💻 computer science

Few-Shot Network Intrusion Detection Using Online Triplet Mining

This paper proposes a few-shot network intrusion detection system that combines a triplet network with online triplet mining and a KNN classifier to effectively identify malicious traffic using as few as 10 labeled samples per attack class, addressing the limitations of traditional supervised and anomaly detection methods in data-scarce scenarios.

Original authors: Jack Wilkie, Hanan Hindy, Christos Tachtatzis, Miroslav Bures, Robert Atkinson

Published 2026-05-19

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Jack Wilkie, Hanan Hindy, Christos Tachtatzis, Miroslav Bures, Robert Atkinson

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Problem: The "New Guard" Dilemma

Imagine a security guard at the entrance of a massive office building. Their job is to spot intruders.

The Old Way (Supervised Learning): To learn how to spot a thief, the guard is shown thousands of photos of known thieves. This works great if the thief looks exactly like the photos. But if a new type of thief shows up, or if the guard is hired at a brand-new building where no photos of thieves exist yet, the guard is helpless. They need a huge library of "bad guy" photos to learn, which takes a long time to gather.
The "Anomaly" Way (Anomaly Detection): Another approach is to teach the guard what "normal" people look like. If someone looks even slightly different, they are flagged as a threat. The problem? This is too sensitive. A person wearing a bright red hat or carrying a weird-shaped bag gets flagged as a criminal. This causes too many false alarms (false positives), and the guard ends up ignoring the real threats because they are too busy chasing innocent people.

The Goal: The authors wanted to create a security system that can learn to spot a new type of thief after seeing only a handful of pictures (maybe just 10), without screaming "Thief!" at every innocent person who walks by.

The Solution: The "Triplet" Training Method

The authors propose a new training method using something called a Triplet Network. Instead of just showing the guard pictures of "Good Guys" and "Bad Guys," they use a three-person comparison game.

Imagine the guard is learning to identify a specific type of criminal (let's say, a pickpocket). The training session involves three people:

The Anchor: A photo of the pickpocket.
The Positive: Another photo of the same pickpocket (maybe wearing a different hat).
The Negative: A photo of a totally innocent person (a "Good Guy").

The guard is taught a simple rule: "The Anchor and the Positive must look closer to each other than they look to the Negative."

By playing this game over and over, the guard learns the essence of what makes a pickpocket a pickpocket, rather than just memorizing a specific face. This allows them to recognize the same criminal even if they change their appearance, and it helps them ignore innocent people who just happen to look a little different.

The Secret Sauce: "Online Triplet Mining"

In the past, researchers would pick these three-person groups randomly before training started. The authors realized this was inefficient.

They introduced Online Triplet Mining. Imagine a coach watching the training session in real-time. Instead of using random groups, the coach looks at the current batch of photos and says, "Hey, these two pickpockets look very similar, but that innocent person looks very similar to them too. That's a tricky group! Let's focus on that one."

By constantly picking the hardest examples to learn from (the ones that almost trick the guard), the system learns much faster and more effectively, even with very little data.

The Final Step: The "K-Nearest Neighbors" (KNN) Judge

Once the guard has learned the "essence" of the criminals, how do they make a decision on a new person walking in?

The system uses a K-Nearest Neighbors (KNN) approach. Imagine the guard has a wall of photos from the training session. When a new person arrives, the guard looks at the 10 photos on the wall that look most similar to the new person.

If 8 of those 10 photos are of pickpockets, the guard says, "That's a pickpocket."
If 9 of them are innocent people, the guard says, "That's a normal person."

Crucial Point: The authors kept the ratio of "Good Guys" to "Bad Guys" in the training photos exactly as it is in the real world (mostly good guys, very few bad guys). This ensures that the guard doesn't get confused and start flagging innocent people just because they want to be safe.

What They Found (The Results)

The authors tested this system on two famous datasets of network traffic (CICIDS2017 and Lycos2017). Here is what happened:

Super Low Data: The system worked incredibly well even when trained on just 10 examples of each type of attack.
Few False Alarms: Unlike the "Anomaly" systems that scream at everything, this system kept the false alarm rate extremely low. It didn't flag innocent traffic as malicious.
Better than the Rest: When compared to other advanced methods (like Siamese networks or standard AI models), their "Triplet" system was more accurate and more stable, especially when the data was messy or complex.
No Overfitting: Sometimes, AI models memorize the training data so well they fail on new data (like a student memorizing answers but not understanding the subject). This system didn't do that; it learned the concept of the attack, so it generalized well.

Summary

The paper presents a smart way to teach a computer to spot cyber-attacks using very few examples. By using a "compare three things" training method and focusing on the hardest examples to learn from, the system can detect new threats quickly without causing a panic of false alarms. It's like training a security guard who can spot a new type of thief after seeing just a few photos, without mistaking a tourist for a criminal.

