Few-shot network intrusion detection method based on multi-domain fusion and cross-attention.
Deep learning methods have achieved remarkable progress in network intrusion detection. However, their performance often deteriorates significantly in real-world scenarios characterized by limited attack samples and substantial domain shifts. To address this challenge, we propose a novel few-shot in...
Saved in:
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Public Library of Science (PLoS)
2025-01-01
|
| Series: | PLoS ONE |
| Online Access: | https://doi.org/10.1371/journal.pone.0327161 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1849319478131687424 |
|---|---|
| author | Congyuan Xu Donghui Li Zihao Liu Jun Yang Qinfeng Shen Ningbing Tong |
| author_facet | Congyuan Xu Donghui Li Zihao Liu Jun Yang Qinfeng Shen Ningbing Tong |
| author_sort | Congyuan Xu |
| collection | DOAJ |
| description | Deep learning methods have achieved remarkable progress in network intrusion detection. However, their performance often deteriorates significantly in real-world scenarios characterized by limited attack samples and substantial domain shifts. To address this challenge, we propose a novel few-shot intrusion detection method that integrates multi-domain feature fusion with a bidirectional cross-attention mechanism. Specifically, the method adopts a dual-branch feature extractor to jointly capture spatial and frequency domain characteristics of network traffic. The frequency domain features are obtained via two-dimensional discrete cosine transform (2D-DCT), which helps to highlight the spectral structure and improve feature discriminability. To bridge the semantic gap between support and query samples under few-shot conditions, we design a dual-domain bidirectional cross-attention module that enables deep, task-specific alignment across spatial and frequency domains. Additionally, we introduce a hierarchical feature encoding module based on a modified Mamba architecture, which leverages state space modeling to capture long-range dependencies and temporal patterns in traffic sequences. Extensive experiments on two benchmark datasets, CICIDS2017 and CICIDS2018, demonstrate that the proposed method achieves accuracy of 99.03% and 98.64% under the 10-shot setting, outperforming state-of-the-art methods. Moreover, the method exhibits strong cross-domain generalization, achieving over 95.13% accuracy in cross-domain scenarios, thereby proving its robustness and practical applicability in real-world, dynamic network environments. |
| format | Article |
| id | doaj-art-c76ae4fc9c3842c6a16d3703d62cb14e |
| institution | Kabale University |
| issn | 1932-6203 |
| language | English |
| publishDate | 2025-01-01 |
| publisher | Public Library of Science (PLoS) |
| record_format | Article |
| series | PLoS ONE |
| spelling | doaj-art-c76ae4fc9c3842c6a16d3703d62cb14e2025-08-20T03:50:26ZengPublic Library of Science (PLoS)PLoS ONE1932-62032025-01-01207e032716110.1371/journal.pone.0327161Few-shot network intrusion detection method based on multi-domain fusion and cross-attention.Congyuan XuDonghui LiZihao LiuJun YangQinfeng ShenNingbing TongDeep learning methods have achieved remarkable progress in network intrusion detection. However, their performance often deteriorates significantly in real-world scenarios characterized by limited attack samples and substantial domain shifts. To address this challenge, we propose a novel few-shot intrusion detection method that integrates multi-domain feature fusion with a bidirectional cross-attention mechanism. Specifically, the method adopts a dual-branch feature extractor to jointly capture spatial and frequency domain characteristics of network traffic. The frequency domain features are obtained via two-dimensional discrete cosine transform (2D-DCT), which helps to highlight the spectral structure and improve feature discriminability. To bridge the semantic gap between support and query samples under few-shot conditions, we design a dual-domain bidirectional cross-attention module that enables deep, task-specific alignment across spatial and frequency domains. Additionally, we introduce a hierarchical feature encoding module based on a modified Mamba architecture, which leverages state space modeling to capture long-range dependencies and temporal patterns in traffic sequences. Extensive experiments on two benchmark datasets, CICIDS2017 and CICIDS2018, demonstrate that the proposed method achieves accuracy of 99.03% and 98.64% under the 10-shot setting, outperforming state-of-the-art methods. Moreover, the method exhibits strong cross-domain generalization, achieving over 95.13% accuracy in cross-domain scenarios, thereby proving its robustness and practical applicability in real-world, dynamic network environments.https://doi.org/10.1371/journal.pone.0327161 |
| spellingShingle | Congyuan Xu Donghui Li Zihao Liu Jun Yang Qinfeng Shen Ningbing Tong Few-shot network intrusion detection method based on multi-domain fusion and cross-attention. PLoS ONE |
| title | Few-shot network intrusion detection method based on multi-domain fusion and cross-attention. |
| title_full | Few-shot network intrusion detection method based on multi-domain fusion and cross-attention. |
| title_fullStr | Few-shot network intrusion detection method based on multi-domain fusion and cross-attention. |
| title_full_unstemmed | Few-shot network intrusion detection method based on multi-domain fusion and cross-attention. |
| title_short | Few-shot network intrusion detection method based on multi-domain fusion and cross-attention. |
| title_sort | few shot network intrusion detection method based on multi domain fusion and cross attention |
| url | https://doi.org/10.1371/journal.pone.0327161 |
| work_keys_str_mv | AT congyuanxu fewshotnetworkintrusiondetectionmethodbasedonmultidomainfusionandcrossattention AT donghuili fewshotnetworkintrusiondetectionmethodbasedonmultidomainfusionandcrossattention AT zihaoliu fewshotnetworkintrusiondetectionmethodbasedonmultidomainfusionandcrossattention AT junyang fewshotnetworkintrusiondetectionmethodbasedonmultidomainfusionandcrossattention AT qinfengshen fewshotnetworkintrusiondetectionmethodbasedonmultidomainfusionandcrossattention AT ningbingtong fewshotnetworkintrusiondetectionmethodbasedonmultidomainfusionandcrossattention |