# Few-Shot Network Intrusion Detection Using Online Triplet Mining

arXiv: https://arxiv.org/abs/2605.17530 · HTML: https://mlsanity.com/paper/2605.17530/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 42 references that are in the map.
- First posted on arXiv 17 May 2026.

## Builds on (most cited first, 9 of 9)

- [Emerging Properties in Self-Supervised Vision Transformers](https://mlsanity.com/paper/2104.14294/) (2021)
- [FaceNet: A Unified Embedding for Face Recognition and Clustering](https://mlsanity.com/paper/1503.03832/) (2015)
- [In Defense of the Triplet Loss for Person Re-Identification](https://mlsanity.com/paper/1703.07737/) (2017)
- [Learning a Neural-network-based Representation for Open Set Recognition](https://mlsanity.com/paper/1802.04365/) (2018)
- [Deep Autoencoding GMM-based Unsupervised Anomaly Detection in Acoustic Signals and its Hyper-parameter Optimization](https://mlsanity.com/paper/2009.12042/) (2020)
- [A Grassmannian Approach to Zero-Shot Learning for Network Intrusion Detection](https://mlsanity.com/paper/1709.07984/) (2017)
- [Deep Learning for Network Anomaly Detection under Data Contamination: Evaluating Robustness and Mitigating Performance Degradation](https://mlsanity.com/paper/2407.08838/) (2024)
- [Leveraging Siamese Networks for One-Shot Intrusion Detection Model](https://mlsanity.com/paper/2006.15343/) (2020)
- [Utilising Deep Learning Techniques for Effective Zero-Day Attack Detection](https://mlsanity.com/paper/2006.15344/) (2020)

## Abstract (arXiv)

Network intrusion detection systems play a vital role in protecting networks by detecting malicious network traffic which can then be investigated by a cybersecurity operations centre. State-of-the-art approaches utilise supervised machine learning methods to train a classification model to recognise known cyberattacks; however, these models require a large labelled dataset to train and show poor performance when trained on smaller datasets. In an attempt to address this shortcoming, anomaly detection models learn the distribution of benign traffic and flag non-conforming traffic as malicious. While these methods do not require malicious examples to train, they suffer from high false-positive rates rendering them impractical. As a result, networks may be particularly vulnerable when there are insufficient labelled instances of a specific attack class to train an effective classifier. This often occurs in newly established networks or when previously unseen types of attacks emerge. To address this challenge, this work proposes the use of a triplet network, utilising online triplet mining and a KNN classifier, which is able to perform few-shot classification, enabling effective intrusion detection after being trained on a limited number of malicious examples. Various online triplet mining algorithms were explored and model design choices, such as the inference algorithm and optimised distance metrics, were compared and evaluated through a series of ablation studies. The final model was compared against other state-of-the-art approaches in few-shot binary and multiclass classification, where the proposed approach was found to be competitive with existing methods when trained on as little as 10 malicious samples of each class.