Traditional Detection Systems Research Articles

XplAInable: Explainable AI Smoke Detection at the Edge

Wild and forest fires pose a threat to forests and thereby, in extension, to wild life and humanity. Recent history shows an increase in devastating damages caused by fires. Traditional fire detection systems, such as video surveillance, fail in the early stages of a rural forest fire. Such systems would see the fire only when the damage is immense. Novel low-power smoke detection units based on gas sensors can detect smoke fumes in the early development stages of fires. The required proximity is only achieved using a distributed network of sensors interconnected via 5G. In the context of battery-powered sensor nodes, energy efficiency becomes a key metric. Using AI classification combined with XAI enables improved confidence regarding measurements. In this work, we present both a low-power gas sensor for smoke detection and a system elaboration regarding energy-efficient communication schemes and XAI-based evaluation. We show that leveraging edge processing in a smart way combined with buffered data samples in a 5G communication network yields optimal energy efficiency and rating results.

NGMD: next generation malware detection in federated server with deep neural network model for autonomous networks

Distributed denial-of-service (DDoS) attacks persistently proliferate, impacting individuals and Internet Service Providers (ISPs). Deep learning (DL) models are paving the way to address these challenges and the dynamic nature of potential threats. Traditional detection systems, relying on signature-based techniques, are susceptible to next-generation malware. Integrating DL approaches in cloud-edge/federated servers enhances the resilience of these systems. In the Internet of Things (IoT) and autonomous networks, DL, particularly federated learning, has gained prominence for attack detection. Unlike conventional models (centralized and localized DL), federated learning does not require access to users’ private data for attack detection. This approach is gaining much interest in academia and industry due to its deployment on local and global cloud-edge models. Recent advancements in DL enable training a quality cloud-edge model across various users (collaborators) without exchanging personal information. Federated learning, emphasizing privacy preservation at the cloud-edge terminal, holds significant potential for facilitating privacy-aware learning among collaborators. This paper addresses: (1) The deployment of an optimized deep neural network for network traffic classification. (2) The coordination of federated server model parameters with training across devices in IoT domains. A federated flowchart is proposed for training and aggregating local model updates. (3) The generation of a global model at the cloud-edge terminal after multiple rounds between domains and servers. (4) Experimental validation on the BoT-IoT dataset demonstrates that the federated learning model can reliably detect attacks with efficient classification, privacy, and confidentiality. Additionally, it requires minimal memory space for storing training data, resulting in minimal network delay. Consequently, the proposed framework outperforms both centralized and localized DL models, achieving superior performance.

A falls recognition framework based on faster R-CNN and temporal action sequences that can be deployed on home service robots

With the popularity of home service robots (e.g. floor sweepers), robots should be considered to have more features for older adult care. Compared to fixed home monitors with a limited field of view, fall detection with service robots is an ideal solution to keep older adults and disabled people within sight. However, the user’s actions, such as lying on the bed to sleep or slumping on the sofa to rest, cause the traditional fall detection system to generate false alarms, which disrupts the user’s family life. The present work proposed an enhanced faster R-convolutional neural network (CNN) network by incorporating temporal action sequences and fall acceleration computation, demonstrating a reduced misjudgment rate on the service robot platform. Firstly, motion images were captured to obtain the target’s motion area description and action timing at the input stage. Then, the faster R-CNN algorithm was implemented to check the suspected falls further based on the falling acceleration of the detected actions during the training phase. Finally, the proposed temporal action sequences module eliminated the action mistaken for falling. Network training and robotic platform testing demonstrated that the proposed approach distinguished between falls and false alarms, which mitigated the occurrence of false positives. On the service robot platform, experimental results showed that the FAR was 8.19 and processing time was 0.79 s.

Integration of Fire Detection and Personnel Accountability System

Fire incidents in public spaces pose significant risks to life and property. Traditional fire detection systems often suffer from delays and inaccuracies, necessitating the development of advanced solutions. This paper presents a comprehensive system for integrating fire detection and personnel accountability in surveillance scenarios. With the increasing concerns about safety in public spaces, the need for effective systems to detect fires and ensure personnel safety has become paramount. Traditional methods rely on manual intervention or basic sensors, often resulting in delayed or inaccurate alerts. To address these challenges, our system employs advanced image processing and machine learning to enhance safety measures. By analyzing surveillance camera feeds, it detects changes in pixel intensity, smoke patterns, and heat signatures to identify potential fire incidents. Machine learning models, such as convolutional neural networks (CNNs), are trained to accurately classify fire and non-fire regions in video frames. Additionally, the system tracks personnel presence and movement, ensuring accountability within the surveillance area. Modular and scalable, our system integrates seamlessly with existing infrastructure, providing reliable fire detection and personnel monitoring. Experimental results demonstrate its effectiveness, contributing to enhanced safety in public spaces and facilitating prompt emergency responses.

