Zero-shot learning for raw network traffic detection

Abstract

In recognizing the importance of network traffic monitoring for cybersecurity, it is essential to acknowledge that most traditional machine learning models integrated in network intrusion detection systems encounter difficulty in training because acquiring labeled data involves an expensive and time-consuming process. This triggers an in-depth analysis into zero-shot learning techniques specifically designed for raw network traffic detection. Our innovative approach uses clustering combined with the instance-based method for zero-shot learning, enabling classification of network traffic without explicit training on labeled attack data and produces pseudo-labels for unlabeled data. This approach enables the development of accurate models with minimal limited labeled data for making network security more adaptable. Extensive computational experimentation is performed to evaluate our zero-shot learning approach using a real-world network traffic detection dataset. Finally, we offer insights into state-of-art developments and guiding efforts to enhance network security against ever-evolving cyber threats.