Leveraging siamese networks for one-shot intrusion detection model

Abstract

The use of supervised Machine Learning (ML) to enhance Intrusion Detection Systems (IDS) has been the subject of significant research. Supervised ML is based upon learning by example, demanding significant volumes of representative instances for effective training and the need to retrain the model for every unseen cyber-attack class. However, retraining the models in-situ renders the network susceptible to attacks owing to the time-window required to acquire a sufficient volume of data. Although anomaly detection systems provide a coarse-grained defence against unseen attacks, these approaches are significantly less accurate and suffer from high false-positive rates. Here, a complementary approach referred to as “One-Shot Learning”, whereby a limited number of examples of a new attack-class is used to identify a new attack-class (out of many) is detailed. The model grants a new cyber-attack classification opportunity for classes that were not seen during training without retraining. A Siamese Network is trained to differentiate between classes based on pairs similarities, rather than features, allowing to identify new and previously unseen attacks. The performance of a pre-trained model to classify new attack-classes based only on one example is evaluated using three mainstream IDS datasets; CICIDS2017, NSL-KDD, and KDD Cup’99. The results confirm the adaptability of the model in classifying unseen attacks and the trade-off between performance and the need for distinctive class representations.

Malicious Data Classification in Packet Data Network Through Hybrid Meta Deep Learning

“…However, their model still requires a large amount of data to gain the detection rate they achieved. In [9] They performed binary classification on two datasets, namely ISCX2012 and CICIDS2017. However, specific attack related countermeasures cannot be taken as the classification indicates whether a network is benign or malicious.…”

“…In [9], authors recommended a Siamese Network using a one-shot learning mechanism to classify cyber attacks. In total, they used 274729 samples for their experiment.…”

MeshID: Few-Shot Finger Gesture Based User Identification Using Orthogonal Signal Interference

“…The performance of the traditional deep learning(DL) technique relies heavily on collecting a large amount of user data as a prerequisite, especially assuming that the represented data distribution is relatively stationary without dynamic changes. Towards robust and efficient model retraining, we utilize a one-shot learning approach based on the Siamese network [ 27 , 28 , 29 ], with two core techniques: first component reverse (FCR) extraction and convolution block attention module (CBAM), achieving high model robustness and performance in heterogeneous scenarios (e.g., identifying unseen users). A unique velocity distribution profiling (VDP) is calculated from a double-source interference pattern, reflecting the personal motion features.…”

Machine Learning-Based Adaptive Synthetic Sampling Technique for Intrusion Detection

“…The NSL-KDD dataset, which may be used to assess anomaly detection accuracy, was utilized as a benchmark dataset for network infiltration. It was possible to identify and categorize normal or aberrant connections when assessed using the test results [27]. Applying strategies such as stacked autoencoding, a deep belief net version of sparse autoencoding, for unsupervised feature learning and NB-Tree, Random Tree, or J48 for additional categorization boosted performance even more [28].…”