# Few-shot Weakly-supervised Cybersecurity Anomaly Detection

arXiv: https://arxiv.org/abs/2304.07470 · HTML: https://mlsanity.com/paper/2304.07470/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 12 of its 32 references that are in the map.
- First posted on arXiv 15 Apr 2023.

## Builds on (most cited first, 12 of 12)

- [Real-world Anomaly Detection in Surveillance Videos](https://mlsanity.com/paper/1801.04264/) (2018)
- [GANomaly: Semi-Supervised Anomaly Detection via Adversarial Training](https://mlsanity.com/paper/1805.06725/) (2018)
- [Deep Semi-Supervised Anomaly Detection](https://mlsanity.com/paper/1906.02694/) (2019)
- [Zero-Shot Learning -- The Good, the Bad and the Ugly](https://mlsanity.com/paper/1703.04394/) (2017)
- [Deep Learning for Anomaly Detection: A Review](https://mlsanity.com/paper/2007.02500/) (2020)
- [Deep Anomaly Detection with Deviation Networks](https://mlsanity.com/paper/1911.08623/) (2019)
- [Explainable Deep Few-shot Anomaly Detection with Deviation Networks](https://mlsanity.com/paper/2108.00462/) (2021)
- [Few-shot Network Anomaly Detection via Cross-network Meta-learning](https://mlsanity.com/paper/2102.11165/) (2021)
- [A Hierarchical Transformation-Discriminating Generative Model for Few Shot Anomaly Detection](https://mlsanity.com/paper/2104.14535/) (2021)
- [On the Nature and Types of Anomalies: A Review of Deviations in Data](https://mlsanity.com/paper/2007.15634/) (2020)
- [Federated TON_IoT Windows Datasets for Evaluating AI-based Security Applications](https://mlsanity.com/paper/2010.08522/) (2020)
- [A Hybrid Deep Learning Anomaly Detection Framework for Intrusion Detection](https://mlsanity.com/paper/2212.00966/) (2022)

## Built on by (most cited first, 2 of 2)

- [Learning in Multiple Spaces: Few-Shot Network Attack Detection with Metric-Fused Prototypical Networks](https://mlsanity.com/paper/2501.00050/) (2024)
- [CGGM: A conditional graph generation model with adaptive sparsity for node anomaly detection in IoT networks](https://mlsanity.com/paper/2402.17363/) (2024)

## Abstract (arXiv)

With increased reliance on Internet based technologies, cyberattacks compromising users' sensitive data are becoming more prevalent. The scale and frequency of these attacks are escalating rapidly, affecting systems and devices connected to the Internet. The traditional defense mechanisms may not be sufficiently equipped to handle the complex and ever-changing new threats. The significant breakthroughs in the machine learning methods including deep learning, had attracted interests from the cybersecurity research community for further enhancements in the existing anomaly detection methods. Unfortunately, collecting labelled anomaly data for all new evolving and sophisticated attacks is not practical. Training and tuning the machine learning model for anomaly detection using only a handful of labelled data samples is a pragmatic approach. Therefore, few-shot weakly supervised anomaly detection is an encouraging research direction. In this paper, we propose an enhancement to an existing few-shot weakly-supervised deep learning anomaly detection framework. This framework incorporates data augmentation, representation learning and ordinal regression. We then evaluated and showed the performance of our implemented framework on three benchmark datasets: NSL-KDD, CIC-IDS2018, and TON_IoT.