Abstract
The rapid evolution of cyber-adversarial procedures has rendered traditional signature-based and static machine learn- ing intrusion detection systems (IDS) ineffective, particularly against zero-day attacks and non-stationary traffic distributions. While recent few-shot and meta-learning approaches demonstrate high detection accuracy, they remain limited by two criti- cal gaps: lack of causal explainability and vulnerability to distributional shifts. This research proposes an Adaptive, Causally- Explainable, and Distributionally Robust AI framework for low–false-positive zero-day attack detection in dynamic network envi- ronments. The proposed architecture integrates Causal Prototypical Networks (CPN) with Structural Causal Modeling (SCM) to eliminate spurious correlations and enable prototype-based reasoning. Furthermore, Distributionally Robust Optimization (DRO) is embedded within a meta-learning paradigm to ensure worst-case performance guarantees under adversarial and non-stationary shifts. An open-world interpretability module employing counterfactual explanations provides actionable insights for security an- alysts. Experimental validation across heterogeneous datasets demonstrates improved generalization under domain shifts, reduced false positives, and enhanced forensic interpretability compared to conventional black-box ensemble and autoencoder-based IDS models. The proposed framework advances IDS research toward robust, trustworthy, and analyst-centric cybersecurity systems