Few-Shot Learning for Network Intrusion Detection: Methods, Datasets, and Performance
A PRISMA-style review of 21 few-shot learning studies for network intrusion detection finds meta-learning and CNNs dominant and evaluation inconsistently reported.
The systematic review screened 1,358 records from ACM Digital Library, IEEE Xplore, and Scopus covering 2022-2026 and retained 21 studies on few-shot learning for network intrusion detection. Meta-learning (8 studies) and convolutional neural networks (10) are the most common approaches, while CIC-IDS2017 and CSE-CIC-IDS2018 are the most frequently used datasets. Most evaluations use five or fewer samples per class, and missing parameters and source code limit reproducibility and direct comparison.
- 21 FSL-for-NIDS studies retained from 1,358 initial records
- CNNs (10) and meta-learning (8) dominate the approaches
- CIC-IDS2017 and CSE-CIC-IDS2018 are the most used benchmarks
- Most settings evaluate five or fewer samples per class
- Reproducibility hindered by missing parameters and source code
Full article166 words · extracted from arxiv.org · click to collapse
Anomaly-based network intrusion detection systems (NIDS) are an important first line of defense. However, training NIDS for new attack types is challenging, because labeled attack data are rarely available. Few-shot learning (FSL) addresses this problem by learning from few samples. However, the approaches and evaluation settings, that have been investigated so far, vary widely. This work systematically reviews FSL approaches for NIDS published from 2022 to 2026. We conduct a systematic literature review with PRISMA 2020-like reporting to search ACM Digital Library, IEEE Xplore, and Scopus. From a set of 1,358 initial records, we retain 21 studies after screening, deduplication, and quality filtering. We classify the applied FSL approaches, datasets, and experimental parameters and compare reported performance. Meta-learning and convolutional neural networks are the most common approaches, with 8 and 10 studies, respectively. Most studies evaluate five or fewer samples per class, although settings vary. CIC-IDS2017 and CSE-CIC-IDS2018 are the most frequently used datasets. Missing parameters and source code limit reproducibility and direct comparison between approaches.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.11275