2.1 Network intrusion detection

Network intrusion detection is a critical issue in the field of network security, aimed at identifying malicious activities within a network to safeguard systems and data. With the emergence and development of deep learning, methods combining deep learning with network intrusion detection have gradually evolved. Shone et al. [13] proposed a novel classification model that integrates deep learning and machine learning, specifically a stacked non-symmetric deep autoencoder (NDAE) combined with a random forest (RF) classification algorithm. This approach leverages the stacking capabilities of NDAEs along with the accuracy and speed of RF. Gurung et al. [14] designed a system using sparse autoencoders, a deep learning method, for intrusion detection. This system not only learns but also adapts to previously undefined patterns. Sparse autoencoders have been used for unsupervised feature learning, and the data is subsequently classified using a logistic classifier. Additionally, R et al. [3] introduced some techniques from the field of computer vision, utilizing CNNs to extract features from network traffic. The authors primarily employed supervised learning methods such as multilayer perceptrons (MLP), CNNs, CNN-Recurrent Neural Network (CNN-RNN), CNN-Long Short-Term Memory network (CNN-LSTM), and CNN-Gated Recurrent Unit (CNN-GRU), which exhibit stronger feature extraction capabilities compared to traditional machine learning methods. Liu et al. [15] used CNNs as the foundational network model and applied Fourier transforms to convert network traffic into images. Since the Fourier transform operates on numerical sequences and network traffic data is not purely numerical, the authors first converted the traffic into numerical sequences, which were then directly subjected to Fourier transformation.

Recent advancements have been made in the integration of deep learning and network intrusion detection. Wang et al. [16] proposed an intrusion detection model using ResNet, Transformer and BiLSTM (Res-TranBiLSTM) that takes into account both the spatial and temporal features of network traffic. They used the Synthetic Minority Over-sampling Technique (SMOTE) combined with the Edited Nearest Neighbor (ENN) method to alleviate the degree of data imbalance. Ullah et al. [17] introduced a transformer neural network-based intrusion detection system (TNN-IDS) designed explicitly for IoT networks supporting MQTT, leveraging the parallel processing capabilities of the transformer neural network to accelerate the learning process and improve malicious attack detection. Kilincer et al. [18] emphasized the importance of building a comprehensive intrusion detection framework. By utilizing boosting algorithms, such as AdaBoost and gradient boosting, they improved the detection accuracy of various network attacks in heterogeneous network environments. Long et al. [19] proposed a novel NIDS algorithm based on the transformer model, integrating the fundamental aspects of network intrusion detection with the inherent complex attention mechanism of the transformer model, and thoroughly examining the relationship between input features and different types of intrusions. Ullah et al. [20] proposed a transformer-based transfer learning method for imbalanced network intrusion detection systems (IDS-INT). IDS-INT uses a transformer-based transfer learning method to learn the network feature representations and interactions in imbalanced data. Simultaneously, a hybrid method of the CNN-LSTM model was developed to detect different types of attacks from deep features. Reka et al. [21] designed a clustering-gradient-based centrality coating optimization algorithm for multi-attack intrusion identification. This method maximizes the attack identification rate of the intrusion detection system without affecting its effectiveness. It utilizes the proposed Coati optimization algorithm and a constitutive artificial neural network (CANN) to select cluster heads and reduce cluster creation in network activity to evaluate the proposed method. Altaf et al. [22] designed a framework called the Node Edge-Graph Convolutional Network (NE-GConv), which enhances the detection capability of the model by utilizing both node and edge features simultaneously. In addition, a novel undersampling method based on the KNN principle and the borderline-SMOTE oversampling method were introduced for mixed data sampling to balance the dataset while addressing the issue of low detection accuracy in overlapping data classes. Manocchio et al. [23] introduced the flowtransformer framework, which is a new approach for implementing a NIDS based on a transformer. This method leverages the advantages of the transformer model in recognizing a network’s long-term behavior and characteristics.

