3.1 Sample definition

To enable deep learning models to effectively handle few-shot network intrusion detection tasks, raw network traffic must first be transformed into a standardized input format. As illustrated in Fig 1, the preprocessing pipeline consists of three key steps: flow splitting, packet parsing, and cropping & padding.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 1. Illustration of converting network traffic into sample matrices.

https://doi.org/10.1371/journal.pone.0327161.g001

(1) Flow Splitting. Raw network traffic is typically captured in formats such as PCAP files or live packet captures, where each packet contains header and payload information. In this step, the captured traffic is split into independent flows based on five-tuple attributes: source IP address, source port, destination IP address, destination port, and protocol. Each resulting flow corresponds to a session with shared communication characteristics, facilitating subsequent analysis.

(2) Packet Parsing. For each flow, packet contents are extracted, including headers and payloads. To prevent information leakage, IP addresses are masked to eliminate potential class-related identifiers. Other header fields are retained to preserve behavioral features relevant to network activity.

(3) Cropping and Padding. Since flows and packets vary significantly in length, payload data is normalized to a fixed size to satisfy neural network input constraints. Specifically, two parameters are defined:

• : Maximum number of packets per flow
• : Fixed number of bytes per packet

If a flow contains more than packets, only the first are retained. Otherwise, zero-padding is applied. Similarly, each packet’s payload is cropped or padded to length .

After processing, each network flow is converted into a two-dimensional traffic matrix, where the height corresponds to the number of packets (), and the width corresponds to the payload length (). Each row represents the byte-level content of one packet. This matrix formulation transforms the temporal structure of network traffic into a spatial representation, from which both spatial and implicit temporal features can be extracted by subsequent modules.

3.2 Task formulation

Traditional intrusion detection models based on deep learning require extensive labeled datasets to achieve good generalization. However, in practical environments, data labeling is costly, attack samples are sparse, and privacy constraints often hinder dataset construction. To address these challenges, we define intrusion detection as a few-shot classification problem, where each task consists of a support set and a query set.

Each task follows an N-way K-shot protocol: the support set contains K labeled samples from each of N classes, while the query set includes unlabeled samples that must be classified using information from the support set.

Formally, a few-shot task is composed of:

(1) Support set: , where x_i is a preprocessed traffic sample, and is the corresponding label. There are N classes with K samples per class.

(2) Query set: , where x_j denotes the unlabeled traffic samples to be classified, and N_Q is the number of query samples.

The objective is to learn a task-specific classifier that predicts the class of a query sample x_q using the support set S:

(1)

As shown in Fig 2, the few-shot intrusion detection task simulates a realistic scenario in which only limited labeled samples are available for a new or rare attack type. The model must learn to adapt and perform accurate classification using minimal supervision, thus improving generalization under few-shot conditions.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 2. Few-shot task formulation in intrusion detection.

https://doi.org/10.1371/journal.pone.0327161.g002

3.3 Overall framework

To address the challenges of few-shot learning in network intrusion detection, we propose a framework that integrates multi-domain feature modeling and a bidirectional cross-attention mechanism. As illustrated in Fig 3, the proposed method consists of five modules: preprocessing, frequency domain transformation, feature encoding, feature matching, and feature fusion with classification.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 3. Overall architecture of the proposed few-shot intrusion detection method.

https://doi.org/10.1371/journal.pone.0327161.g003

(1) Preprocessing. Each detection task contains a support set and a query set. All samples are first normalized to ensure consistent input distributions across the model. This preprocessing step standardizes the inputs, laying the foundation for reliable feature extraction and comparison.

(2) Frequency Domain Transformation. Normalized traffic samples are further transformed into the frequency domain using the two-dimensional discrete cosine transform. This operation effectively decomposes the spectral components of network traffic, exposing differences between normal and attack patterns in the frequency domain. After this step, each sample has both spatial and frequency representations, which are used in subsequent modules for joint modeling.

(3) Feature Encoding. Two independent encoders are used to extract features from the spatial and frequency domains. The spatial encoder (S-Encoder) processes the original traffic matrix and produces a spatial feature map (S-Map), while the frequency encoder (F-Encoder) operates on the DCT-transformed input and outputs a frequency feature map (F-Map). Both encoders share the same architecture to ensure consistency, and the support/query sets are processed through shared weights.

