A Few‐Shot Learning‐Based Siamese Capsule Network for Intrusion Detection with Imbalanced Training Data

Wang, Zumin; Tian, Ji-Yu; Qin, Jing; Fang, Hui; Chen, Liming

doi:10.1155/2021/7126913

Cited by 19 publications

(8 citation statements)

References 48 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…FC-Net [ 18 ] is based on RelationNet to implement few-shot traffic classification and achieves good performance in its experimental setting. DF-Net [ 23 ] takes use of siamese capsule network for AD with imbalanced traning data. A relative position mechanism and a global-enhanced feature extractor are designed in GP-Net [ 26 ] to capture the relationship between arbitrary 2-byte payload sequences.…”

Section: Resultsmentioning

confidence: 99%

A Biological Immunity-Based Neuro Prototype for Few-Shot Anomaly Detection with Character Embedding

Ma,

Chen,

Zheng

et al. 2024

Cyborg Bionic Syst

View full text Add to dashboard Cite

Anomaly detection has wide applications to help people recognize false, intrusion, flaw, equipment failure, etc. In most practical scenarios, the amount of the annotated data and the trusted labels is low, resulting in poor performance of the detection. In this paper, we focus on the anomaly detection for the text type data and propose a detection network based on biological immunity for few-shot detection, by imitating the working mechanism of the immune system of biological organisms. This network enabling the protected system to distinguish the aggressive behavior of “nonself” from the legitimate behavior of “self” by embedding characters. First, it constructs episodic task sets and extracts data representations at the character level. Then, in the pretraining phase, Word2Vec is used to embed the representations. In the meta-learning phase, a dynamic prototype containing encoder, routing, and relation is designed to identify the data traffic. Compare to the mean-based prototype, the proposed prototype applies a dynamic routing algorithm that assigns different weights to samples in the support set through multiple iterations to obtain a prototype that combines the distribution of samples. The proposed method is validated on 2 real traffic datasets. The experimental results indicate that (a) the proposed anomaly detection prototype outperforms state-of-the-art few-shot techniques with 1.3% to 4.48% accuracy and 0.18% to 4.55% recall; (b) under the premise of ensuring the accuracy and recall, the number of training samples is reduced to 5 or 10; (c) ablation experiments are designed for each module, and the results show that more accurate prototypes can be obtained by using the dynamic routing algorithm.

show abstract

Section: Resultsmentioning

confidence: 99%

A Biological Immunity-Based Neuro Prototype for Few-Shot Anomaly Detection with Character Embedding

Ma,

Chen,

Zheng

et al. 2024

Cyborg Bionic Syst

View full text Add to dashboard Cite

show abstract

“…The model achieved 98.88% accuracy and 99.62% accuracy on different datasets. Although the model was scalable and could be applied using various algorithms, the approach ignored the worldwide spatial distance between classes, which is detrimental to the further development of recognition accuracy [22].…”

Section: Literature Reviewmentioning

confidence: 99%

Enhancing IoT Security: A Few-Shot Learning Approach for Intrusion Detection

Althiyabi,

Ahmad,

Alassafi

2024

Mathematics

View full text Add to dashboard Cite

Recently, the number of Internet of Things (IoT)-connected devices has increased daily. Consequently, cybersecurity challenges have increased due to the natural diversity of the IoT, limited hardware resources, and limited security capabilities. Intrusion detection systems (IDSs) play a substantial role in securing IoT networks. Several researchers have focused on machine learning (ML) and deep learning (DL) to develop intrusion detection techniques. Although ML is good for classification, other methods perform better in feature transformation. However, at the level of accuracy, both learning techniques have their own certain compromises. Although IDSs based on ML and DL methods can achieve a high detection rate, the performance depends on the training dataset size. Incidentally, collecting a large amount of data is one of the main drawbacks that limits performance when training datasets are lacking, and such methods can fail to detect novel attacks. Few-shot learning (FSL) is an emerging approach that is employed in different domains because of its proven ability to learn from a few training samples. Although numerous studies have addressed the issues of IDSs and improved IDS performance, the literature on FSL-based IDSs is scarce. Therefore, an investigation is required to explore the performance of FSL in IoT IDSs. This work proposes an IoT intrusion detection model based on a convolutional neural network as a feature extractor and a prototypical network as an FSL classifier. The empirical results were analyzed and compared with those of recent intrusion detection approaches. The accuracy results reached 99.44%, which shows a promising direction for involving FSL in IoT IDSs.

show abstract

“…The experimental results show that the method is universal and performs well. Wang et al [ 32 ] proposed a Siamese capsule network and an unsupervised subtype sampling scheme to solve the problem of insufficient training data of network attack traffic. Yu et al [ 33 ] utilized the Siamese network as the classification model, consisting of two two-layer CNN.…”

Section: Related Workmentioning

confidence: 99%

Few-Shot network intrusion detection based on prototypical capsule network with attention mechanism

et al. 2023

View full text Add to dashboard Cite

Network intrusion detection plays a crucial role in ensuring network security by distinguishing malicious attacks from normal network traffic. However, imbalanced data affects the performance of intrusion detection system. This paper utilizes few-shot learning to solve the data imbalance problem caused by insufficient samples in network intrusion detection, and proposes a few-shot intrusion detection method based on prototypical capsule network with the attention mechanism. Our method is mainly divided into two parts, a temporal-spatial feature fusion method using capsules for feature extraction and a prototypical network classification method with attention and vote mechanisms. The experimental results demonstrate that our proposed model outperforms state-of-the-art methods on imbalanced datasets.

show abstract

A Few‐Shot Learning‐Based Siamese Capsule Network for Intrusion Detection with Imbalanced Training Data

Cited by 19 publications

References 48 publications

A Biological Immunity-Based Neuro Prototype for Few-Shot Anomaly Detection with Character Embedding

A Biological Immunity-Based Neuro Prototype for Few-Shot Anomaly Detection with Character Embedding

Enhancing IoT Security: A Few-Shot Learning Approach for Intrusion Detection

Few-Shot network intrusion detection based on prototypical capsule network with attention mechanism

Contact Info

Product

Resources

About