Leveraging siamese networks for one-shot intrusion detection model

Abstract The use of supervised Machine Learning (ML) to enhance Intrusion Detection Systems (IDS) has been the subject significant research. Supervised ML is based upon learning by example, demanding volumes representative instances for effective training and need retrain model every unseen cyber-attack class. However, retraining models in-situ renders network susceptible attacks owing time-window required acquire a sufficient volume data. Although anomaly detection systems provide coarse-grained defence against attacks, these approaches are significantly less accurate suffer from high false-positive rates. Here, complementary approach referred as “One-Shot Learning”, whereby limited number examples new attack-class used identify (out many) detailed. grants classification opportunity classes that were not seen during without retraining. A Siamese Network trained differentiate between on pairs similarities, rather than features, allowing previously attacks. performance pre-trained classify attack-classes only one example evaluated using three mainstream IDS datasets; CICIDS2017, NSL-KDD, KDD Cup’99. results confirm adaptability in classifying trade-off distinctive class representations.