A Hybrid Optimization Model for Efficient Detection and Classification of Malware in the Internet of Things

The proliferation of Internet of Things (IoT) devices and their integration into critical infrastructure and business operations has rendered them susceptible to malware and cyber-attacks. Such malware presents a threat to the availability and reliability of IoT devices, and a failure to address it can have far-reaching impacts. Due to the limited resources of IoT devices, traditional rule-based detection systems are often ineffective against sophisticated attackers. This paper addressed these issues by designing a new framework that uses a machine learning (ML) algorithm for the detection of malware. Additionally, it also employed sequential detection architecture and evaluated eight malware datasets. The design framework is lightweight and effective in data processing and feature selection algorithms. Moreover, this work proposed a classification model that utilizes one support vector machine (SVM) algorithm and is individually tuned with three different optimization algorithms. The employed optimization algorithms are Nuclear Reactor Optimization (NRO), Artificial Rabbits Optimization (ARO), and Particle Swarm Optimization (PSO). These algorithms are used to explore a diverse search space and ensure robustness in optimizing the SVM for malware detection. After extensive simulations, our proposed framework achieved the desired accuracy among eleven existing ML algorithms and three proposed ensemblers (i.e., NRO_SVM, ARO_SVM, and PSO_SVM). Among all algorithms, NRO_SVM outperforms the others with an accuracy rate of 97.8%, an F1 score of 97%, and a recall of 99%, and has fewer false positives and false negatives. In addition, our model successfully identified and prevented malware-induced attacks with a high probability of recognizing new evolving threats.

Integrated Fire Detection System using ML and IOT

Abstract: An integrated fire detection system that combines smoke, thermal, and image analysis using machine learning can provide real-time fire detection and reduce false alarms, thereby enhancing safety. Traditional single-sensor fire detection systems that rely on smoke or heat often result in false alarms or delays. The proposed multi-model system involves combining smoke, thermal, and YOLO v8 image detection technologies. However, challenges such as data privacy, cost, and maintenance need to be addressed. Nevertheless, this advanced fire detection system has the potential to significantly improve fire protection.

Less interference fluorescence analytical strategy: Bridging substance-triggered ratiometric sensor with convenient preparation and application

High interference and narrow application range are key of bottleneck of recent fluorescence analysis methods, which limit their wide application in the sensing field. Therefore, to overcome these disadvantages, a ratiometric fluorescence sensing system utilizing berberine (BER) and silver nanoclusters protected by dihydrolipoic acid (DHLA-AgNCs) was constructed for the first time in this work, to achieve determination of BER and daunorubicin (Dau). BER aqueous solution (non-planar conformation) has no fluorescence emission. When it was mixed with DHLA-AgNCs, the conformation of BER became planar, producing fluorescence emission at 515 nm besides the fluorescence emission peak of DHLA-AgNCs at 653 nm. With the increase of BER concentration added in system, the fluorescence intensity of BER (planar conformation) at 515 nm increased obviously and the fluorescence intensity of DHLA-AgNCs decreased slightly. Therefore, the dual emission fluorescence sensing system was constructed based on a fluorescence substance and non fluorescence substance, to achieve determination of BER. Meanwhile, based on the bridging effect of BER and fluorescence resonance energy transfer effect from Dau, the altering of two peaks intensity was utilized to achieve determination of Dau. Thus, this dual emission sensing system can not only be used for fluorescence analysis of BER and its analogues, but also based on the bridging effect of BER, allowing the determination of Dau and its analogues that could not be directly measured with silver nanoclusters, expanding the application range of traditional dual emission detection systems. Meanwhile, this system has strong anti-interference ability and low toxicity to the human body and less pollution to the sample and environment. This provides a new direction and universal research strategy for the construction of new fluorescence sensing systems in the future for the analysis of target substances that cannot be directly detected with conventional fluorescence analysis methods.

