Traditional machine learning for network security requires labeled training data from your specific environment before detecting anything. Deploy a new intrusion detection system, wait weeks for baseline establishment, collect attack samples, label traffic, retrain models. Only then does detection begin. Meanwhile, attackers operate undetected during this training period.
Zero-shot learning enables models to detect attack patterns never seen during training. In network security, this means identifying reconnaissance, lateral movement, or exfiltration in completely new environments on day one, without prior exposure to that environment's traffic patterns or operational baselines.
The traditional machine learning problem
Supervised machine learning requires labeled training data from the target environment. Research shows that models achieving strong performance in one network domain often experience serious deterioration when transferred to another domain, due to environment-specific characteristics like service configurations, IP addressing schemes, and application behaviors.
Security teams cannot afford weeks of training time. Breakout times average 62 minutes, with the fastest lateral movement completing in 2 minutes 7 seconds. Detection systems requiring extended training periods miss these attacks entirely.
What zero-shot detection means technically
Zero-shot learning means detecting attack classes not present in training data by learning semantic relationships between known and unknown attacks. Rather than memorizing specific traffic patterns, models learn abstract representations of attack behaviors that generalize across environments.
Foundation models learn universal representations during pre-training on diverse network data, capturing fundamental patterns in how attacks operate. Network foundation models learn inherent relationships through self-supervised learning without requiring labeled examples from every environment.
Why zero-shot matters for AI-driven attacks
Zero-shot detection becomes critical as attackers deploy AI to automate and morph their operations. Research indicates that 80% of ransomware attacks now use artificial intelligence, while Gartner predicts that by 2027, AI will cut exploitation time in half.
AI enables polymorphic malware that constantly rewrites itself to evade signature-based detection. Hundreds of thousands of new malware variants are detected daily. Traditional detection systems trained on known samples fail against malware that has never existed in that specific form.
Agentic AI systems can now automate entire attack lifecycles, from reconnaissance through credential harvesting to extortion, making tactical and strategic decisions independently. Trend Micro predicts that by 2026, fully automated hacking will handle everything from scanning to exploit creation to ransom delivery.
Training-based detection fails because the training period creates a window where AI-driven attacks operate undetected, and AI attacks evolve faster than retraining cycles. Zero-shot detection based on structural patterns survives AI-driven evolution. While AI can modify malware code, change protocols, vary timing, and morph payloads, it cannot change fundamental attack structure without losing effectiveness. Reconnaissance requires systematic enumeration. Lateral movement requires privilege escalation through infrastructure tiers. Exfiltration requires collection followed by transfer. These structural requirements persist across all AI-generated variants.
Universal patterns vs environment-specific characteristics
Detection systems must distinguish between universal attack patterns and environment-specific characteristics. Universal patterns exist independent of network topology or service configuration. Environment-specific characteristics vary by organization and require local learning.
Universal attack patterns include behavioral structures that remain consistent across environments. Reconnaissance exhibits systematic enumeration: queries targeting multiple organizational units, progressive privilege identification, compressed timing. Lateral movement shows topological progression: authentication sequences moving from workstation to file server to application server to domain controller, revealing privilege escalation. Exfiltration exhibits collection-transfer timing correlation: file access preceding outbound data transfer, regardless of transfer protocol.
Environment-specific characteristics include baseline traffic volumes, approved service catalogs, authorized IP ranges, scheduled tasks, normal user behavior patterns.
How DeepTempo enables day-one detection
DeepTempo learns universal structural patterns from network flow sequences during pre-training. The model creates behavioral timeline embeddings that capture how reconnaissance, lateral movement, and exfiltration structure themselves. Classifiers interpret these embeddings to assign intent based on structural patterns, not environment-specific characteristics.
Training operates on flow sequences: source IP, destination IP, service, duration, forward bytes, backward bytes, timestamp. The model learns that reconnaissance sequences exhibit systematic enumeration structure, lateral movement sequences exhibit privilege escalation structure, exfiltration sequences exhibit collection-transfer structure, independent of specific IP addresses, service names, or volume thresholds.
When deployed in a new environment on day one, DeepTempo identifies behavioral structures matching learned attack patterns without requiring knowledge of specific IP ranges or server roles. A sequence of LDAP queries exhibits systematic enumeration structure characteristic of reconnaissance regardless of specific IP addresses involved.
Zero-shot detection operates because attack structure transcends environment boundaries. Attackers cannot perform reconnaissance without systematic enumeration, achieve lateral movement without progressing through infrastructure tiers, or exfiltrate data without collecting then transferring. These structural requirements exist independent of environment specifics and persist across all AI-generated attack variants.
What surfaces on day one
DeepTempo surfaces attacks exhibiting universal structural patterns on day one, even in environments never seen before.
Reconnaissance surfaces through systematic enumeration characteristics. Active Directory queries showing user enumeration across organizational units, group membership resolution, service principal name enumeration. Flow sequences showing query frequency exceeding administrative patterns, target diversity, timing compressed into minutes rather than distributed over normal periods.
Lateral movement surfaces through privilege escalation sequences. RDP or SSH authentication moving sequentially through network tiers, showing connection diversity to multiple unique destinations, progressive access to higher-privilege systems, systematic traversal inconsistent with routine administration.
Exfiltration surfaces through collection-transfer correlation. SMB flows showing systematic share enumeration and file retrieval followed by HTTPS flows showing bulk upload to external destinations. Flow timing reveals collection preceding transfer, volume characteristics show deviation from typical patterns, destination novelty shows first contact with external endpoints.
Living off the land attacks surface through behavioral timeline structure. PowerShell reconnaissance generates flows exhibiting systematic enumeration patterns. RDP lateral movement using valid credentials generates flows exhibiting privilege escalation sequences. These detections occur on day one because structural patterns exist independent of whether tools are legitimate or credentials are valid.
Why zero-shot detection matters operationally
Zero-shot detection eliminates the training period vulnerability window. Traditional systems require weeks of baseline establishment during which attackers operate undetected. Zero-shot detection provides coverage from deployment start.
Organizations deploying detection in new network segments gain immediate coverage: branch offices, acquired subsidiaries, cloud environments, OT networks. Traditional systems require separate training periods for each. Zero-shot detection applies learned patterns across all environments simultaneously.
Detection of novel attack variants benefits from structural pattern recognition. Traditional ML systems trained on known attack classes struggle with zero-day attacks. Zero-shot detection identifies attacks based on structural patterns that remain consistent even as specific tools change, including AI-generated polymorphic variants.
DeepTempo's zero-shot capability represents a shift from environment-specific training to universal pattern recognition. By learning behavioral structure during pre-training, the model detects attacks in new environments on day one. Organizations deploying DeepTempo gain immediate threat detection coverage without training periods, applicable across all network environments simultaneously, including against AI-driven attacks that morph implementations while maintaining attack structure.
MITRE: Reconnaissance, Discovery, Lateral Movement, Collection, Exfiltration
Related reading:
- From packets to patterns: How foundation models detect network threats
- Living off the land: Why your network sees attacks as normal traffic
- The promise of cybersecurity foundation models
- Attackers don't use indicators and detection shouldn't either
Get in touch to run a 30 day risk-free assessment in your environment. DeepTempo will analyze your existing data to identify threats that are active. Catch threats that your existing NDRs and SIEMs might be missing!
