Detecting Zero-Day Attacks via Reconstruction of Feature Influence and Model Uncertainty

September 7, 2026 (1mo ago)

PaperDOI

Hussein Fawaz, Jacopo Talpini, Marco Savi, Silvia Giordano, Omran Ayoub
SUPSI, Switzerland · University of Milano-Bicocca (UNIMIB), Italy

IEEE Transactions on Network and Service Management (TNSM), 2026

The problem

In practical Network Intrusion Detection System (NIDS) deployments, detecting an anomaly is only the first step — determining its exact nature is equally important. Anomalous traffic is commonly forwarded to a supervised multiclass classifier trained on known attack categories. This works well for known threats, but a zero-day attack is forced into one of the learned classes and ends up misclassified as a known attack. We need approaches that go beyond standard classification and can reliably recognize when an input does not conform to any learned attack pattern.

Where this work sits in the NIDS pipeline: after anomaly detection, attacks are classified, and a zero-day attack can be mislabeled as a known class.

What we propose

A detection strategy that jointly models two complementary signals: an explanation-driven reconstruction error, built from per-instance feature importance scores produced by an explainable AI (XAI) framework, and the predictive uncertainty of an ensemble classifier. The method is model-agnostic — we evaluate it with both XGBoost and Random Forest as the underlying classifier — using a leave-one-attack-out strategy that holds out each attack class in turn to simulate a zero-day, across three benchmark datasets: CICIoT2023, NF-ToN-IoT, and CIC-DDoS2019.

Uncertainty decomposition: the total predictive uncertainty of the ensemble splits into model (epistemic) uncertainty and aleatoric uncertainty.

The proposed pipeline: SHAP reconstruction error and epistemic uncertainty from the attack classifier are combined into a 2D representation and modeled with a Gaussian Mixture Model; instances above the threshold are labeled as zero-day attacks.

Results and takeaways

Our approach achieves best-case AUROC gains approaching 40% and F1-score improvements of up to 73%, while maintaining positive or near-neutral worst-case performance across datasets. Jointly modeling explanation-driven reconstruction error and predictive uncertainty is an effective and robust way to identify zero-day threats, making the classification stage of a NIDS more reliable in real deployments.

2D representations (SHAP reconstruction error vs. epistemic uncertainty) for Backdoor (NF-ToN-IoT), DoS (CICIoT2023) and TFTP (CIC-DDoS2019). Zero-day attacks are shown in red, known attacks in blue and green.

Relative improvement in F1-score and AUROC over the training baseline on NF-ToN-IoT, for XGBoost and Random Forest.