Cogaugids: a cognitive model-based data augmentation framework for intrusion detection under extremely small sample conditions

Abstract In current research on network intrusion detection systems (IDS), mainstream methods typically rely on large-scale, high-quality labeled datasets to train deep learning models, such as convolutional neural networks (CNNs), recurrent neural networks (RNNs), and their variants. These methods can achieve high detection accuracy and robustness under conditions where sufficient training data is available. However, during actual deployment, especially at the initial emergence of novel attacks or in specific scenarios, it is often difficult to collect sufficient and reliable labeled samples, leading to extremely small-sample conditions. Under extremely small-sample conditions, existing deep learning-based IDS methods experience significant degradation in both detection performance and generalization capability due to scarce training data or insufficient labeling quality. To address this problem, this paper proposes CogAugIDS, a cognitive model data augmentation-based IDS framework. CogAugIDS simulates human learning and decision-making processes to deeply understand and reason about extremely small-sample data, thereby generating more representative and diverse augmented samples. This approach enhances the training and detection performance of deep learning-based IDS methods under extremely small-sample conditions. Experimental results show that, when tested on the UNSW-NB15 dataset with only 10 samples per attack category, CogAugIDS achieves significantly better performance in multi-classification tasks compared to classical deep learning methods (CNN-BiLSTM, 1D-CNN, CNN-LSTM, LSTM). Specifically, CogAugIDS improves the accuracy of multi-classification tasks by approximately 5%–7% compared to classical deep learning-based IDS approaches. Furthermore, CogAugIDS demonstrates stronger robustness and generalization ability in resource-constrained environments. It effectively enhances detection accuracy even when faced with a very small number of training samples, and its adaptability to is superior to that of baseline deep learning-based IDS methods. These results validate the superiority of the CogAugIDS framework under extremely small-sample conditions and demonstrate its practical applicability in resource-limited IDS environments.