Adaptive continual botnet detection with self-supervised prototypical networks and few-shot learning for evolving...

One of the problems faced by botnet intrusion detection systems is the detection of unknown attacks or zero-day attacks. Zero-day attacks give security analysts very little time for action since there is only little information that is known about the new attack that is launched, given very few samples available for the training process. Class imbalance issues faced by many benchmark datasets also reduce the ability to detect a zero-day attack. It leads to very few samples of a particular class, which makes it difficult to trace different types of the same attack. The rapid evolution of botnets also poses a challenge to the existing models, which often fail to adapt to the new attack patterns without catastrophic forgetting of previously learned knowledge.

The objective of this study was to develop a model for adaptive botnet detection in cases of zero-day attacks and imbalanced dataset availability. The study integrates self-supervised learning (SSL), enhanced prototypical networks with attention mechanisms, and few-shot learning (FSL) to overcome the existing issues. Wasserstein generative adversarial network with gradient penalty (WGAN-GP) generates synthetic samples to handle class imbalance. An adaptive continual learning module is used, which combines elastic weight consolidation (EWC) and an experience replay buffer which enables the model to accommodate new botnet behaviors while preserving performance on previously seen samples. Moreover, a drift detector using the KS test, Wasserstein distance, and class-prior shift triggers model adaptation when concept drift is identified.

The performance of the proposed model was evaluated on the CIC IoT dataset 2023, which demonstrated an exceptional accuracy of 98.50%, outperforming the traditional baselines. Few-shot learning evaluations show strong generalization with as few as 1-5 shots per class. This result shows the overall achievement of the model in zero-day attack detection and real-time adaptation to the evolving botnet threats.

The findings demonstrate that the proposed framework provides an effective approach for zero-day botnet attack detection while maintaining knowledge of previously observed attacks. The combination of few-shot learning and adaptive continual learning improves the model's ability to respond to emerging botnet behaviours without requiring extensive retraining. Thus, the proposed approach shows potential for adaptive and real-time botnet detection in evolving IoT network environments.