Few-shot learning techniques compared for network attack detection
Few-Shot Learning for Network Intrusion Detection: Methods, Datasets, and Performance
Cryptography and Security
Summary
Detecting new types of cyberattacks on computer networks is difficult because there are usually very few examples available to learn from. The authors reviewed studies on few-shot learning, a method that helps systems learn from only a few examples, applied to this problem. They found that approaches like meta-learning and convolutional neural networks are most common, and certain datasets are frequently used for evaluation. However, differences in experimental setups and missing details make it hard to fairly compare the methods.
What this means in practice
- •For cybersecurity engineers: Choose few-shot learning methods suitable for detecting rare network attacks with minimal labeled data using the survey’s comparisons and dataset information.
- •For network security vendors: Inform product development by incorporating proven few-shot learning approaches to improve intrusion detection for new attack types with limited training data.$Commercial implications: Enables development of intrusion detection products capable of quickly adapting to emerging threats with minimal data.
A survey. It maps existing work.
Authors
Arne Roszeitis, Victor Jüttner, Erik Buchmann
Abstract
Anomaly-based network intrusion detection systems (NIDS) are an important first line of defense. However, training NIDS for new attack types is challenging, because labeled attack data are rarely available. Few-shot learning (FSL) addresses this problem by learning from few samples. However, the approaches and evaluation settings, that have been investigated so far, vary widely. This work systematically reviews FSL approaches for NIDS published from 2022 to 2026. We conduct a systematic literature review with PRISMA 2020-like reporting to search ACM Digital Library, IEEE Xplore, and Scopus. From a set of 1,358 initial records, we retain 21 studies after screening, deduplication, and quality filtering. We classify the applied FSL approaches, datasets, and experimental parameters and compare reported performance. Meta-learning and convolutional neural networks are the most common approaches, with 8 and 10 studies, respectively. Most studies evaluate five or fewer samples per class, although settings vary. CIC-IDS2017 and CSE-CIC-IDS2018 are the most frequently used datasets. Missing parameters and source code limit reproducibility and direct comparison between approaches.