A unified drift-adaptive and robust residual autoencoder with attention and few-shot learning for zero-day intrusion detection

Autoencoder-based unsupervised intrusion detection systems (IDS) offer a promising approach for identifying zero-day attacks without requiring labeled malicious data. However, residual autoencoder (RAE) frameworks remain limited by static decision thresholds, susceptibility to concept drift (CD), limited adversarial robustness, and restricted adaptability to emerging attack patterns. To address these limitations, we propose the Attention-Boosted Streaming Residual Autoencoder (ASRAE), a unified framework that integrates attention-enhanced representation learning, online CD detection with adaptive thresholding, benign-only adversarial training, post-identification few-shot meta-learning, and explainability through integrated gradients (IG). Experiments on UNSW-NB15, CIC-IDS2017, and CSE-CIC-IDS2018 show that ASRAE outperforms the evaluated unsupervised baselines, achieving ROC-AUC values of 0.952, 0.940, and 0.931, respectively. Under the controlled simulated concept-drift setting, ASRAE maintains a ROC-AUC above 0.91, while adversarial evaluation using Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) demonstrates improved robustness to feature-space perturbations. The few-shot adaptation stage further enables adaptation to held-out attack families using only a small number of labeled samples while largely preserving benign reconstruction performance. ASRAE requires an average inference time of 9.2 ms per sample in the evaluated experimental environment. Overall, the results demonstrate the effectiveness of ASRAE across the benchmark, simulated-drift, adversarial, and few-shot adaptation settings.