2.2 Self-attention mechanism

Self-attention mechanism has achieved significant success in natural language processing. It has been widely applied in computer vision, speech processing, time-series analysis, and other fields. In network traffic analysis, we can utilize high-performance feature extraction and the ability to capture long-distance dependencies offered by a self-attention mechanism. Researchers have begun to explore the application of self-attention mechanisms to network traffic feature learning and threat detection. Transformers, as representatives of self-attention mechanisms, have gradually become a research focus. Huang et al. Han et al. [24] proposed a new transformer-based network in the style of U-Net for repair tasks, called the Sparse Self-Attention Transformer (spa-former). This method employs a new channel attention approximation algorithm that reduces attention computation to linear complexity and effectively excludes irrelevant features by generating sparse attention maps. Han et al. [25] proposed a new intrusion detection model based on n-gram frequency and a time-aware transformer that considers the features of various components of the original network traffic and can hierarchically learn the packet-level and session-level features of the original network traffic. Zhang et al. [26] introduced a deep-learning-based intrusion detection method that integrates the Transformer and LSTM modules with the intrusion detection model to automatically detect network intrusions. They used a Transformer and LSTM to capture the sequential information of traffic data, which is beneficial for distinguishing between abnormal and normal data. Similarly, Li et al. [27] proposed a network intrusion detection method based on a transformer, and designed a dual-encoder transformer that uses weighted sums and residual connections to integrate packet-level and flow-level network traffic features. Expanding the application of Transformers, Zhang et al. [28] introduced an intrusion detection model that combines convolutional neural networks and a transformer, which can capture not only the global relevance between packets but also the local relevance of intrusion behaviors. Barut et al. [29] proposed a malware traffic classification system called the Residual One-Dimensional Image Transformer (R1DIT), which uses raw data transformation and attention-based modules for classification. This system focuses on leveraging knowledge from the network domain by parsing IP, HTTP, DNS, and headers of unencrypted TLS records as byte sequence inputs. Moreover, Fang et al. [30] proposed a Packeted Window Transformer model (PWT) based on learnable embedding features, which learns the embedding features of network traffic by blocking windows of packets of specific sizes, thereby ultimately determining abnormalities in network traffic. Rendón-Segador et al. [31] drew an analogy between network traffic features and the NLS format of natural language sentences. They proposed the application of an attention mechanism for classifying network flows, focusing on the interrelationships between features. By utilizing multi-head self-attention layers, they aimed to enhance the parsing and classification of features. Zhou et al. [32] proposed a novel self-supervised attention generative adversarial image painting method based on a transformer, utilizing the self-attention strategy of the transformer to capture global semantic data and established a self-supervised attention module within the transformer to overcome the limitations of convolutional operations. These methods require a large number of samples for model training, making it difficult to deal with new types of network intrusions with smaller samples.

