A Few-Shot Learning-Based Siamese Capsule Network for Intrusion Detection with Imbalanced Training Data

Zu-Min Wang, Ji-Yu Tian, Jing Qin, Hui Fang, Li-Ming Chen

Research output: Contribution to journalArticlepeer-review

25 Citations (Scopus)
66 Downloads (Pure)


Network intrusion detection remains one of the major challenges in cybersecurity. In recent years, many machine-learning-based methods have been designed to capture the dynamic and complex intrusion patterns to improve the performance of intrusion detection systems. However, two issues, including imbalanced training data and new unknown attacks, still hinder the development of a reliable network intrusion detection system. In this paper, we propose a novel few-shot learning-based Siamese capsule network to tackle the scarcity of abnormal network traffic training data and enhance the detection of unknown attacks. In specific, the well-designed deep learning network excels at capturing dynamic relationships across traffic features. In addition, an unsupervised subtype sampling scheme is seamlessly integrated with the Siamese network to improve the detection of network intrusion attacks under the circumstance of imbalanced training data. Experimental results have demonstrated that the metric learning framework is more suitable to extract subtle and distinctive features to identify both known and unknown attacks after the sampling scheme compared to other supervised learning methods. Compared to the state-of-the-art methods, our proposed method achieves superior performance to effectively detect both types of attacks. [Abstract copyright: Copyright © 2021 Zu-Min Wang et al.]
Original languageEnglish
Article number7126913
Pages (from-to)1-17
Number of pages17
JournalComputational intelligence and neuroscience
Publication statusPublished (in print/issue) - 14 Sept 2021

Bibliographical note

Publisher Copyright:
© 2021 Zu-Min Wang et al.


  • Machine Learning
  • Computer Security


Dive into the research topics of 'A Few-Shot Learning-Based Siamese Capsule Network for Intrusion Detection with Imbalanced Training Data'. Together they form a unique fingerprint.

Cite this