A Few-Shot Learning-Based Siamese Capsule Network for Intrusion Detection with Imbalanced Training Data.

Area of Science:

• Cybersecurity
• Machine Learning
• Network Intrusion Detection

Background:

• Network intrusion detection is a critical cybersecurity challenge.
• Machine learning methods struggle with imbalanced data and detecting novel attacks.
• Existing systems require improvement for reliability against evolving threats.

Purpose of the Study:

• To propose a novel few-shot learning-based Siamese capsule network.
• To address the scarcity of abnormal network traffic data.
• To enhance the detection of both known and unknown network attacks.

Main Methods:

• A Siamese capsule network architecture designed for capturing dynamic traffic feature relationships.
• Integration of an unsupervised subtype sampling scheme to handle imbalanced training data.
• Utilizing a metric learning framework for feature extraction.

Main Results:

• The proposed method effectively tackles imbalanced data and enhances detection of unknown attacks.
• The metric learning framework extracts subtle, distinctive features for identifying diverse attacks.
• Superior performance demonstrated compared to state-of-the-art methods in detecting known and unknown attacks.

Conclusions:

• The few-shot learning Siamese capsule network offers a robust solution for network intrusion detection.
• The integrated sampling scheme significantly improves performance on imbalanced datasets.
• This approach advances reliable detection capabilities against sophisticated cyber threats.