Few-Shot Learning with Discriminative Representation for Cyberattack Detection

Advanced methods in machine learning, like Few-shot learning, have demonstrated potential in tackling the difficulties of identifying cyberattacks (namely anomalies) posed by the shortage of anomaly data. A recent study had employed the latent representation of a Discriminative AutoEncoder to transfer knowledge of known cyberattacks to few-shot learning-based classifiers for identifying novel/rare anomaly categories. However, the Discriminative AutoEncoder is trained to prefer representing normal data than anomalies without any constrains on its latent feature space. In this paper, we propose a discriminative representation model that directly learns the manifolds of both normal class and known anomalies. The model is then used to extract prior meta-knowledge to the few-shot learning phase for new/rare anomaly classes. Experimental evaluations conducted on benchmark datasets (i.e. NSLKDD, CIC-IDS2017 and NBaIoT) demonstrate that our proposed model often outperforms traditional discriminative autoencoders on the tasks of detecting new/rare cyberattack groups. This approach holds promise for advancing the state-of-the-art in cybersecurity by effectively utilizing few labeled anomaly samples and incorporating prior knowledge to accurately and efficiently identify novel/rare attacks.