Semi-supervised Few-shot Network Intrusion Detection based on Meta-learning

Due to the rapid development of the Internet, the scale of networks is growing exponentially, and new types of attacks continue to emerge. These new attacks are becoming more threatening, and the means of attack are changing with days. Most network intrusion detection models fail to achieve the same level of detection performance in real-world network environments as in laboratory environments. This is because different types of intrusion traffic evolve over time, and new intrusion attacks continue to emerge, rendering the sample data used for model training gradually obsolete. Real-time and reliable sample data is always scarce. How to achieve accurate and effective network intrusion detection in few-shot or zero-shot scenarios is a significant challenge for researchers. To address the problem of lacking real-time labeled data for new or variant attacks in real networks, this paper proposes a few-shot intrusion detection model called SPN based on semi-supervised prototype network. In this model, the original classification problem is transformed into a metric learning problem by using prototype network in meta-learning. By redefining the construction process of prototype points through the newly designed soft K-means and soft masking mechanisms, the SPN model can incorporate a large amount of unlabeled data in training based on a small amount of labeled data. This enables the SPN model to achieve outstanding intrusion detection performance in few-shot scenarios, while also having the ability to identify unknown intrusion attacks in zero-shot scenarios. A series of experimental results on datasets CICIDS2017 and UNSW-NB15 demonstrate that the proposed SPN model can accurately detect known attacks in few-shot scenarios, achieving an accuracy rate of 96%. Furthermore, it can effectively detect unknown intrusion attacks in zero-shot scenarios with a detection rate of over 93%.