GDE model: A variable intrusion detection model for few-shot attack

Abstract

With the formation and popularity of the Internet of Things(IoT), the difficulty of protecting IoT infrastructure and smart devices from a few-shot of ever-changing malicious attacks has increased significantly. Traditional intrusion detection models in static mode cannot defend against intelligent attacks that change in real time and are good at reconnaissance, and it is difficult to achieve effective detection of few-shot attacks. Therefore, to solve the above problems, this paper proposes a variable few-shot intrusion detection model GDE Model for IoT, which contains a data processing module consisting of an improved Gramian Angular Fields(GAF), a data augmentation module consisting of an improved Denoising Diffusion Probabilistic Models(DDPM), and an image classification module consisting of a variable network ETNet V2 obtained from a neural architecture search based on efficient net v2. The one-dimensional network traffic data collected from a real network environment is converted into two-dimensional images and fed into the above model for learning and training, so as to construct a variable intrusion detection model that combines accuracy and inference speed. To evaluate the work of this paper, different categories of evaluation metrics were selected and experiments were conducted on each module and the overall model separately. The experimental results show that the proposed intrusion detection model achieves variable functionality with an accuracy of up to 99.20% for few-shot detection and an average inference time as low as 23ms, which can be used not only for IoT but also for different network environments and attack types.