(4) Feature Matching. To compare support and query features, we employ a bidirectional cross-attention mechanism in both the spatial and frequency domains. The spatial cross-attention module computes attention between support and query samples in the spatial feature space, generating the spatial comparison features (S-Feat). Similarly, the frequency cross-attention module computes attention in the frequency space, yielding the frequency comparison features (F-Feat). These mechanisms enhance fine-grained alignment across samples.

(5) Feature Fusion and Classification. The resulting S-Feat and F-Feat are fused via an attention-based fusion module, which adaptively integrates multi-domain features. The fused representation is then passed to the classification module (CLS), implemented as a multi-layer perceptron (MLP), to perform final intrusion classification and output predicted labels.

The proposed framework fully leverages spatial, temporal, and frequency-domain features of network traffic. By incorporating bidirectional cross-domain attention, it enhances the mutual alignment between support and query sets, improving detection performance under few-shot conditions.

3.4 Frequency domain transformation

In network intrusion detection, traffic samples contain not only spatial and temporal patterns but also critical information in the frequency domain. To exploit such frequency-domain features, we apply the two-dimensional discrete cosine transform (2D-DCT) to map traffic samples from the spatial domain into the frequency domain, thereby enabling the extraction of more discriminative representations.

Given a traffic sample represented as a grayscale image of size , where x(i,j) denotes the signal intensity at position (i,j), the 2D-DCT is mathematically defined as:

(2)

where F(u,v) is the DCT coefficient at frequency indices (u,v), representing the energy distribution in the frequency domain. The normalization factors and are defined as:

(3)

The resulting frequency spectrum reveals the energy composition across different frequency bands. Low-frequency components (i.e., small u and v) capture the global structure and background trends of network traffic, while high-frequency components (i.e., large u and v) represent rapid changes, fine-grained variations, or noise—often crucial for identifying subtle or stealthy attacks.

To illustrate the invertibility of DCT, the inverse discrete cosine transform (IDCT) can be used to reconstruct the original input:

(4)

This property indicates that DCT preserves essential information while emphasizing the frequency structure. In our detection framework, only the forward DCT is applied during training and inference to enhance feature separability, while IDCT is useful for visualizing or analyzing traffic in the spatial domain when necessary.

By transforming network traffic into the frequency domain, we introduce a complementary perspective to traditional spatial modeling. The frequency domain representation enhances the ability to distinguish between benign and malicious traffic, especially in cases where spatial features alone are insufficient.

3.5 Feature encoding

To extract expressive representations from both spatial and frequency-domain traffic samples, we design a feature encoding module based on an improved Mamba architecture, as shown in Fig 4. This module includes two structurally identical yet input-specific encoders: the spatial encoder (S-Encoder) and the frequency encoder (F-Encoder). The S-Encoder directly processes raw traffic matrices, while the F-Encoder operates on DCT-transformed frequency-domain inputs. Although their inputs differ in domain, both branches share the same network structure to ensure consistency in representational capacity.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 4. Architecture of the feature encoding module based on Mamba.

https://doi.org/10.1371/journal.pone.0327161.g004

The overall module comprises four main stages: stride-based partitioning, downsampling, Mamba-based feature extraction, and feature concatenation.

(1) Stride-Based Partitioning. Traffic samples, represented as 2D matrices, are first partitioned into fixed-length sequences using a sliding window with predefined stride. This conversion prepares the data for sequential processing and helps extract localized correlations across the input.

(2) Downsampling. To reduce the input sequence length and computational cost, each segment undergoes a combination of layer normalization (LN) and one-dimensional convolution (Conv1D). LN stabilizes the training process by normalizing feature distributions, while Conv1D captures local dependencies and reduces dimensionality.

(3) Mamba-Based Feature Extraction. The core of the encoding module is a Mamba block that integrates both nonlinear projection and state space modeling [36]. The Mamba block includes the following key steps:

1. Normalization and Dual-Channel Projection: The input is first normalized, followed by two independent linear projections with nonlinear activation functions.
2. State Space Modeling (SSM): One branch further processes the features through Conv1D and a continuous-time state space model, described by the following ordinary differential equations (ODEs):(5)
   where is the hidden state, u(t) is the input, and y(t) is the output. are trainable parameters of appropriate dimensions.
3. Discretization: The continuous model is discretized as:(6)
   with transition matrices:(7)
   For simplicity and efficiency, our implementation omits the direct feedthrough term Du_k and uses the reduced form:(8)
4. Nonlinear Activation and Fusion: A GeLU activation function [37] is applied to y_k to introduce nonlinearity:(9)
   This output is then element-wise multiplied with the projection result from the other channel, and fused through a final linear layer to generate the encoded feature.

