Efficient Intrusion Detection for Edge Network via Multi-Stage Few-Shot Class-Incremental Learning

The emerging increasingly sophisticated, intelligent, and stealthy network attacks pose more severe security threats to the edge network. In particular, the emergence of novel intelligent attacks makes it a challenging issue to obtain sufficient attack samples, and thus classical deep learning-driven intrusion detection frameworks (IDSs) become ineffective. To tackle this issue, we introduce a novel intrusion detection framework lever aging few-shot class-incremental learning (FSCIL) capabilities to achieve robust detection of emerging threats with few samples. This approach pre-trains a backbone traffic classification model and employs few-shot training with prototypical networks. To further reduce catastrophic forgetting while improving both accuracy and system robustness, we incrementally fine-tune the classification model with supervised contrastive learning, and also realize rapid adaptation to new attacks. Evaluations on the intrusion detection datasets CIC-IDS2017 and USTC-TF2016 demonstrate that our framework consistently outperforms base line models for emerging attacks detection with few attack samples while preserving effective recognition of known threats