Enterprise Network Security Using Few‐Shot Meta‐Learning

ABSTRACT Enterprise network security systems face growing and advanced intrusion threats. Supervised learning‐based systems are limited by data sufficiency to quickly adapt to these novel attack vectors and classify these attacks. This study employs a meta‐learning approach (MAML) using few‐shot learning to train a base CNN model on diverse network intrusion detection task sets with limited datasets. A meta‐dataset was curated from six benchmark datasets: CIC‐IDS2017, CSE‐CIC‐IDS2018, CIC‐DDoS2019, NSL‐KDD, UNSW‐NB15 and UNR‐IDD for experimental evaluations. This dataset consists of 84 network attack vectors divided into 67 meta‐train and validation vectors and 17 meta‐test vectors. Raw network traffic data from (PCAP) files are transformed into images by extracting relevant features. 20 samples for each attack vector are used for meta‐training and validation 5‐way, 1‐shot, 5‐way, 5‐shot, 10‐way, 1‐shot, 10‐way and 5‐shot configurations. The experiments displayed training accuracies of up to 96.52% and validation accuracies of up to 91.58% for the 5‐way, 15‐shot mode. The meta‐testing accuracies reported mean values of up to 93.52% with a standard deviation of 0.36% in the (90.40% and 95.69%) 95% confidence interval with an error bar of 2.65% on unseen classes after minimal fine‐tuning. A shallow CNN model and a reduced image size improve accuracy and efficiency for gradient updates.