2.3 Few-shot network intrusion

Although deep learning methods combined with network intrusion detection possess strong feature extraction capabilities and perform well in most environments, they rely on large amounts of data. In reality, newly emerging network traffic data to be classified are often scarce, representing few-shot conditions. Therefore, effectively detecting intrusion traffic under few-shot conditions remains an urgent problem to be addressed. To tackle this challenge, the field of network intrusion detection is leveraging mature few-shot methods from other domains, such as meta-learning, transfer learning, and data augmentation and generation techniques. For instance, Xu et al. [33] designed FC-Net, a deep neural network that learns feature maps from raw traffic data to classify new traffic types with few samples. Similarly, Lu et al. [9] introduced a MAML-based method for IoT environments, enabling rapid adaptation to new intrusion types using a Convolutional Neural Network (CNN). Mahdavi et al. [34] developed the ITL-IDS framework, which employs transfer learning and incremental clustering to efficiently detect intrusions with limited data. Additionally, He et al. [35] combined Generative Adversarial Networks (GAN) with meta-learning to enhance few-shot attack sample augmentation and improve detection performance. Focusing on IoT, Yan et al. [36] proposed the GDE Model, which transforms one-dimensional traffic data into two-dimensional images, achieving high accuracy and fast inference. In another approach, Sun [37] utilized attention mechanisms and prototype capsule networks to enhance feature extraction and classification for few-shot intrusion detection. Yan et al. [38] presented a model that integrates an improved GAN and multi-head attention mechanisms to boost detection accuracy and real-time performance. Meanwhile, Tong et al. [39] developed IResTAE2A, a method combining self-supervised and supervised learning with efficient channel attention to better extract hidden information from normal traffic without labeled data. Wang et al. [40] introduced BT-TPF, a lightweight model that uses a Siamese network for feature reduction and knowledge distillation from a Vision Transformer to a smaller Poolformer model, maintaining high accuracy with fewer parameters. Overall, these studies highlight significant progress in few-shot network intrusion detection through the integration of meta-learning, transfer learning, and attention mechanisms. Building on these advancements, this paper proposes a novel few-shot network intrusion detection method based on self-attention and multiple updates, leveraging the self-attention mechanism’s ability to capture long-distance dependencies and facilitate rapid model optimization.

3.1 Data preprocessing

The method uses the raw network traffic provided by the CIC, including CSV files and raw traffic PCAP packets. The CSV files contain the source IP, source port, destination IP, destination port, and classification labels of the data flows. Labels corresponding to each data flow in the PCAP packets are attached based on the CSV files, and original IPs are replaced with randomly generated IPs. The data is further processed using the data preprocessing method of Xu et al. [33]. Specifically, original IPs are replaced with randomly generated IPs for anonymization, then the first 256 bytes of the first 16 packets of each data flow are extracted. The extracted data is divided into training and testing sets by task, and further divided into support sets and query sets based on the concept of meta-learning.

3.2 Gradient adaptive attention model

The self-attention mechanism can extract features with high relevance from global information by calculating the degree of correlation between network traffic, while information with lower relevance is weakened. Unlike traditional machine learning, this model does not learn the features of a specific target sample but is based on the task to learn how to acquire the capability to learn new tasks. Specifically, data is divided by task. In the training phase, existing tasks are learned first, and then on this basis, tasks that have never been seen before are learned, increasing their generalization ability. Finally, through multiple training sessions, a model with a good set of initial parameters is obtained, which can quickly adapt to new tasks in a few-shot manner.

Fig 1 shows the framework of the model, and the right half shows its core structure. After preprocessing the data, each sample data x₁x₂…x₁₆ in the input task is vector-embedded in the learnable vector embedding layer to be transformed into x₀x₁…x₁₆. This implies that a learnable embedding vector is inserted at the beginning of each data stream. This embedding vector can automatically learn the features of the original traffic through a self-attention mechanism during the model training phase and serve as the basis for classifier classification.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 1. The training, testing and the internal structure of the model.

https://doi.org/10.1371/journal.pone.0317713.g001

The sequential relationship between each flow is also significant in the network. To represent the sequence among the flows, positional encoding using sine and cosine functions was applied in the position embedding layer to the input vectors x₁x₂…x₁₆ to add positional information. The input data become mathematical representation is shown in Eq (1). (1) where p represents p^th the flow of the 16 flows, d represents the dimensions of each flow (256 bytes), and i represents the i^th byte of a single flow. The term was used to allow the model to better capture positional information when processing flows. It is important to note that current common encoding methods also include Learned Positional Encoding [11] and Relative Positional Encoding [42], among others. In contrast, sinusoidal positional encoding does not require additional parameters and is straightforward to implement, thereby maintaining the model’s simplicity and training efficiency.

The training process of the model is shown in the left half of Fig 1, where the internal detailed structure of the gradient adaptive attention model is on the right side. During the entire training phase, the first multi-head self-attention encoder is trained in the inner loop, then its weight parameters are passed to the multi-head self-attention encoder in the outer loop for training, and finally, the model is fine-tuned on the test set to obtain the final target detection model.