Technical Summary: Few-Shot Network Intrusion Detection Using Online Triplet Mining

Problem Statement
Network Intrusion Detection Systems (NIDSs) face a critical vulnerability when deployed in newly established networks or when zero-day attacks emerge. Traditional supervised machine learning approaches require large volumes of labelled malicious traffic to train effective classifiers, creating a "vulnerability window" where systems remain exposed until sufficient data is accumulated. Conversely, unsupervised anomaly detection methods, which learn the distribution of benign traffic, often suffer from prohibitively high false-positive rates, rendering them impractical for real-world operations. The core challenge addressed in this work is achieving effective intrusion detection with a limited number of malicious samples (few-shot learning) while maintaining low false-positive rates and resisting overfitting in highly imbalanced datasets where benign traffic dominates.

Methodology
The authors propose a system combining a Triplet Network trained via online triplet mining with a K-Nearest Neighbours (KNN) classifier for inference.

Triplet Network Architecture: Unlike Siamese networks that learn from pairs, the proposed model uses a triplet network consisting of three parallel neural networks with shared weights. It processes an anchor sample ( $x_a$ ), a positive sample ( $x_p$ ) from the same class, and a negative sample ( $x_n$ ) from a different class. The network learns an embedding space where the distance between the anchor and positive is smaller than the distance between the anchor and negative by a margin $m$ .
Online Triplet Mining: To overcome the inefficiency of pre-sampled pairs, the authors employ batch-all triplet mining. Instead of selecting triplets before training, a class-balanced batch is passed through the encoder to generate embeddings. All valid triplets within the batch are then identified, and the loss is computed over all valid combinations. This maximizes the relational supervision extracted per batch, particularly beneficial when the total number of labelled malicious samples is small.
Balanced Batch Sampling: Given the extreme class imbalance in NIDS datasets, a weighted random sampling strategy is used during training. Samples are weighted inversely proportional to their class frequency to ensure that each training batch contains an even number of samples from each class, facilitating the formation of valid triplets.
Inference Strategy: During inference, the model does not retrain or use a learned decision boundary. Instead, test samples are mapped to the embedding space, and a KNN classifier is applied over the unbalanced training reference set. The authors argue that while balanced batches are necessary for learning discriminative features, preserving the natural class skew (dominance of benign traffic) during inference is crucial for maintaining low false-positive rates.

Key Contributions

Proposed System: A novel NIDS architecture combining online triplet mining and a KNN classifier, capable of performing few-shot classification with as few as 10 malicious samples per class.
Evaluation Framework: A novel evaluation procedure comparing the proposed model against state-of-the-art supervised and anomaly-based baselines in both few-shot binary and multiclass classification settings.
Ablation Studies: Comprehensive analysis demonstrating the optimal design choices, including the superiority of batch-all mining over batch-hard or semi-hard mining, the effectiveness of Euclidean distance over Manhattan or Cosine distance, and the robustness of the KNN inference algorithm compared to linear probing or fine-tuning.
Overfitting Analysis: Evidence showing that the proposed method intrinsically reduces overfitting compared to baseline models, particularly in multiclass settings with limited data.

Experimental Results
The model was evaluated on two benchmark datasets: CICIDS2017 (28 features, 5 classes) and Lycos2017 (72 features, 12 classes).

Binary Classification: On both datasets, the triplet network achieved competitive or superior macro F1-scores compared to baselines (Autoencoders, DAE-LR, One-Class SVM, and RENOIR). Notably, while RENOIR showed marginally higher recall in some low-data scenarios, it incurred false-positive rates orders of magnitude higher than the proposed method. The triplet network maintained the best precision and lowest false-positive rates across all training sizes.
Multiclass Classification: The proposed model outperformed Siamese networks, Multi-Layer Perceptrons (MLPs), and standard KNN classifiers on the more complex Lycos2017 dataset across all training sizes. On CICIDS2017, it outperformed baselines when trained on at least 40 samples per class.
Robustness: The model demonstrated resilience to variations in the number of benign training samples and maintained high performance even with only 10 malicious samples per class.

Significance and Claims
The paper claims that this work represents an important step toward practical, ML-based NIDSs. By enabling effective classification with minimal labelled data, the approach aims to reduce the vulnerability window associated with new network deployments and zero-day attacks. The authors assert that their method successfully bridges the gap between the low false-positive rates required for practical deployment and the ability to learn from limited data, outperforming existing few-shot and anomaly detection approaches in most evaluated metrics. The use of KNN inference on learned embeddings allows the system to leverage the true class distribution (benign dominance) without sacrificing the discriminative power learned during the balanced training phase.

Limitations and Future Directions
The authors acknowledge that evaluation was limited to two specific benchmark datasets and did not include comparisons to broader meta-learning approaches (e.g., prototypical networks) due to differing training assumptions. They suggest future work should validate the approach on diverse datasets (e.g., IoT, encrypted traffic) and address the computational overhead of KNN inference in real-time, high-throughput scenarios, potentially through approximate nearest neighbour search methods.