Abstract:Due to the rapid evolution of Advanced Persistent Threats (APTs) attacks, the emergence of new and rare attack samples, and even those never seen before, make it challenging for traditional rule-based detection methods to extract universal rules for effective detection. With the progress in techniques such as transfer learning and meta-learning, few-shot network attack detection has progressed. However, challenges in few-shot network attack detection arise from the inability of time sequence flow features to adapt to the fixed length input requirement of deep learning, difficulties in capturing rich information from original flow in the case of insufficient samples, and the challenge of high-level abstract representation. To address these challenges, a few-shot network attack detection based on NFHP (Network Flow Holographic Picture)-RN (ResNet) is proposed. Specifically, leveraging inherent properties of images such as translation invariance, rotation invariance, scale invariance, and illumination invariance, network attack traffic features and contextual relationships are intuitively represented in NFHP. In addition, an improved RN network model is employed for high-level abstract feature extraction, ensuring that the extracted high-level abstract features maintain the detailed characteristics of the original traffic behavior, regardless of changes in background traffic. Finally, a meta-learning model based on the self-attention mechanism is constructed, achieving the detection of novel APT few-shot network attacks through the empirical generalization of high-level abstract feature representations of known-class network attack behaviors. Experimental results demonstrate that the proposed method can learn high-level abstract features of network attacks across different traffic detail granularities. Compared with state-of-the-art methods, it achieves favorable accuracy, precision, recall, and F1 scores for the identification of unknown-class network attacks through cross-validation on multiple datasets.

EmbedLOF: A Network Embedding Based Intrusion Detection Method for Organized Attacks

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

A Method of Few-Shot Network Intrusion Detection Based on Meta-Learning Framework

A Spatiotemporal-Oriented Deep Ensemble Learning Model to Defend Link Flooding Attacks in IoT Network

Network Intrusion Detection Methods Based on Deep Learning

An integrated intrusion detection framework based on subspace clustering and ensemble learning

Hybrid CNN-LSTM model combined with feature selection and SMOTE for detection of network attacks

NFHP-RN: A Method of Few-Shot Network Attack Detection Based on the Network Flow Holographic Picture-ResNet

Log2vec: A Heterogeneous Graph Embedding Based Approach for Detecting Cyber Threats within Enterprise

Network Intrusion Detection Model Based on Improved BYOL Self-Supervised Learning

Detecting Stealthy Spreaders Using Online Outdegree Histograms

A Graph Representation Learning Algorithm for Low-Order Proximity Feature Extraction to Enhance Unsupervised IDS Preprocessing

Anomaly detection in ad-hoc networks based on deep learning model: A plug and play device

Open Set Intrusion Event Recognition Using Anchor Point Learning for Distributed Optical Fiber System

Application of Local Outlier Factor Algorithm to Detect Anomalies in Computer Network

EmInspector: Combating Backdoor Attacks in Federated Self-Supervised Learning Through Embedding Inspection

LTRDetector: Exploring Long-Term Relationship for Advanced Persistent Threats Detection

Long-Distance Pipeline Intrusion Warning Based on Environment Embedding from Distributed Optical Fiber Sensing

A Novel Network Forensic Framework for Advanced Persistent Threat Attack Attribution Through Deep Learning

Strengthening Network Security: Deep Learning Models for Intrusion Detection with Optimized Feature Subset and Effective Imbalance Handling

A Novel Framework Design of Network Intrusion Detection Based on Machine Learning Techniques