In the encoding layer, to make the model converge quickly, the data is first normalized and then fed into the multi-head self-attention module. The multi-head self-attention module splits a sample and performs multiple self-attention operations in different spaces in parallel. This module not only learns the features of the traffic in different spaces but also reduces the training time of the model.

The self-attention operation generates three vectors, Q, K, V for each input vector through a linear transformation. It calculates the relevance between every pair of input vectors using the Q and K vectors, performs layer normalization, and finally conducts a residual connection with the V vector, enhancing the feature transmission capability. The self-attention mechanism can effectively learn the relational features of traffic. The specific operation process is shown in Eq (2). (2) where Q represents the specified traffic information, K represents the traffic to be matched, and the relevance of each traffic flow is obtained through dot-product operations. V represents the original information of the specified traffic.

Multi-head self-attention calculates self-attention in different subspaces independently and in parallel by dividing the input vector into different “heads.” Each head calculates self-attention, and after completion, all results are concatenated to form the self-attention matrix and multiplied by a weight matrix W₀ to obtain the final self-attention. Different heads focus on various types of information, which can effectively prevent the problem of attention from being too concentrated. Specific details are given in Eq (3). (3) where a₁ represents the self-attention matrix of the first head, and W₀ is the corresponding weight matrix generated by a linear transformation. After passing through the multi-head self-attention module, it undergoes layer normalization and is fed into a feed-forward neural network. Finally, it undergoes residual connection and output, learning more features in the traffic.

The output of the multiple encoding layers is fed into the classification layer, which uses normalization, linear transformation, and a sigmoid function to map features to the prediction probabilities of the two categories. The results were classified as normal and attack traffic based on the predicted probabilities. Subsequently, the Adam gradient descent algorithm and backpropagation are used to update the weight parameters of the model.

Based on the training process shown in Fig 1, a specific training algorithm can be designed, as shown in Algorithm 1, with the following key processes:

Algorithm 1 Iterative Refinement Intrusion Detection Training Algorithm

Input: τ_n: Distribution of intrusion detection tasks

Output: α,β: Learning rate

Require: update:Number of updates

1 Random initialization of θ

2 for all epoch do

3  Randomly select a batch of tasks τ_i ∈ τ_n

4  for all τ_i do

5   Support set D_s containing K samples from

6   Compute the gradient based on K samples and the loss function

7   Compute the adaptive parameter for gradient descent:

8   θ′ = θ − α∇_θ

9   Update self-attention weights based on adaptive parameters

10   

11   Query set D_q containing k′ samples from

12   Calculate the loss of the model after parameter updates

13   for j = 1 to update do

14    Compute the gradient based on K samples and the loss function

15    Compute the adaptive parameter for gradient descent:

16    θ′ = θ′ − α

17    Update self-attention weights based on adaptive parameters

18    

19    Query set D_q containing k′ samples from

20    Calculate the loss of the model after parameter updates

21   end

22  end

23  Compute the gradient based on the total loss of the query set from τ_i and the loss function

24  Update θ ← θ − β∇_θ

25 end

A batch of tasks τ_i is randomly drawn from τ_n, including a training support set and a training query set for model training. The model is pre-trained using the training support set, the loss on the support set is calculated using the cross-entropy loss function, and the model’s weight parameters are updated through Adam gradient descent and backpropagation, obtaining the first updated parameters θ′. Subsequently, the loss is calculated for the multi-head self-attention encoder with the updated parameters using the query set. The formula for calculating the loss function is given in Eq (4): (4)

The weight parameters were updated through multiple cycles, repeating steps 5~10 to capture more target task feature information through multiple update cycles and improve the adaptability of the model. Notably, the tasks performed in each cycle differed. Based on the aforementioned weight parameters, the model’s weight parameters were updated using the training query set, aiming to train the model’s ability to learn new tasks, specifically using the loss calculated on the query set to update the weight parameters of the multi-head self-attention encoder for the second time. The initial weight parameters of the multi-head self-attention encoder in the outer loop are the weight parameters of the multi-head self-attention encoder trained in the inner loop. The complete training process can be expressed with Eq (5): (5) where represents the likelihood probability of the model in the support set within the inner loop multi-head self-attention encoder, by continuously updating the parameters θ′, updating the posterior of the inner loop multi-head self-attention encoder, and finally making act as the prior of the outer loop multi-head self-attention encoder on the query set .