Feature-Selection-Based DDoS Attack Detection Using AI Algorithms

SDN has the ability to transform network design by providing increased versatility and effective regulation. Its programmable centralized controller gives network administration employees more authority, allowing for more seamless supervision. However, centralization makes it vulnerable to a variety of attack vectors, with distributed denial of service (DDoS) attacks posing a serious concern. Feature selection-based Machine Learning (ML) techniques are more effective than traditional signature-based Intrusion Detection Systems (IDS) at identifying new threats in the context of defending against distributed denial of service (DDoS) attacks. In this study, NGBoost is compared with four additional machine learning (ML) algorithms: convolutional neural network (CNN), Stochastic Gradient Descent (SGD), Decision Tree, and Random Forest, in order to assess the effectiveness of DDoS detection on the CICDDoS2019 dataset. It focuses on important measures such as F1 score, recall, accuracy, and precision. We have examined NeTBIOS, a layer-7 attack, and SYN, a layer-4 attack, in our paper. Our investigation shows that Natural Gradient Boosting and Convolutional Neural Networks, in particular, show promise with tabular data categorization. In conclusion, we go through specific study results on protecting against attacks using DDoS. These experimental findings offer a framework for making decisions.

Detection of Cyber Attacks and Network Attacks using Machine Learning Algorithms

With the escalating sophistication of cyber threats and the increasing complexity of network infrastructures, traditional rule-based intrusion detection systems (IDS) are proving inadequate in safeguarding against modern cyber attacks. Consequently, the integration of machine learning (ML) algorithms has emerged as a promising approach to fortify network security by enabling proactive detection and mitigation of cyber threats. This review paper comprehensively explores the application of ML algorithms in detecting various forms of cyber-attacks and network intrusions. The review begins by outlining the fundamental concepts of cyber attacks and network intrusions, providing context for the subsequent discussion on ML-based detection methodologies. It surveys the landscape of ML algorithms employed in cybersecurity, ranging from classical techniques like Support Vector Machines (SVM) and Random Forests to more advanced methods such as deep learning and ensemble models. Furthermore, the paper explains the diverse datasets utilized for training and evaluating ML-based intrusion detection systems, highlighting their significance in ensuring robust and generalizable models. Additionally, it examines the challenges and limitations associated with ML-driven detection, including issues of data scarcity, adversarial attacks, and model interpretability

Design and validation of novel maize grain cleaning loss detection system based on classification models of particle time-domain signals

Quantitative evaluation of grain cleaning loss is a central concern in maize intelligent direct harvesting. This study integrates particle time-domain signals with machine learning models to develop a novel grain cleaning loss detection system and create modular embedded companion software. Specifically, collisional time-domain signals of grains and impurities with varying mass gradients are captured, and abnormal data are eliminated utilizing the Mahalanobis Distance (MD) algorithm. Signal classification models incorporating diverse preprocessing methods are trained using Naive Bayes (NB) and Support Vector Machine (SVM) algorithms. Model performance is evaluated through internal leave-one-out-cross-validation (LOOCV) and external validation sets. The best classification model is integrated into the grain loss detection software, and bench tests verify real-time cleaning loss rates for detection systems. Results demonstrate that the SVM model with Savitzky-Golay (S-G) smoothing + Second-Order Derivative (SOD) preprocessing achieves the highest predictive accuracy, with 97.44 % and 96.15 % in training and validation sets, respectively. When the feeding rate of maize mixtures is 5 kg/s, absolute grain loss rates for three measurements are 1.62 %, 1.72 % and 1.86 %, respectively. Compared to traditional loss detection systems with multifunctional circuits, the novel loss detection system enhances the average accuracy of grain loss rate by 6.54, 6.82 and 8.93 percentage points. Hence, the proposed method and apparatus can be applied to detect grain cleaning loss quantitatively.

A hybrid detection algorithm for 5G OTFS waveform for 64 and 256 QAM with Rayleigh and Rician channels

Abstract Signal detection in orthogonal time frequency space modulation is one of the critical aspects for enhancing the throughput of the beyond fifth-generation framework, especially in challenging environments characterized by high mobility and multipath propagation. In this work, we proposed a hybrid detection algorithm by combining zero-forcing equalization (ZFE) and minimum square error equalization (MMSE), also known as ZFE–MMSE, with Rician and Rayleigh channels for 64 and 256 quadrature amplitude modulation. The combination of ZFE and MMSE allows for a more comprehensive approach to equalization. ZFE addresses channel-induced distortions, while MMSE tackles the impact of noise. Together, they enhance the overall performance of the equalization process, resulting in improved signal detection accuracy. The analysis and comparison of the simulation parameters with traditional detection systems include bit error rate, power spectral density (PSD), and complexity. The projected algorithms achieve a signal-to-noise ratio and a PSD gain of 2 dB and −800, respectively, outperforming the traditional detection techniques.

