SSPNet: Semi-Supervised Prototypical Networks for Few-Shot Network Intrusion Detection

Network Intrusion Detection Systems (NIDS) play a crucial role in protecting digital infrastructures against evolving cyber threats. However, the increasing sophistication and frequency of novel attacks, combined with the limited access to labeled training data, pose significant challenges to traditional machine learning-based detection methods. To address these challenges, we propose a novel semi-supervised training schema to enhance Prototypical Networks for few-shot learning in NIDS. Our approach integrates a semi-supervised prototypical loss that leverages pseudo-labels from high-confidence samples, improving representation learning and model performance.We evaluate our method on benchmark network intrusion detection datasets, where we demonstrate its ability to generalize to novel attack classes with few labeled samples. Experimental results show that the proposed semi-supervised Prototypical Networks (SSPNet) outperforms standard Prototypical Networks and other competing models, particularly in scenarios where newly introduced target attack categories are highly dissimilar to source attacks: it performs 24% better on ACI-IoT-2023 Network Traffic Dataset and 15% better on CICIDS2017 than the standard Prototypical Networks. Our findings highlight the potential of semi-supervised few-shot learning in increasing the adaptability and reliability of NIDS in countering emerging cyber threats.