Few-Shot Class-Adaptive Anomaly Detection with Model-Agnostic Meta-Learning

Anomaly detection in encrypted traffic is a growing problem, and many approaches have been proposed to solve it. However, those approaches need to be trained in the massive of normal traffic and specific-class abnormal traffic, so to achieve good results in that specific-class. For a new anomaly class with few labeled samples, the effectiveness of existing approaches will decline sharply. How to train a model using only a few anomaly samples to detect unseen new anomaly classes in training is a huge challenge. In this paper, we propose a Few-shot Class-adaptive Anomaly Detection framework (FCAD) with model-agnostic meta-learning (MAML) to meet this challenge. Given an input network flow, FCAD first extracts statistical features by feature extractor and feature selector, and time-series features using LSTM-based AutoEncoder. Then, FCAD designs a MAML-based few-shot anomaly detection model, relying on the episodic training paradigm and learning from the collection of K-way-M-shot classification tasks, which can mimic the few-shot regime faced at test time during training. Finally, FCAD uses the pre-trained model to adapt the new class by a few iterations steps. Our goal is to detect anomaly traffic in a before unseen anomaly class with only a few samples. A reliable solution to few-shot anomaly detection will have huge potential for real-world applications since it is expensive and arduous to collect a massive amount of data onto the new anomaly class; extensive experimental results demonstrate the effectiveness of our proposed approach.