High Performance NMF based Intrusion Detection System for Big Data IoT Traffic

With the emergence of smart devices and the Internet of Things (IoT), millions of users connected to the network produce massive network traffic datasets. These vast datasets of network traffic, Big Data are challenging to store, deal with and analyse using a single computer. In this paper we developed parallel implementation using a High Performance Computer (HPC) for the Non-Negative Matrix Factorization technique as an engine for an Intrusion Detection System (HPC-NMF-IDS). The large IoT traffic datasets of order of millions samples are distributed evenly on all the computing cores for both storage and speedup purpose. The distribution of computing tasks involved in the Matrix Factorization takes into account the reduction of the communication cost between the computing cores. The experiments we conducted on the proposed HPC-IDS-NMF give better results than the traditional ML-based intrusion detection systems. We could train the HPC model with datasets of one million samples in only 31 seconds instead of the 40 minutes using one processor), that is a speed up of 87 times. Moreover, we have got an excellent detection accuracy rate of 98% for KDD dataset.

Customizable Nichrome Wire Heaters for Molecular Diagnostic Applications.

Accurate sample heating is vital for nucleic acid extraction and amplification, requiring a sophisticated thermal cycling process in nucleic acid detection. Traditional molecular detection systems with heating capability are bulky, expensive, and primarily designed for lab settings. Consequently, their use is limited where lab systems are unavailable. This study introduces a technique for performing the heating process required in molecular diagnostics applicable for point-of-care testing (POCT), by presenting a method for crafting customized heaters using freely patterned nichrome (NiCr) wire. This technique, fabricating heaters by arranging protrusions on a carbon black-polydimethylsiloxane (PDMS) cast and patterning NiCr wire, utilizes cost-effective materials and is not constrained by shape, thereby enabling customized fabrication in both two-dimensional (2D) and three-dimensional (3D). To illustrate its versatility and practicality, a 2D heater with three temperature zones was developed for a portable device capable of automatic thermocycling for polymerase chain reaction (PCR) to detect Escherichia coli (E. coli) O157:H7 pathogen DNA. Furthermore, the detection of the same pathogen was demonstrated using a customized 3D heater surrounding a microtube for loop-mediated isothermal amplification (LAMP). Successful DNA amplification using the proposed heater suggests that the heating technique introduced in this study can be effectively applied to POCT.

Machine Learning-Based Intrusion Detection System for Encrypted Attacks

In today's society, information and communication technology is developing rapidly. With the gradual maturity and popularization of encryption technology, more and more malicious attacks are also using encryption technology to evade the scrutiny of traditional traffic detection systems. Therefore, accurate identification of encrypted attacks has become a research hotspot in the international community. This paper proposes an encrypted traffic detection method based on convolutional neural network (CNN) technology to address the issues of tedious steps and low recognition accuracy in manually extracting traffic features. This method does not require manual or expert feature extraction, and can automatically extract advanced features through CNNs, which are then fed into XGBoost classifiers for classification processing. On the basis of the above methods, this article designs and implements an encrypted traffic intrusion detection system, which is divided into five parts: traffic collection, data processing, model detection, data visualization, and traffic blocking. Reasonable explanations and technical introductions are provided for these modules.

Performance Analysis in Children of Traditional and Deep Learning CT Lung Nodule Computer-Aided Detection Systems Trained on Adults.