(4) Feature Concatenation. To capture multi-scale semantics, we stack multiple Mamba blocks, interleaved with downsampling operations. The feature dimensionality progressively increases across layers (64 128 192 256). Finally, all intermediate representations are concatenated to form the final hierarchical feature vector.

To enhance feature representation capability, the proposed encoding module integrates an improved Mamba-based architecture with a hierarchical feature extraction strategy, enabling deep modeling of both spatial and frequency domain information. Compared with conventional CNN or Transformer architectures, our module introduces three major innovations:

First, the stride-based partitioning mechanism divides the input traffic matrix into temporal sub-sequences using a sliding window. This allows the model to capture fine-grained local dependencies at early stages, which is especially useful for modeling subtle variations between network packets.

Second, the multi-layered Mamba blocks with downsampling gradually reduce sequence length and expand feature dimensionality. This hierarchical structure enables the model to progressively extract high-level semantic patterns from local to global scales. Thanks to the state space modeling capability of Mamba, the module effectively captures long-range dependencies even in long and noisy traffic sequences, which is an area where self-attention mechanisms typically face scalability and generalization challenges.

Third, the dual-branch encoder structure (S-Encoder and F-Encoder) processes spatial and frequency domain inputs independently using the same architecture. This enables the model to extract complementary representations: spatial features capture structural behavior in packet sequences, while frequency features emphasize periodicity, burst patterns, and other spectral characteristics that may be difficult to detect in the spatial domain alone.

As a result, the enhanced encoding module not only achieves comprehensive modeling of short-term and long-term patterns but also provides robust, domain-aware feature representations that significantly improve support-query alignment in downstream cross-attention-based matching and classification.

3.6 Feature matching

To enable accurate comparison between support and query samples, we design a bidirectional cross-attention mechanism that operates in both spatial and frequency domains. The feature matching module consists of two main components: a Transformer-based intra-feature encoder and a dual-domain bidirectional cross-attention module, as illustrated in Fig 5.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 5. Architecture of the feature matching module with cross-attention.

https://doi.org/10.1371/journal.pone.0327161.g005

1) Transformer-Based Feature Refinement. Before performing cross-attention, we apply Transformer layers to refine individual features and capture long-range dependencies within each sample. The input features from the support and query sets, denoted as , are first embedded into tokens:

(10)

The multi-head self-attention (MHSA) mechanism computes the internal relationships among tokens by projecting them into queries (Q), keys (K), and values (V):

(11)

The attention weights and output are computed as:

(12)

The outputs from all heads are concatenated and linearly projected:

(13)

This is followed by a feed-forward network (FFN) with GELU activation:

(14)

2) Bidirectional Cross-Attention Mechanism. After feature refinement, we compute bidirectional cross-attention between support and query sets in both domains. For spatial cross-attention, the support feature F_s and query feature F_q are first linearly projected to form the respective queries, keys, and values:

(15)

(16)

We then compute two directions of attention:

(17)

The final spatial comparison feature is obtained by weighted fusion:

(18)

where is a learnable parameter that controls the contribution of each direction.

3) Frequency Domain Cross-Attention. The frequency-domain comparison is performed using the same structure as above. Let and denote the support and query features in the frequency domain. After linear projection, we compute bidirectional attention:

(19)

Then the fused frequency-domain comparison feature is:

(20)

The dual-domain attention mechanisms enhance the matching robustness and enable the model to align task-specific semantics between support and query sets from multiple perspectives.

3.7 Feature fusion and classification

To fully leverage the complementary advantages of spatial and frequency domain comparison features, we introduce an attention-based fusion mechanism that adaptively integrates information from both domains. This enhances the discriminative power of the model under few-shot conditions by allowing it to focus on the most informative aspects of the traffic representation.

Let and denote the feature representations obtained from the bidirectional cross-attention modules in the spatial and frequency domains, respectively. Given that both features originate from the same input data and are aligned in dimensionality, we concatenate them along the token axis:

(21)

Next, we apply a Transformer encoder to perform self-attention across the concatenated tokens. This allows the model to explore interactions between spatial and frequency features and learn global dependencies:

(22)

Through this attention mechanism, the model adaptively weighs spatial and frequency-domain cues and learns an integrated representation that highlights the most salient features for each task.

