A Few-Shot Learning-Based Siamese Capsule Network for Intrusion Detection with Imbalanced Training Data

Zu-Min Wang, Ji-Yu Tian, Jing Qin, Hui Fang, Li-Ming Chen

Research output: Contribution to journalArticlepeer-review

Abstract

Network intrusion detection remains one of the major challenges in cybersecurity. In recent years, many machine-learning-based methods have been designed to capture the dynamic and complex intrusion patterns to improve the performance of intrusion detection systems. However, two issues, including imbalanced training data and new unknown attacks, still hinder the development of a reliable network intrusion detection system. In this paper, we propose a novel few-shot learning-based Siamese capsule network to tackle the scarcity of abnormal network traffic training data and enhance the detection of unknown attacks. In specific, the well-designed deep learning network excels at capturing dynamic relationships across traffic features. In addition, an unsupervised subtype sampling scheme is seamlessly integrated with the Siamese network to improve the detection of network intrusion attacks under the circumstance of imbalanced training data. Experimental results have demonstrated that the metric learning framework is more suitable to extract subtle and distinctive features to identify both known and unknown attacks after the sampling scheme compared to other supervised learning methods. Compared to the state-of-the-art methods, our proposed method achieves superior performance to effectively detect both types of attacks. [Abstract copyright: Copyright © 2021 Zu-Min Wang et al.]
Original languageEnglish
Article number7126913
Pages (from-to)1-17
Number of pages17
JournalComputational intelligence and neuroscience
Volume2021
Early online date13 Sep 2021
DOIs
Publication statusE-pub ahead of print - 13 Sep 2021

Keywords

  • Machine Learning
  • Computer Security

Fingerprint

Dive into the research topics of 'A Few-Shot Learning-Based Siamese Capsule Network for Intrusion Detection with Imbalanced Training Data'. Together they form a unique fingerprint.

Cite this