Intrusion Detection System Using Initialization-based Few-shot Learning

An Intrusion Detection System (IDS) has become an essential means of ensuring the security of a network. It is a system that monitors the state of the traffic running in the network. Few-shot learning is a novel machine learning (ML) approach that has the ability of recognizing novel objects from very few examples. Conventional ML models require substantial amount of data in order to train the model whereas the IDS dataset is imbalanced and is lacking in various categories. In this research, we proposed and implemented a method of using initialization-based few-shot learning (IB-FSL) to improve the performance of the IDS by initializing the weights and by "learning to fine-tune" the data as it detects intrusion. To accomplish our set objectives, we implemented a ResNet-50 on the proposed IB-FSL which gave us a model that initializes the weights such that classifiers for novel classes could be learned from very few labeled examples and a minimal number of gradient descent steps before the application of fine-tuning. The experiment on UNSW-NB15 showed a good performance with an accuracy of 85.96% on less than 2% of the training dataset. We also obtained a precision of 96.18% and F1-score of 92% while other methods such as Decision Tree (DT), Logistic regression (LR), Naïve Bayes (NB) and Expectation Maximization (EM) clustering used 100% of the training dataset but achieved an accuracy of 85.56%, 83.15%, 82.07% and 78.47% respectively. This model could be used to detect abnormal data intrusions into the network traffic with low false alarm rate leading to improved network security.