Classification Module. The fused representation is then fed into a classification module, implemented as a multi-layer perceptron (MLP), to perform the final intrusion prediction. The classification function is defined as:

(23)

The MLP consists of several fully connected layers with nonlinear activations, such as ReLU or GeLU, to capture complex decision boundaries. The final Softmax layer outputs the probability distribution over N classes, enabling the prediction of the query sample’s class label.

By combining spatial and frequency domain features through attention-based fusion, and performing final prediction using a deep nonlinear classifier, the proposed module effectively improves detection accuracy in few-shot scenarios. It captures not only local and domain-specific patterns but also their joint contributions, thereby enhancing robustness and generalization across tasks.

4.1 Datasets

To evaluate the adaptability and effectiveness of the proposed few-shot intrusion detection method under various real-world conditions, we conduct experiments on two representative benchmark datasets: CICIDS2017 and CICIDS2018. Both datasets were released by the Canadian Institute for Cybersecurity (CIC) and are widely used in intrusion detection research. They simulate realistic network environments and cover a broad range of benign and malicious traffic types [38].

For experimental consistency, we select a subset of attack types from each dataset that contain a sufficient number of samples to construct few-shot tasks. The selected attacks span various intrusion categories, such as Denial-of-Service (DoS), Distributed Denial-of-Service (DDoS), brute-force login attempts, port scanning, and botnet communication. These attack types are commonly encountered in real-world security scenarios and pose diverse detection challenges.

Each few-shot detection task is organized following the N-way K-shot protocol. That is, N different classes (including both benign and attack types) are sampled per task, and each class in the support set contains K labeled instances. The query set contains unseen instances from the same N classes, which must be classified using information from the support set. This setup closely mimics realistic conditions where labeled attack data are limited and imbalanced.

Table 1 summarizes the attack types used in our experiments along with brief descriptions of their characteristics.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 1. Attack types and descriptions in CICIDS datasets.

https://doi.org/10.1371/journal.pone.0327161.t001

4.2 Evaluation metrics

To comprehensively evaluate the performance of the proposed few-shot network intrusion detection method, we adopt five commonly used evaluation metrics: accuracy (ACC), detection rate (DR), precision, false positive rate (FPR), and F-measure (F1-score). These metrics reflect the model’s capability to distinguish between normal and malicious traffic from different perspectives, and collectively assess its practical utility and robustness.

Accuracy measures the overall classification correctness of the model. Detection rate reflects the model’s ability to successfully identify attack samples. Precision describes the proportion of correctly identified attack samples among all samples predicted as attacks. False positive rate measures the proportion of normal traffic misclassified as attacks. F-measure provides a trade-off evaluation between detection rate and precision, especially useful in imbalanced data scenarios.

Let the confusion matrix components be defined as follows:

• TP: the number of true positives (i.e., attack samples correctly identified as attacks);
• TN: the number of true negatives (i.e., benign samples correctly identified as benign);
• FP: the number of false positives (i.e., benign samples incorrectly classified as attacks);
• FN: the number of false negatives (i.e., attack samples incorrectly classified as benign).

The above metrics are defined in Eq (24):

(24)

In the following experiments, we evaluate and compare the detection performance of different methods under various task settings using the above metrics, aiming to comprehensively validate the effectiveness and generalization ability of the proposed method.

4.3 Experimental setup

The experiments were conducted in the following computing environment: hardware configuration includes an Intel Xeon(R) Platinum 8358P @2.6GHz processor, 64 GB RAM, and an NVIDIA RTX 3090 GPU with 24 GB memory. The software environment uses Ubuntu 22.04 LTS as the operating system, with PyTorch 2.3.0 as the deep learning framework, accelerated by CUDA 12.1 and cuDNN 8.9.

During training, the model adopts an improved Adam optimizer [39], and the relevant hyperparameters are adjusted according to the characteristics of few-shot learning tasks. All experiments are carried out under multiple N-way K-shot settings to ensure the reliability and representativeness of performance evaluation. The detailed hyperparameter configurations are shown in Table 2.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 2. Values of hyperparameters.

https://doi.org/10.1371/journal.pone.0327161.t002

The model is trained using the cross-entropy loss function, which measures the divergence between the predicted class probabilities and the ground truth labels. This loss function is particularly suitable for multi-class classification tasks under few-shot settings, as it effectively penalizes incorrect predictions and encourages the model to assign high confidence to the correct class. During training, the cross-entropy loss is computed over the query set samples in each episode to guide the optimization process.

Formally, given a query sample with ground truth label and predicted probability distribution , the cross-entropy loss is defined as:

(25)

where denotes the predicted probability assigned to the correct class y. The final loss is averaged over all query samples within each episode.

