Tagline
Few-shot learning for unseen network attacks.
Tech Stack
Python, TensorFlow/PyTorch, Scikit-learn, Pandas
Year
2025
Network Intrusion Detection System (NIDS) using Few-Shot Learning
A Siamese few-shot model for spotting zero-day attacks when labelled data is thin. Trained on paired traffic samples, evaluated with 5-fold cross-validation across five held-out attack classes. Hit 94 percent detection accuracy, beat an XGBoost supervised baseline by 11 points, and showed clean separation between benign flows and malicious patterns in the learned embedding.
Glimpse of the Project
Model Pipeline
01 / 0501
Capture
Network flows are captured and aggregated into feature vectors — packet counts, byte rates, flag ratios, inter-arrival times — drawn from the CICIDS-style benchmark.
Pandas · NumPy
tap a step to explore →
Case Study
The problem
Intrusion detection systems are good at attacks they've seen before and bad at the ones that matter most — novel, zero-day families where you have almost no labelled examples. A supervised classifier needs many samples per attack class, which you simply don't have on day one of a new threat.
What I built
A Siamese few-shot detector. Network flows are aggregated into feature vectors and assembled into same-class and cross-class pairs; a twin encoder projects each flow into a 128-dimensional embedding, trained with contrastive loss to pull like traffic together and push unlike traffic apart. At inference, a single support example of a novel attack is enough to flag similar malicious flows by nearest neighbour in the embedding space.
The hardest decision
The real choice was framing: treat this as supervised classification, or as metric learning. A supervised model like XGBoost is simpler to train and tune, but it can't recognise an attack class it never saw in training. I chose few-shot metric learning specifically so one example of an unseen family is enough to detect it — accepting the harder engineering of pair construction, contrastive-loss tuning and embedding evaluation as the price of generalising to zero-day attacks.
Outcome & what I'd do differently
Evaluated with 5-fold cross-validation across five held-out attack classes, the few-shot model reached 94% detection accuracy and beat the XGBoost supervised baseline by 11 points, with clean separation between benign and malicious flows in the learned embedding. It was validated on a benchmark dataset, though — a production deployment would need online adaptation and explicit handling of concept drift as real traffic changes.
Designed and Developed by Takinur M