4.1 Dataset

To comprehensively evaluate the effectiveness of our proposed few-shot network intrusion detection method, this study selected the widely recognized CICIDS2017 and CICIDS2018 public datasets in the field of cybersecurity. The total volume of the pcap dataset reached 452 GB, including 48.8 GB from CICIDS2017 and 403.2 GB from CICIDS2018. This dataset encompasses a diverse range of attack types, ensuring strong generalizability. As shown in Table 1, these datasets contain a large amount of real intrusion traffic. We selected 1000 samples from each attack type. This can effectively cover the variability and complexity of attack behaviors, helping the model to learn richer and more detailed content, thus improving accuracy and generalization capabilities [43] without causing excessive consumption of computational resources due to large data volumes.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 1. Attack types distribution in CICIDS2017 and CICIDS2018 datasets.

https://doi.org/10.1371/journal.pone.0317713.t001

4.2 Evaluation metrics

We used commonly accepted evaluation metrics to compare the proposed method with related methods. Five metrics were used: Accuracy, Detection Rate, Precision Rate, F1-Score, and Specificity, as shown in Eq (6). These metrics are calculated based on the confusion matrix components: True Positives (TP), True Negatives (TN), False Positives (FP), and False Negatives (FN). (6)

4.3 Hyperparameter settings

This study focused on analyzing the hyperparameters that significantly affect model performance, including the number of attention heads and feed-forward neural network dimensions (FFD). To determine the optimal hyperparameter configuration, we designed a series of experiments to evaluate the changes in model performance by varying the values of these parameters. The accuracy was used as the evaluation metric, and the experimental results are shown in Fig 2, from which we can observe the impact of different hyperparameter configurations on the model accuracy.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 2. The accuracies of the models in different hyperparameter settings.

https://doi.org/10.1371/journal.pone.0317713.g002

Fig 2 shows that increasing the number of attention heads and FFD generally led to an upward trend in accuracy. The best performance was achieved with four layers and the FFD of 256, with accuracies of 99.98% and 98.70%, respectively. Although increasing the number could increase the accuracy further, this would make the training more time-consuming. Thus, considering the balance of various factors, the hyperparameters listed in Table 2 were chosen for subsequent experiments.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 2. Hyperparameter settings.

https://doi.org/10.1371/journal.pone.0317713.t002

4.4 Experimental setup

The software and hardware environment for the experiments in this study were as follows: The CPU used was an Intel(R) Xeon(R) Platinum 8358C CPU @ 2.60GHz, and the GPU was an RTX A5000 (24 GB). The operating system used was Ubuntu 20.04, Python version 3.8, and the deep learning framework was PyTorch 1.10.0. The GPU acceleration library was CUDA 11.3, with a memory size of 128 GB.

To quantify the impact of training rounds and sample size on detection performance, the experiments were divided into three groups: Group A, to explore the impact of training rounds, and Group B, to explore the impact of sample quantity. Additionally, Group C evaluated inference time, parameter size, and the effects of iterative refinement on performance.

Group A: To ensure that the model converges properly and delve deeper into the impact of training rounds on performance metrics, we averaged the metrics for all available attack types in CICIDS2017 and CICIDS2018. The accuracies and detection rates were then plotted using trend lines to reflect the overall change trend of the model and show the evolution of the overall model performance. In addition, we evaluated the performance of the method on two datasets using the F1-Score.