4.4 Detection results

To verify the effectiveness of the proposed few-shot intrusion detection method based on multi-domain fusion and cross-attention, we conduct comprehensive experiments on both the CICIDS2017 and CICIDS2018 datasets under two typical few-shot settings: K = 5 and K = 10.

The experimental results on the CICIDS2017 dataset are shown in Table 3 and Table 4. Table 3 presents the results under the K = 5 setting. Despite the very limited number of support samples for each class, the proposed method achieves an average accuracy (ACC) of 97.78%, detection rate (DR) of 97.67%, precision of 97.88%, F-measure of 0.9777, and a relatively low false positive rate (FPR) of 2.12%. Among all classes, the SSH-Patator attack achieves the best detection performance, with an F-measure of 0.9855, indicating the model’s ability to effectively capture SSH-specific attack patterns. Table 4 shows the results for K = 10. All metrics are further improved, with average accuracy rising to 99.03%, F-measure reaching 0.9903, and FPR decreasing to just 0.99%. These results demonstrate that increasing the number of support samples, even within a small-sample regime, can significantly improve the model’s matching precision and overall detection performance.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 3. Detection results on the CICIDS2017 dataset (K = 5).

https://doi.org/10.1371/journal.pone.0327161.t003

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 4. Detection results on the CICIDS2017 dataset (K = 10).

https://doi.org/10.1371/journal.pone.0327161.t004

The experimental results on the CICIDS2018 dataset are shown in Table 5 and Table 6. Compared with CICIDS2017, the included attack types (Botnet) are more complex, making detection more challenging. Table 5 presents the results under the K = 5 setting, where the proposed method achieves an overall accuracy of 97.26% and an F-measure of 0.9726. All metrics confirm the robustness of our model in more complex environments. Table 6 shows the performance under K = 10, where the detection metrics are further improved. The overall accuracy rises to 98.64%, the F-measure reaches 0.9864, and the false positive rate is significantly reduced. Notably, the detection improvement for Botnet attacks highlights that the proposed multi-domain fusion and cross-attention mechanism effectively enhances the extraction and discrimination of complex attack behaviors.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 5. Detection results on the CICIDS2018 dataset (K = 5).

https://doi.org/10.1371/journal.pone.0327161.t005

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 6. Detection results on the CICIDS2018 dataset (K = 10).

https://doi.org/10.1371/journal.pone.0327161.t006

To assess the robustness of the proposed method across different runs, we conducted 10 independent trials for each experimental setting using different random seeds. Considering the significant computational cost of each experiment, we only performed 10 independent runs specifically for the overall results, which are representative of the general performance across classes. Consequently, we report the average and standard deviation (in “mean std” format) for the “Overall” rows in Tables 3 to 6. The results show that the F-measure standard deviation is approximately 0.0030 for 5-shot settings and 0.0020 for 10-shot settings, indicating that the proposed method is stable and reliable under few-shot conditions.

In summary, the experimental results show that:

• On both datasets, the proposed method consistently achieves high detection accuracy and low false positive rates, even under few-shot conditions;
• As the number of support samples increases, the model’s ability to distinguish between different attack types improves steadily, indicating that the method can effectively utilize limited information in the support set and has strong discriminative capability for complex attack types.
• The proposed method demonstrates strong stability across independent runs, as evidenced by low standard deviations of overall metrics, suggesting its robustness and practical applicability in real-world few-shot scenarios.

4.5 Comparison with related work

To further validate the effectiveness of the proposed few-shot network intrusion detection method, we compare it against several representative recent methods. These methods span diverse strategies, including meta-learning, federated learning, adversarial training, and feature enhancement. The comparison results are presented in Table 7. The evaluation is conducted on both CICIDS2017 and CICIDS2018 datasets under typical few-shot settings with K = 5 and K = 10, while some works additionally consider extended setups such as K = 20 or 1-shot scenarios.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 7. Comparison of the proposed detection method with related works.

https://doi.org/10.1371/journal.pone.0327161.t007

On the CICIDS2017 dataset, the proposed method achieves an accuracy of 97.78% with K = 5, outperforming FC-Net (94.33%), Multi-scale deep-CapsNet (92.04%), Enhanced triplet network (96.18%), and SPN+K-means (94.14%). Although SPN-based methods combine unsupervised clustering with meta-learning and perform reasonably well in 5-shot settings, their accuracy remains below 96%. Other methods such as FS-IDS (97.51%) and continual learning method (97.43%) approach our performance but still fall slightly short.

