A lightweight model design approach for few-shot malicious traffic classification.

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Classifying malicious network traffic is crucial for cybersecurity but current deep learning methods require extensive labeled data, which is difficult to obtain.
• Edge devices have limited computational resources, hindering the deployment of complex deep learning models for threat detection.
• The dynamic nature of cyber threats necessitates models with strong generalization capabilities to adapt to new and evolving malicious activities.

Purpose of the Study:

• To introduce an innovative few-shot malicious traffic classification method that is precise, lightweight, and exhibits enhanced generalization.
• To address the data scarcity and computational constraints associated with traditional deep learning approaches in cybersecurity.
• To develop a model capable of adapting to the rapid mutation of malicious activities.

Main Methods:

• Refined transfer learning by segmenting source models into public and private feature extractors for stepwise transfer and improved parameter alignment.
• Utilized neuron importance sorting based on feature extractor tasks for precise pruning, creating an optimal lightweight model.
• Employed an adversarial network for retraining public feature extractor parameters to strengthen model generalization.

Main Results:

• Achieved over 97% accuracy on few-shot datasets with a maximum of 15 samples per class.
• Developed a model with fewer than 50K parameters, making it suitable for resource-constrained environments.
• Demonstrated superior generalization capabilities compared to existing baseline methods.

Conclusions:

• The proposed few-shot learning method offers a precise, lightweight, and highly generalizable solution for malicious traffic classification.
• This approach effectively overcomes the limitations of data requirements and computational costs of traditional deep learning models.
• The method provides a robust defense mechanism against evolving cyber threats, particularly for edge network security.