An Intrusion Detection Method Using Few-Shot Learning

Abstract

Network intrusion detection is an essential means to ensure the security of the network information system. In the real network, abnormal behaviors occur much less frequently than normal behaviors, resulting in scarcity of abnormal samples. We proposed an intrusion detection method based on Few-Shot Learning (FSL), which only used less than 1% of NSL-KDD KDDTrain+ dataset for training, and achieved high accuracy of 92.34% for KDD-Test+ and 85.75% for KDD-Test-21, while other methods, such as J48, Naive Bayes(NB), Random Forest(RF), Support Vector Machine(SVM), recurrent neural network(RNN) and Channel boosted and residual learning based deep convolutional neural network (CBR-CNN), used 20% of KDDTrain+ dataset for training, and achieved relatively low accuracy (less than 89.41% for KDD-Test+ and less than 80.36% for KDD-Test-21). The experiment on dataset of UNSW- NB15 showed a similar result. The detection rates for Dos, U2R, R2L and U2R are improved by our method too, especially for U2R and R2L, which only take up a small proportion of the dataset, the detection rates are increased from 13% to 81.50% and 44.41% to 75.93%, respectively.

Keywords

• Few-shot learning
• intrusion detection
• deep learning
• data scarcity