When increasing the support samples to K = 10, our method achieves 99.03% accuracy on CICIDS2017, significantly surpassing earlier models such as FC-Net (94.64%) and deep-CapsNet (94.49%), as well as more recent methods like MetaMRE (93.30%) and FML+ResNet (87.27%). Notably, BS-Agg reports an accuracy of 97.90% without a clearly specified K, which remains below our result. This demonstrates that the proposed method excels in modeling deep semantic relationships between support and query sets under limited data conditions.

For the CICIDS2018 dataset, relevant studies are comparatively fewer. MAML+L2F achieves 96.00% and 97.29% for K = 5 and K = 10, respectively, while Self-attention+Iterative refinement method reaches 96.91% under K = 5. In comparison, our method achieves 97.26% and 98.64% under the same conditions, reflecting consistent improvement, especially in the 10-shot scenario.

Overall, despite ongoing advancements in network design, feature modeling, and training strategies, many existing methods still rely primarily on single-domain features. They often fail to effectively capture frequency-domain patterns or cross-domain interactions. In contrast, our method leverages a multi-domain fusion strategy and a bidirectional cross-attention mechanism to jointly model spatial and frequency features, allowing deeper comparison between support and query samples. This leads to superior performance under data-scarce conditions.

Furthermore, some methods in Table 7, such as MetaMRE, SPN+Masking, and FML-based methods, focus on alternative tasks such as encrypted traffic classification or continual learning, which are not entirely comparable. However, even under comparable settings, our method consistently achieves superior results, demonstrating strong generalization and applicability across diverse task scenarios.

In summary, the proposed method outperforms all existing methods across multiple few-shot configurations, especially in complex attack environments and low-support conditions, verifying its technical superiority and practical value.

4.6 Ablation study

To further validate the effectiveness of each key module in the proposed detection method, we conduct comprehensive ablation experiments on both CICIDS2017 and CICIDS2018 datasets. The objective is to assess the contribution of spatial and frequency domain features to the overall detection performance.

Specifically, we conduct comparisons among the following three model variants:

• Full Model: The complete model incorporating both spatial and frequency feature branches, including dual-domain feature extraction and matching;
• w/o Frequency Feat.: The model variant with the frequency branch removed; only spatial features are utilized for detection;
• w/o Spatial Feat.: The model variant with the spatial branch removed; only frequency features are utilized for detection.

Experiments are conducted under two few-shot settings: K = 5 and K = 10. Evaluation metrics include accuracy (ACC), detection rate (DR), precision, and F-measure. The results are presented in Figs 6, 7, 8 and 9.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 6. Ablation study results on the CICIDS2017 dataset (K = 5).

https://doi.org/10.1371/journal.pone.0327161.g006

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 7. Ablation study results on the CICIDS2017 dataset (K = 10).

https://doi.org/10.1371/journal.pone.0327161.g007

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 8. Ablation study results on the CICIDS2018 dataset (K = 5).

https://doi.org/10.1371/journal.pone.0327161.g008

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 9. Ablation study results on the CICIDS2018 dataset (K = 10).

https://doi.org/10.1371/journal.pone.0327161.g009

On the CICIDS2017 dataset (Figs 6 and 7), the full model achieves high performance under the K = 5 setting, with an F-measure of 0.9777. Removing the frequency feature branch reduces the F-measure to 0.9618, indicating the frequency features play an important role in improving detection capability. Further removal of spatial features causes a more significant drop in F-measure to 0.9479, with ACC and DR decreasing to 96.18% and 96.09%, respectively. This demonstrates that spatial features are especially critical in recognizing structured attacks such as DoS and Port Scan. Under the K = 10 setting, the full model improves across all metrics, reaching an F-measure of 0.9903. Excluding frequency features results in a drop to 0.9760, and excluding spatial features yields an even lower F-measure of 0.9650. Although the model benefits from increased support samples at K = 10, missing domain-specific information still notably degrades performance, validating the necessity of multi-domain fusion.

On the CICIDS2018 dataset (Figs 8 and 9), the full model achieves an F-measure of 0.9726 under the K = 5 setting. Removing the frequency branch drops the F-measure to 0.9536, while removing the spatial branch results in a larger decrease to 0.9290. Notably, precision drops most significantly from 97.40% to 93.19%, highlighting the crucial role of spatial features in identifying complex attacks such as Brute Force and Botnet. Under K = 10, the full model further improves, achieving an F-measure of 0.9864. Removing the frequency and spatial branches leads to F-measures of 0.9659 and 0.9548, respectively. Despite performance gains with more support samples, the absence of either branch continues to impair detection accuracy, reaffirming the benefit of multi-domain design.