Group B: To explore the impact of varying sample sizes on model performance, the following experiment was designed with training and testing conducted on the CICIDS2017 and CICIDS2018 datasets, using sample sizes of 1, 3, 5, and 10. These experiments were aimed at simulating a novel attack scenario. Thus, we selected attack types that were previously unseen by the models as the test set. The generalizability of the model was systematically evaluated using multiple datasets and different metrics. Moreover, we explored the dependence of this method on the number of samples compared to traditional methods.

Group C: To investigate the model’s inference time and parameter count, and to analyze the impact of the number of iterative refinement cycles on accuracy and runtime, we designed the following experiments. For a fair comparison on the CICIDS2018 dataset, our method utilized 10 samples, whereas other methods employed 100 samples to ensure that the comparative methods could leverage more data to optimize their performance. We examined the effect of varying the number of iterations on model performance. Additionally, we compared our method with several commonly used approaches in terms of parameter count and accuracy, and evaluated the model’s inference time to comprehensively assess the efficiency and practicality of the proposed method.

4.5 Detection results

Group A: As shown in Figs 3 and 4, within the first 25 epochs, the Accuracy of CICIDS2017 and CICIDS2018 rapidly increased, stabilizing from 25 to 40, with most of the accuracy and detection rates in this range falling between 0.9 and 1.0. This indicates that the model requires only a few training cycles to converge, with subsequent cycles having little impact on performance improvement. As shown in Table 3, the F1-Score metrics can reach 77.03% and 80.03%, respectively, with only two epochs; compared to one epoch, they increase by 35.28% and 31.59%, respectively. With only 10 epochs, they reached 92.72% and 96.69%, respectively, with increases of 19.56% and 20.82%, respectively, compared to two epochs.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 3. The accuracy in different datasets.

https://doi.org/10.1371/journal.pone.0317713.g003

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 4. The detection rates in different datasets.

https://doi.org/10.1371/journal.pone.0317713.g004

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 3. Relationship between F1-Score and epoch.

https://doi.org/10.1371/journal.pone.0317713.t003

Group B: As presented in Tables 4 and 5, for K = 1, 3, 5, and 10, the model performed excellently under few-shot scenarios for both the CICIDS2017 and CICIDS2018 datasets. For the CICIDS2017 dataset with only one sample, the accuracy reached 95.52% and the detection rate was 96.74%. Even with a smaller number of samples, the model maintained high detection performance. In the CICIDS2018 dataset, despite the small number of samples, the model achieves high accuracy and detection rates, especially in the cases of K = 5 and K = 10, where the accuracy exceeded 96%. As shown in Fig 5, the left side of the image displays the relationship between the model accuracy and sample size in the few-shot domain. In contrast, the right-hand side displays the relationship for traditional intrusion detection models, such as MLP, ANN, and CNN. Traditional models require a larger number of samples for better experimental results; however, obtaining a sufficient number of samples is difficult for network intrusion detection. The ANN model needs 1000 samples to achieve the same accuracy, whereas the proposed model required only three samples. In the few-shot scenario, we developed the MAML + CNN model and found that it fluctuates more in ordinary few-shot environments. Under the same sample conditions, our proposed model can achieve higher accuracy. This further demonstrates that our model requires fewer samples and exhibits higher stability.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 5. Accuracy of different models in the CICIDS2017 dataset.

https://doi.org/10.1371/journal.pone.0317713.g005

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 4. The results in the CICIDS2017 dataset.

https://doi.org/10.1371/journal.pone.0317713.t004

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 5. The results in the CICIDS2018 dataset.

