Design of an integrated evidence-driven few-shot meta-learning for zero-day malware detection and forensic attributions

Abstract

Zero-day malware still slips past the best detection systems because most models need thousands of labeled examples before they learn anything useful. That dependency is exactly the weak point: by the time enough samples accumulate, the damage is already spreading. Traditional few-shot approaches promise quicker adaptation, yet they often reduce rich forensic evidence into flat feature vectors and end up overfitting to byte-level quirks rather than behavioral signals. This work takes a different path and develops a systematic pipeline that treats malware traces as structured evidence, feeding them through a sequence of five meta-learning extensions designed to survive the scarcity of zero-day samples. We begin with EpiForge, which fabricates realistic few-shot episodes from evidence-graphs and injects controlled novelties without breaking causal consistency, ensuring the training tasks resemble true zero-day strangeness. These episodes drive BayesMAML-E, a hierarchical Bayesian meta-learner that encodes evidence-type priors, producing task-conditioned initializations and calibrated uncertainty estimates. The output then flows into CoShaRE, which sparsifies decisions by learning counterfactual Shapley-regularized masks retaining only causally sufficient evidence and generating counter-examples that test decision stability. From there, OptiQuill decides how to spend scarce resources, balancing sandbox runs and labeling efforts using a budget-aware Lagrangian bandit that targets maximum downstream meta-learning gains. Finally, CausalFADE distills the learned behavior into compact automata and executable rules, turning black-box predictions into forensic signatures that analysts can trust and re-use for the process. Across all five stages, we see evidence of measurable impact: 5-shot accuracy improves by more than 10% points over standard MAML, calibration error falls to near 2%, and label and compute budgets are cut substantially. The result is not just faster adaptation but also auditable, causally grounded signatures that close the loop between evidence collection, learning, and deployment. This work appears to offer a path toward zero-day detection that is both technically feasible and operationally sustainable in process.