In summary, both spatial and frequency features contribute uniquely to few-shot intrusion detection. Spatial features offer strong discriminative power for structured attacks, while frequency features complement by capturing spectral patterns that are difficult to identify using conventional methods. The synergy between the two domains significantly enhances the model’s robustness and accuracy in sample-scarce environments, confirming the effectiveness and necessity of the proposed multi-domain fusion strategy.

4.7 Cross-domain generalization analysis

In real-world cybersecurity applications, network environments and data sources often vary significantly across deployment scenarios. Such variations may include differences in device manufacturers, traffic characteristics, and attack behaviors. To evaluate the adaptability of the proposed method under domain shifts, we conduct cross-dataset experiments to assess its cross-domain generalization capability.

Specifically, cross-domain detection refers to the scenario where the model is trained on a source dataset and directly tested on a target dataset without access to any labeled samples from the target domain. This setting simulates real-world cases where the detection model is deployed in previously unseen or unlabeled environments, making it highly practical.

As shown in Table 8, we train the model on the CICIDS2018 dataset and test it on CICIDS2017 using a 5-way 10-shot setup across all attack types. The model achieves an accuracy of 96.73% and an F-measure of 0.9673, demonstrating strong transferability. Notably, detection performance is best for DDoS and FTP-Patator attacks, with F-measures of 0.9732 and 0.9727 respectively. In contrast, Port Scan exhibits slightly lower performance with an F-measure of 0.9517, due to structural differences in its traffic patterns across datasets. Nonetheless, the results remain acceptable.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 8. Cross-domain detection results on the CICIDS2017 dataset (K = 10).

https://doi.org/10.1371/journal.pone.0327161.t008

Table 9 presents the results of training on CICIDS2017 and testing on CICIDS2018 under the same configuration. The model achieves 95.93% accuracy and an F-measure of 0.9594. While detection for DDoS and Brute Force remains stable with an F-measure of 0.9635, the Botnet class poses greater challenges due to its absence from the training set, yielding a lower F-measure of 0.9515. This suggests that the model learns cross-domain features with strong generalization capability, even for diverse attack types.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 9. Cross-domain detection results on the CICIDS2018 dataset (K = 10).

https://doi.org/10.1371/journal.pone.0327161.t009

To further examine model performance under lower-resource conditions, we conduct similar experiments under the 5-shot setting, as shown in Tables 10 and 11. The model still achieves competitive results with an overall F-measure of 0.9505 on CICIDS2017 and 0.9424 on CICIDS2018. Additionally, we report standard deviations of key metrics in the Overall rows of each table. The results demonstrate that as the number of support samples increases (from K = 5 to 10), not only does the detection accuracy improve, but performance variance also decreases. This confirms the proposed method’s robustness and stability in practical cross-domain few-shot intrusion detection scenarios.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 10. Cross-domain detection results on the CICIDS2017 dataset (K = 5).

https://doi.org/10.1371/journal.pone.0327161.t010

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 11. Cross-domain detection results on the CICIDS2018 dataset (K = 5).

https://doi.org/10.1371/journal.pone.0327161.t011

Overall, although the performance drops slightly compared to within-domain settings, the proposed method still maintains high accuracy and robustness across domains. This confirms that the multi-domain fusion and cross-attention mechanism not only perform well under static conditions but also adapt effectively to dynamic, heterogeneous environments, highlighting the practical value of the method for real-world deployments.

To further demonstrate the superiority of the proposed method in cross-domain generalization, we conduct additional comparative experiments with several traditional baseline models under the same cross-domain settings. Specifically, we evaluate Support Vector Machine (SVM), k-Nearest Neighbors (k-NN), and Decision Tree (DT) classifiers, as well as a non-attentive deep learning baseline (FC-Net), using the same 10-shot configuration across CICIDS2017 and CICIDS2018.

