A Zero-Shot Transformer–Graph Neural Network Framework for Unknown Cyberattack Pattern Recognition in IoT Networks

Abstract

The exponential growth of Internet of Things (IoT) devices has led to an unprecedented rise of cyberattacks, many of which are new, unseen attack families that cannot be handled by traditional signature-based and closed-set classification systems. Traditional intrusion detection systems (IDS) fail catastrophically when facing zero-day threats or emerging attack categories, and this limitation poses critical risks to smart infrastructure, industrial IoT and edge computing environments. In this paper, we propose ZT-GraFormer: a Zero-Shot Transformer–Graph Neural Network framework with a multi-head Transformer encoder for extracting temporal and sequential traffic pattern and a dynamic k-Nearest Neighbor (kNN) graph construction mechanism along with dual GraphSAGE layers for propagating relational cyberattack pattern. It contains an auxiliary reconstruction based anomaly scoring module that combines mean squared error (MSE) reconstruction loss and energy based scoring for robust detection of unseen attack categories without any prior exposure to their samples during training. Extensive experiments on the UNSW-NB15 benchmark dataset show that ZT-GraFormer achieves 99.14% classification accuracy and 98.72% macro-F1 score on the known attack categories, outperforming the next best approach by 0.93 percentage points in terms of accuracy. For zero-shot unseen attack detection, the framework achieves 0.9876 AUROC and 0.9712 Average Precision, significantly outperforming the previous state-of-the-art methods including GNN-IDS, HeteroGNN, and BERT-IDS variants. ZT-GraFormer raises the bar for AI-based cyberattack pattern recognition in IoT networks, providing a solution that is both practically deployable and theoretically sound for open-world intrusion detection. Release of source code and pre-trained models for reproducibility.