in the empirical evidence addressing the last two questions. This points to a need for targeted experiments on continuously evolving network traffic and zero-day polymorphic attacks, both of which are central to the development of the next-generation adaptive intrusion-detection framework.
Rahaman et al. (Mon,) studied this question.