All baseline models are trained on the source dataset and directly tested on the target dataset without any fine-tuning. The results, shown in Table 12, indicate that while traditional methods achieve acceptable performance in within-domain settings, their effectiveness drops considerably under domain shifts. In contrast, the proposed method achieves superior performance across all key metrics. Specifically, our model reaches an accuracy of 95.93% and an F-measure of 0.9594, outperforming the best traditional baseline (FC-Net) by over 2% in both metrics, and surpassing SVM and k-NN by over 10% in F-measure.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 12. Cross-domain comparison with traditional methods (Train: CICIDS2017, Test: CICIDS2018, overall).

https://doi.org/10.1371/journal.pone.0327161.t012

These findings further validate that the integration of multi-domain feature encoding and bidirectional cross-attention substantially improves the model’s ability to learn transferable representations, thus enhancing its robustness and practical utility in real-world, heterogeneous network environments.

4.8 Model complexity and efficiency analysis

To evaluate the computational efficiency and deployment feasibility of the proposed few-shot intrusion detection framework, we analyze the model in terms of parameter scale, theoretical complexity, and inference performance.

The architecture consists of two structurally identical encoders for spatial and frequency domains, a Mamba-based sequence modeling module, bidirectional cross-attention mechanisms, and a multi-layer perceptron classifier. The total number of trainable parameters is approximately 8.1 million. Among these, the dual-branch encoders contribute about 3.2 million parameters, the Mamba feature extraction module accounts for approximately 2.7 million parameters, the bidirectional cross-attention and domain fusion modules introduce around 1.4 million parameters, and the classification module, implemented as a three-layer MLP, adds approximately 0.8 million parameters. This relatively compact parameter size, compared to large-scale Transformer-based models, demonstrates the lightweight nature of the design, making it feasible for training and inference on moderate hardware resources.

From a theoretical perspective, the use of the Mamba encoder replaces traditional self-attention with a state space modeling approach that achieves linear time complexity with respect to sequence length n, thereby offering improved scalability and efficiency when processing long network traffic sequences. The bidirectional cross-attention mechanism performs attention operations in both spatial and frequency domains, aligning support and query features with a complexity of , where L is the token length and d is the feature dimension. Due to the stride-based partitioning and downsampling strategy used in the encoder, L remains moderate, and the overall attention cost remains manageable. The attention-based fusion module introduces a shallow Transformer to refine the concatenated domain features. Since this module operates over a limited number of tokens, its overhead is minor relative to the total cost.

To assess real-world efficiency, we measure inference time under the 2-way 10-shot setting on an NVIDIA RTX 3090 GPU. The average inference latency per task is approximately 43.2 milliseconds, with memory consumption remaining under 8 GB. These results show that, despite incorporating dual-domain processing and complex attention mechanisms, the proposed model maintains efficient runtime characteristics suitable for real-time deployment.

In summary, the proposed method achieves a balanced trade-off between expressive modeling capability and computational cost. Its modular structure, reduced parameter count, and linear-time encoding strategy enable it to operate efficiently while retaining high detection accuracy, making it practical for applications in dynamic network environments.

4.9 Hyperparameter sensitivity analysis

To evaluate the robustness and adaptability of the proposed method under varying few-shot configurations, we conduct a hyperparameter sensitivity analysis focusing on two key parameters: the number of shots (K) and the number of classes (N) per task. These two parameters directly affect the complexity of the few-shot learning task and are crucial for understanding how the model scales in different scenarios. All experiments in this section are conducted on the CICIDS2018 dataset to ensure consistent and controlled evaluation.

Effect of Shot Number (K). We evaluate the model’s performance with K values of 1, 3, 5, 8, 10, and 15 in a fixed 5-way classification setting. As shown in Fig 10, the model’s F-measure increases steadily with more support samples per class. Specifically, the F-measure rises from 0.9112 at 1-shot to 0.9872 at 15-shot, showing that the model effectively learns from a small number of examples and stabilizes when K exceeds 10.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 10. F-measure under varying shot numbers K in 5-way tasks (CICIDS2018).

https://doi.org/10.1371/journal.pone.0327161.g010

Effect of Class Number (N). We also examine how the model performs under different N-way configurations (2, 3, 4, and 5 classes) with a fixed shot number of K = 10. As presented in Fig 11, the model maintains high performance even as the number of classes increases. The F-measure decreases slightly from 0.9908 at 2-way to 0.9864 at 5-way, indicating a graceful performance drop as task complexity increases.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 11. F-measure under varying class numbers N with K = 10 (CICIDS2018).

https://doi.org/10.1371/journal.pone.0327161.g011

These results confirm that the proposed model is not only effective but also robust across a range of few-shot learning configurations, making it suitable for practical applications where the availability of labeled support data and task complexity can vary.