Abstract:Conventional intrusion detection systems based on supervised learning techniques require a large number of samples for training, while in some scenarios, such as zero-day attacks, security agencies can only intercept a limited number of shots of malicious samples. Therefore, there is a need for few-shot detection. In this paper, a detection method based on a meta-learning framework is proposed for this purpose. The proposed method can be used to distinguish and compare a pair of network traffic samples as a basic task of learning, including a normal unaffected sample and a malicious one. To accomplish this task, we design a deep neural network (DNN) named FC-Net, which mainly comprises two parts: feature extraction network and comparison network. FC-Net learns a pair of feature maps for classification from a pair of network traffic samples, then compares the obtained feature maps, and finally determines whether the pair of samples belongs to the same type. To evaluate the proposed detection method, we construct two datasets for few-shot network intrusion detection based on real network traffic data sources, using a specifically developed approach. The experimental results indicate that the proposed detection method is universal and is not limited to specific datasets or attack types. Training and testing on the same datasets demonstrate that the proposed method can achieve the average detection rate up to 98.88%. The outcome of training on one dataset and testing on the other one confirms that the proposed method can achieve better performance. In a few-shot scenario, malicious samples in an untrained dataset can be detected successfully, and the average detection rate is up to 99.62%.

Few-Shot Encrypted Traffic Classification: A Survey

Unidirectional Encrypted Traffic Classification: A Survey

A Method of Few-Shot Network Intrusion Detection Based on Meta-Learning Framework

Few-shot encrypted traffic classification via multi-task representation enhanced meta-learning

Machine Learning-Powered Encrypted Network Traffic Analysis: A Comprehensive Survey.

An Encrypted Traffic Classification Method Combining Graph Convolutional Network and Autoencoder

Optimizing Feature Selection for Efficient Encrypted Traffic Classification: A Systematic Approach

A Survey of Encrypted Malicious Traffic Detection*

End-to-end encrypted traffic classification with one-dimensional convolution neural networks

Rethinking Encrypted Traffic Classification: A Multi-Attribute Associated Fingerprint Approach

PacketCGAN: Exploratory Study of Class Imbalance for Encrypted Traffic Classification Using CGAN

An Novel Hybrid Method for Effectively Classifying Encrypted Traffic

CBD: A Deep-Learning-Based Scheme for Encrypted Traffic Classification with a General Pre-Training Method

Encrypted Network Traffic Analysis and Classification Utilizing Machine Learning

Multi-Task Scenario Encrypted Traffic Classification and Parameter Analysis

Many or Few Samples? Comparing Transfer, Contrastive and Meta-Learning in Encrypted Traffic Classification

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

Few-Shot Image Classification: Current Status and Research Trends

An Encrypted Traffic Classification Framework Based on Higher-Interaction-Graph Neural Network

MATEC: A lightweight neural network for online encrypted traffic classification

RM-Net: an Encrypted Traffic Classification Method Based on Deep Learning for Low Labeled Rate Scenarios