关键词: 入侵检测；小样本学习；元学习；未知攻击检测

Abstract: Aiming at the problems of scarce samples for certain attack types, attack sample imbalance, and difficulty in detecting new attacks in network intrusion detection, this paper proposed a meta-learning framework based on the Meta-SGD+ANIL algorithm. The goal is to improve the efficiency and accuracy of few-shot intrusion detection, and enhance the model’s ability to recognize minority-class attacks and unknown attacks. Starting from the application and optimization of data augmentation and meta-learning algorithms, we first perform oversampling and undersampling on imbalanced datasets, then dynamically generate few-shot tasks to provide training scenarios for the model. Using the Meta-SGD algorithm, we enable the model to learn an adaptive learning rate for each parameter of the specific network, thereby improving the parameter update efficiency in different attack scenarios. Secondly, we introduce ANIL’s core idea on top of Meta-SGD: only the parameters of the classification layer or partial network layers are subject to dynamic learning rate adjustment, which effectively balances model adaptiveness and computational efficiency. Experiments on the few-shot image dataset Omniglot show that time overhead is reduced by 20% with only a slight drop in accuracy. On the CIC-IDS2017 and CSE-CIC-IDS2018 datasets, compared with traditional methods, the Meta-SGD algorithm improves the model’s accuracy by an average of 8.89%. After introducing ANIL, accuracy decreases only slightly, while training time is reduced by 18 % and 22 % respectively.

Key words: intrusion detection; few-shot learning; meta-learning; detection of unknown attacks