Few-shot network intrusion detection method based on multi-domain fusion and cross-attention

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Deep learning excels in network intrusion detection but struggles with limited attack samples and domain shifts in real-world applications.
• Existing methods often fail to generalize effectively across different network environments or when training data is scarce.
• Addressing these limitations is crucial for robust and reliable network security.

Purpose of the Study:

• To propose a novel few-shot network intrusion detection method that overcomes limitations of data scarcity and domain shift.
• To enhance the discriminability and fusion of network traffic features across different domains.
• To improve the robustness and practical applicability of intrusion detection systems in dynamic environments.

Main Methods:

• A dual-branch feature extractor capturing spatial and frequency domain characteristics (using 2D-DCT) of network traffic.
• A dual-domain bidirectional cross-attention module for aligning features between support and query samples under few-shot conditions.
• A hierarchical feature encoding module utilizing a modified Mamba architecture for long-range dependency and temporal pattern capture.

Main Results:

• Achieved 99.03% and 98.64% accuracy on CICIDS2017 and CICIDS2018 datasets in a 10-shot setting, surpassing state-of-the-art methods.
• Demonstrated strong cross-domain generalization, with over 95.13% accuracy in cross-domain scenarios.
• The proposed method shows significant improvements in few-shot learning and domain adaptation for network intrusion detection.

Conclusions:

• The novel few-shot intrusion detection method effectively handles limited data and domain shifts.
• The integration of multi-domain feature fusion and cross-attention significantly enhances detection performance and generalization.
• The method offers a robust and practical solution for real-world network security challenges.