BACKGROUND. Although primary lung cancer is rare in children, chest CT is commonly performed to assess for lung metastases in children with cancer. Lung nodule computer-aided detection (CAD) systems have been designed and studied primarily using adult training data, and the efficacy of such systems when applied to pediatric patients is poorly understood. OBJECTIVE. The purpose of this study was to evaluate in children the diagnostic performance of traditional and deep learning CAD systems trained with adult data for the detection of lung nodules on chest CT scans and to compare the ability of such systems to generalize to children versus to other adults. METHODS. This retrospective study included pediatric and adult chest CT test sets. The pediatric test set comprised 59 CT scans in 59 patients (30 boys, 29 girls; mean age, 13.1 years; age range, 4-17 years), which were obtained from November 30, 2018, to August 31, 2020; lung nodules were annotated by fellowship-trained pediatric radiologists as the reference standard. The adult test set was the publicly available adult Lung Nodule Analysis (LUNA) 2016 subset 0, which contained 89 deidentified scans with previously annotated nodules. The test sets were processed through the traditional FlyerScan (github.com/rhardie1/FlyerScanCT) and deep learning Medical Open Network for Artificial Intelligence (MONAI; github.com/Project-MONAI/model-zoo/releases) lung nodule CAD systems, which had been trained on separate sets of CT scans in adults. Sensitivity and false-positive (FP) frequency were calculated for nodules measuring 3-30 mm; nonoverlapping 95% CIs indicated significant differences. RESULTS. Operating at two FPs per scan, on pediatric testing data FlyerScan and MONAI showed significantly lower detection sensitivities of 68.4% (197/288; 95% CI, 65.1-73.0%) and 53.1% (153/288; 95% CI, 46.7-58.4%), respectively, than on adult LUNA 2016 subset 0 testing data (83.9% [94/112; 95% CI, 79.1-88.0%] and 95.5% [107/112; 95% CI, 90.0-98.4%], respectively). Mean nodule size was smaller (p < .001) in the pediatric testing data (5.4 ± 3.1 [SD] mm) than in the adult LUNA 2016 subset 0 testing data (11.0 ± 6.2 mm). CONCLUSION. Adult-trained traditional and deep learning-based lung nodule CAD systems had significantly lower sensitivity for detection on pediatric data than on adult data at a matching FP frequency. The performance difference may relate to the smaller size of pediatric lung nodules. CLINICAL IMPACT. The results indicate a need for pediatric-specific lung nodule CAD systems trained on data specific to pediatric patients.

IMCNN:Intelligent Malware Classification using Deep Convolution Neural Networks as Transfer learning and ensemble learning in honeypot enabled organizational network

Traditional malware detection systems based on signature-based detection methods cannot detect new and unseen malware. Moreover, conventional machine learning methods for malware detection have utilized features extracted through static program analysis or dynamic analysis, which requires code debugging and execution primarily through offline processing; hence not a scalable approach. This paper proposes a novel intelligent malware classification using a deep convolution neural network (IMCNN) in organizational networks enabled with Honeypots. Systematic customization of pre-trained convolutional neural networks(CNN) as a transfer learning and ensemble learning as a classification is presented to detect intelligent modern-day malware. Real-world malware samples are systematically labeled and visualized into grayscale images. Four cutting-edge deep CNN models - VGG16, VGG19, InceptionV3, and ResNet50, are trained on the ImageNet database (≥1 million) and fine-tuned as feature extractors along with a basic CNN model. Three strategies are designed for feature extraction and selection: Rectified linear unit (ReLU) fully connected layer embedded in a deep CNN model, principal component analysis (PCA), and singular value decomposition(SVD). Reduced sets of features are stacked and used to train k-nearest neighbor (k-NN), support vector machine (SVM), and random forest (RF) classifiers for predictions. Subsequently, the predictive probabilities of different machine-learned models are ensembled using a soft voting method for final classification. The proposed method is evaluated on MalImg datasets (9339 malware samples of 25 families) and real-world modern malware datasets (690 malware of 22 families). The experimental results reveal that despite using a reduced feature set, the IMCNN effectively detects malware with 99.36% test accuracy on unseen data for MalImg datasets and 92.11% for real-world malware. In addition, the proposed method is compared with several existing state-of-art malware detection models in terms of performance accuracy and found performing as the best. Experiments demonstrated that the proposed method is resilient to polymorphic code obfuscation used by the malware authors.

Feature Selection based Performance Analysis of Machine Learning Algorithms in Network Intrusion Detection

Information and data security is one of the most challenging tasks for the massive-scale digital revolution all over the world. The very first step to secure our data is to identify invasive conduct and intrusive behavior. However, due to the high scalability of most modern systems and the complex nature of the attacks, the traditional detection system is less reliable. To overcome this challenge, it is necessary to build intelligent and adaptive intrusion detection technologies. That is why this research developed an intrusion detection system using commonly used ML algorithms and analyzed performance from different perspectives. In our pipeline, this exploration applied both supervised and unsupervised learning algorithms. The training and test data were split in multiple ways to evaluate the performance of the models. From the experimental results, it was found that the Light Gradient Boosting Machine (LightGBM) performs better in our context in terms of both precision and recall.