https://doi.org/10.1371/journal.pone.0317713.t005

Group C: As illustrated in Fig 6, the model’s accuracy continuously improved with an increasing number of iterative refinement cycles. This enhancement was attributed to each iteration’s ability to more effectively utilize the limited sample data, thereby enabling more comprehensive feature extraction. However, each iteration required an additional complete forward and backward propagation, resulting in an increase in inference time. Additionally, during the fine-tuning phase, multiple independent parameter copies needed to be maintained. Although this did not affect the main model parameters, it did lead to increased memory consumption and computational overhead. Fig 7 demonstrates that the proposed method had a parameter size of 8.70 MB and a total memory footprint of 21.75 MB, which was slightly higher than that of other common methods. Nevertheless, in a few-shot environment, the accuracy of the proposed method significantly outperformed that of the other methods. Specifically, iterative refinement increased the computation time per iteration by approximately 1.9 ms, resulting in a total inference time of 15.71 ms. However, the accuracy improved by 52.5%. Although the parameter size increased by several times compared to other methods, the accuracy correspondingly increased by approximately 30%, reaching 98.75%. This additional computational cost was justified by achieving more effective detection under few-shot conditions, thereby offering greater advantages in resource-constrained real-world applications. Moreover, the increases in time and parameter size were not substantial and remained within acceptable limits. Therefore, the proposed method maintained high practicality and efficiency while enhancing detection performance.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 6. Model accuracy and size comparison.

https://doi.org/10.1371/journal.pone.0317713.g006

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 7. Accuracy and inference time across iteration steps.

https://doi.org/10.1371/journal.pone.0317713.g007

From three groups of experiments, we can draw three conclusions:

1. (1) Our method converges quickly, allowing for the selection of fewer training rounds to maintain high accuracy and detection rates while improving model efficiency.
2. (2) In few-shot scenarios, this method performs excellently on both CICIDS2017 and CICIDS2018 datasets and demonstrates outstanding generalization ability.
3. (3) Our method strikes a balance between computational overhead and accuracy, ensuring that the modest increases in inference time and memory usage are appropriately offset by substantial improvements in detection performance.

5.1 Comparison with related work

The proposed few-shot network intrusion detection method based on self-attention can swiftly adapt to new tasks. It can handle various network situations and is suitable for different access methods, thereby offering significant practical value. Given the lack of extensive applications of few-shot network intrusion detection methods, relatively few options are available for comparison.

In this study, we conducted a comparative analysis of our method and recent few-shot network intrusion detection methods to validate the exceptional performance of our proposed method. Table 6 provides a comparison with other research findings encompassing the datasets used, sample sizes, accuracy of the experimental results, and detection rates. These two metrics were used to evaluate the efficacy of the proposed method.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 6. Comparison of detection results and the number of samples in the proposed method and related research works.

https://doi.org/10.1371/journal.pone.0317713.t006

We summarized and compared recent studies utilizing the CICIDS2017 and CICIDS2018 dataset using ACC and DR as evaluation metrics. It is worth noting a continual few-shot learning method using meta-learning for intrusion detection [44] and a few-shot network intrusion detection method based on MAML with L2F [47], both of which are based on meta-learning approaches. The experimental results presented in Table 6 highlight the impressive performance of the proposed method. Notably, FE-MTDM [50] utilized just 1% of the CICIDS2017 dataset, while GDE [36], FE-MTDM [50], and Graph2vec+RF [51] represent the total number of samples used for training. In contrast, the sample sizes for the other methods reflect the number of training samples per class. Additionally, FSIDS-IOT [9] is a hybrid dataset that comprises a mix of five data types drawn from both the CICIDS2017 and CICIDS2018 datasets.

The ACC for the CICIDS2017 dataset was as high as 99.69%, whereas the ACC for the CICIDS2018 dataset reached a maximum of 98.75%. Compared with a few-shot network intrusion detection method based on MAML with L2F (97.92%) and a method with Res-Natural GAN (95.52%), our method exhibited improvements of 0.83% and 3.23%, respectively. Although methods for early and accurate network intrusion detection using graph-embedding technology perform better, they require a significant number of samples for support. By contrast, our method effectively reduces the number of training tasks and can adeptly learn new knowledge from a small number of samples, aiding in the simultaneous detection of previous attack types. Consequently, it achieves higher accuracy and detection rates.

