Network intrusion detection systems play a vital role in protecting networks by detecting malicious network traffic which can then be investigated by a cybersecurity operations centre. State-of-the-art approaches utilise supervised machine learning methods to train a classification model to recognise known cyberattacks; however, these models require a large labelled dataset to train and show poor performance when trained on smaller datasets. In an attempt to address this shortcoming, anomaly detection models learn the distribution of benign traffic and flag non-conforming traffic as malicious. While these methods do not require malicious examples to train, they suffer from high false-positive rates rendering them impractical. As a result, networks may be particularly vulnerable when there are insufficient labelled instances of a specific attack class to train an effective classifier. This often occurs in newly established networks or when previously unseen types of attacks emerge. To address this challenge, this work proposes the use of a triplet network, utilising online triplet mining and a KNN classifier, which is able to perform few-shot classification, enabling effective intrusion detection after being trained on a limited number of malicious examples. Various online triplet mining algorithms were explored and model design choices, such as the inference algorithm and optimised distance metrics, were compared and evaluated through a series of ablation studies. The final model was compared against other state-of-the-art approaches in few-shot binary and multiclass classification, where the proposed approach was found to be competitive with existing methods when trained on as little as 10 malicious samples of each class.

翻译：网络入侵检测系统通过检测恶意网络流量（这些流量后续可由网络安全运营中心进行调查），在保护网络方面发挥着至关重要的作用。现有主流方法利用监督式机器学习训练分类模型以识别已知网络攻击；然而，此类模型需要大规模标注数据集进行训练，当训练数据规模较小时性能显著下降。为弥补这一缺陷，异常检测模型通过学习良性流量分布，将不符合分布特征的流量标记为恶意。虽然这类方法无需恶意样本即可训练，但其高误报率导致实用性受限。因此，当特定攻击类别缺乏足够标注实例以训练有效分类器时，网络可能尤为脆弱——这常见于新建立的网络或出现前所未见的新型攻击时。为解决这一挑战，本研究提出采用三元组网络，结合在线三元组挖掘与KNN分类器实现小样本分类，使得在仅使用有限恶意样本训练后即可有效进行入侵检测。我们探索了多种在线三元组挖掘算法，并通过一系列消融实验比较评估了推断算法、优化距离度量等模型设计选择。最终模型在二元与多分类小样本场景下与现有最优方法进行对比，结果表明：当每类仅使用10个恶意样本训练时，所提方法即能与现有方法性能相当。