Comparative Analysis of Ultrasonic and Traditional Gas-Leak Detection Systems in the Process Industries: A Monte Carlo Approach

Gas leaks can cause disasters at process sites, including fires and explosions, and thus, effective gas-leak detection systems are required. This study investigated the limitations of conventional detectors and introduced an innovative ultrasonic sensor-based approach for continuous monitoring. A new configuration for a stationary remote ultrasonic gas-leak monitoring system is proposed. The selected material was 1-Butene. The detection probability was assessed through a simulation based on a gas-leak scenario, detailing the selection criteria for leak sites and simulation conditions. Computational fluid-dynamics (CFD) simulations were used to evaluate the detection capability of the existing system, whereas Monte Carlo simulations were used to compare it with the proposed ultrasonic system. The CFD simulation was performed by setting the lower detection limit of the concentration-measurement-type gas detector to 600 ppm, and the leak-detection time was approximately 8.895 s. A Monte Carlo simulation accounting for wind direction showed that the existing system’s average detection probability was 3.41%. By integrating the existing and new systems, the detection probability increased by 96.58% and 3.92% compared with that using only the concentration-measurement and ultrasonic measurement methods, respectively. These rates provide valuable insights for future applications in oil refining and petrochemical industries.

A locational false data injection attack detection method in smart grid based on adversarial variational autoencoders

Stealthy FDIA (False Data Injection Attack) is a serious cyber threat that can modify state estimation of smart grid through maliciously altering the measurement data, but can’t be detected by traditional bad data detection system in smart grid. There exist two weakpoints for numerous deep neural networks (DNNs) based data-driven schemes against FDIA. First, they mainly focus on detecting the presence of FDIA, but fail to localize the specific bus/nodes affected. Second, their performance is not sufficiently desirable under small attack, i.e., anomalies caused by the attack closely resemble normal data. To address the above issues, this paper proposes an effective locational FDIA detection framework based on data reconstruction, AT-GVAE, which seamlessly integrates the variational autoencoders (VAEs) and generative adversarial network paradigm. Specifically, our contributions are threefold. First, the proposed AT-GVAE framework is novelly composed of two main modules: the generative VAE_G and discriminative VAE_D that both play dual roles: reconstruct data from jointly learning distributions of data and latent feature space, and meanwhile play Minmax game with adversarial way. Second, multiple-layer gated recurrent units (GRUs) are utilized as the basic structure of the encoder and decoders in both VAEs, to characterize the temporal correlations of measurement data sequence. Additionally, the self-attention mechanism is used to enhance the expressive ability of GRU based VAEs. Then, the anomaly score for each busbar in the smart grid is determined by comparing the residual between the observed measurement and the outputs of VAE_G and VAE_D, enabling the localization of FDIA. Finally, thorough experiments on multiple power systems with series data of total 3456 measurements demonstrate that, in terms of multiple typical metrics, including false alarm rate vs. detection probability, AUC-ROC, and AUC-PR, our proposed framework outperforms the state-of-the-art GRU, VAE and adversarial training based FDIA detection schemes.

A Few-Shot-Based Model-Agnostic Meta-Learning for Intrusion Detection in Security of Internet of Things

Currently, the effective technologies used to protect the security of the Internet of Things include blockchain and intrusion detection systems. The traditional IoT intrusion detection systems based on supervised learning usually requires a large amount of data for training, with high costs, and most of them can only work in several specific types of attacks. Faced with the variability of current IoT attack methods and the complexity of the network environment, they are usually unable to play a role in a short time. Especially in dealing with new security problems such as Zero-day attacks, which have a small number of learnable samples. Therefore, this paper proposed an IoT intrusion detection model to deal with the situation where learnable samples are insufficient. The model adopts the idea of meta-learning and divides the training process into two layers based on model-agnostic meta-learning. Its purpose is to train a relatively general model using the malicious network flow data of various known attack modes. To this end, a few-shot IoT intrusion detection dataset, FSIDS-IoT, is constructed based on five datasets, namely CIC-DDoS2019, CIC-IDS2017, CSE-CIC-IDS2018, NSL-KDD, and UNSW-NB15. Experiments show that our proposed approach, using only a few gradient steps and a small amount of training data from the new attack type, can perform well to protect cyber security. In the test of identifying unknown attacks, the optimal accuracy under the 5-way 1-shot setting reached 78.26%, 90.09% under the 5-way 5-shot setting, and 92.19% under the 5-way 10-shot setting.