5.2 Minimal few-shot

From Tables 4 and 5, it can be observed that in the CICIDS2017 dataset, as the number of samples increased from 1 to 5, all performance metrics of the model exhibited a significant upward trend. This indicates that the model maintained good robustness and stability even with a small sample size. In contrast, in the CICIDS2018 dataset, when the number of samples was 3, the detection rate and specificity were slightly lower than when the number of samples was 1. However, upon increasing the number of samples to 5, the performance metrics showed significant improvement. This fluctuation may be attributed to the inherent complexity of the dataset or the model’s insufficient generalization ability under extremely small sample sizes.

These results also highlight the stability issues of the proposed method under extremely small sample conditions (k = 1, 3), as certain classes within the dataset were difficult to adequately learn with limited samples, resulting in decreased performance when the number of samples increased. In this regard, we discuss the following: Compared to CICIDS2017, CICIDS2018 may encompass more diverse and complex attack types, making it challenging for the model to capture all class features under small sample conditions. Although the self-attention mechanism and iterative refinement strategy performed excellently when k = 5 and k = 10, the task became considerably more difficult under extremely small sample conditions (k = 1, 3). Therefore, the model may require further regularization or data augmentation techniques to enhance its generalization capability.

5.3 Position embedding

Although this study employed the classical sinusoidal positional encoding, demonstrating advantages in model simplicity and training efficiency, this approach still has certain limitations. Firstly, sinusoidal positional encoding generates positional representations based on fixed functional forms, lacking flexibility tailored to specific application scenarios. When handling tasks such as network traffic analysis, which exhibit highly dynamic and unstable characteristics, fixed positional encoding may fail to effectively capture the complex variation patterns of the traffic, resulting in suboptimal model performance in response to different traffic dynamics. Additionally, sinusoidal positional encoding cannot dynamically adjust positional representations in real-time based on traffic changes, limiting the model’s adaptability in real-time traffic prediction and anomaly detection. Given that network traffic often displays bursty and nonlinear features, the fixed sinusoidal encoding struggles to adequately reflect these variations, potentially affecting the model’s prediction accuracy and robustness. Therefore, future research could explore the development of more adaptive positional encoding methods optimized for dynamic traffic characteristics, thereby enhancing the model’s performance in complex and fluctuating network environments.

6.1 Data imbalance

In practical applications, class distribution imbalance or skewness is a common and challenging issue. Our study primarily focused on detection with a limited number of samples and did not specifically address the problem of data imbalance. However, to some extent, our method was able to extract more discriminative features under constrained data conditions, thereby enhancing the model’s detection performance and mitigating the effects of class distribution imbalance [53]. Nevertheless, it remained unable to fully resolve issues related to class imbalance or skewness. To overcome this limitation, future research could consider incorporating more advanced balancing techniques, such as data augmentation, resampling strategies, or specially designed loss functions, to enhance the model’s robustness and generalization capabilities in imbalanced class environments while maintaining high model efficiency.

6.2 Real-time processing

The self-attention mechanism employed in this study demonstrated excellent performance in capturing sequential dependencies. However, its high computational complexity posed significant challenges for large-scale real-time processing. In future work, we plan to explore lightweight self-attention models and distributed computing methods to improve the model’s computational efficiency and processing speed without significantly compromising detection performance. This would enable the efficient handling of large-scale real-time data, making the model more applicable to real-world scenarios that require rapid and scalable processing.

6.3 Scalability

The iterative refinement strategy utilized in this research may encounter substantial scalability challenges as task complexity increases or the number of classes grows. This issue is not unique to our method. In fact, most existing algorithms face difficulties under similar circumstances. Consequently, scalability research has become a crucial direction, particularly for fine-grained classification, to alleviate scalability concerns. Future work should focus on developing more efficient optimization algorithms and fine-grained classification methods to enhance the scalability of iterative refinement strategies in complex tasks. This would provide new insights and solutions for addressing scalability problems, thereby improving the applicability and effectiveness of the proposed method in more diverse and demanding environments.