Zero-Day Attack Detection Using Deep Learning with Focal Loss and Threshold Optimization

Umair Ashraf; Abdul Rehman; Aoun Muhammad; Umar Fayyaz; Sehrish Raza

doi:10.67535/tsp.000002.006

Paper 006

Zero-Day Attack Detection Using Deep Learning with Focal Loss and Threshold Optimization — ISAISS 2026 | TechShield Publications

ISAISS 2026 · Conference Article

Zero-Day Attack Detection Using Deep Learning with Focal Loss and Threshold Optimization

Authors: Umair Ashraf, Abdul Rehman, Aoun Muhammad, Umar Fayyaz, Sehrish Raza

Abstract

Zero-day attacks are attacks which exploit unknown vulnerabilities and they are difficult to find by signature-based methods. In this paper, a deep learning model will be presented for zero day attack identification on the UNSW-NB15 data. We propose a new architecture, based on Focal Loss, and is able to use it to address both extreme imbalance of classes and threshold optimization to reach optimal detection. This model proposed gave an accuracy of 81.26% accuracy. The ROC-AUC grew at 0.9039 with excellent discriminative ability of normal traffic and zero-day attacks. The accuracy of the system is equal (76.42%) and recall (70.87%) with very slight overfitting (7.97% error), which makes it able good enough to go over to the field. Comparative analysis shows our scheme on Focal Loss performs better than conventional Binary Cross Entropy with only 15,297 parameters.

Zero-Day Attacks Deep Learning Focal Loss UNSW-NB15 Intrusion Detection Threshold Optimization

Cite This Paper

U. Ashraf, A. Rehman, A. Muhammad, U. Fayyaz, and S. Raza, “Zero-Day Attack Detection Using Deep Learning with Focal Loss and Threshold Optimization,” Proc. Int. Symp. on AI and Secure Systems (ISAISS 2026), University of Central Punjab, Bahawalpur, Jan. 2026, doi: 10.67535/tsp.000002.006.