{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T00:17:53Z","timestamp":1778199473822,"version":"3.51.4"},"reference-count":58,"publisher":"Wiley","issue":"1","license":[{"start":{"date-parts":[[2021,9,14]],"date-time":"2021-09-14T00:00:00Z","timestamp":1631577600000},"content-version":"vor","delay-in-days":256,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Youth Fund Project of the National Nature Fund of China","award":["62002038"],"award-info":[{"award-number":["62002038"]}]}],"content-domain":{"domain":["onlinelibrary.wiley.com"],"crossmark-restriction":true},"short-container-title":["Computational Intelligence and Neuroscience"],"published-print":{"date-parts":[[2021,1]]},"abstract":"<jats:p>Network intrusion detection remains one of the major challenges in cybersecurity. In recent years, many machine\u2010learning\u2010based methods have been designed to capture the dynamic and complex intrusion patterns to improve the performance of intrusion detection systems. However, two issues, including imbalanced training data and new unknown attacks, still hinder the development of a reliable network intrusion detection system. In this paper, we propose a novel few\u2010shot learning\u2010based Siamese capsule network to tackle the scarcity of abnormal network traffic training data and enhance the detection of unknown attacks. In specific, the well\u2010designed deep learning network excels at capturing dynamic relationships across traffic features. In addition, an unsupervised subtype sampling scheme is seamlessly integrated with the Siamese network to improve the detection of network intrusion attacks under the circumstance of imbalanced training data. Experimental results have demonstrated that the metric learning framework is more suitable to extract subtle and distinctive features to identify both known and unknown attacks after the sampling scheme compared to other supervised learning methods. Compared to the state\u2010of\u2010the\u2010art methods, our proposed method achieves superior performance to effectively detect both types of attacks.<\/jats:p>","DOI":"10.1155\/2021\/7126913","type":"journal-article","created":{"date-parts":[[2021,9,14]],"date-time":"2021-09-14T21:20:09Z","timestamp":1631654409000},"update-policy":"https:\/\/doi.org\/10.1002\/crossmark_policy","source":"Crossref","is-referenced-by-count":32,"title":["A Few\u2010Shot Learning\u2010Based Siamese Capsule Network for Intrusion Detection with Imbalanced Training Data"],"prefix":"10.1155","volume":"2021","author":[{"given":"Zu-Min","family":"Wang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5684-2571","authenticated-orcid":false,"given":"Ji-Yu","family":"Tian","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0577-1755","authenticated-orcid":false,"given":"Jing","family":"Qin","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9365-7420","authenticated-orcid":false,"given":"Hui","family":"Fang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Li-Ming","family":"Chen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"311","published-online":{"date-parts":[[2021,9,14]]},"reference":[{"key":"e_1_2_9_1_2","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-019-0038-7"},{"key":"e_1_2_9_2_2","doi-asserted-by":"publisher","DOI":"10.1109\/tetci.2017.2772792"},{"key":"e_1_2_9_3_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2019.102419"},{"key":"e_1_2_9_4_2","doi-asserted-by":"crossref","unstructured":"FarahnakianF.andHeikkonenJ. A deep auto-encoder based approach for intrusion detection system Proceedings of the 2018 20th International Conference on Advanced Communication Technology (ICACT) February 2018 Chuncheon South Korea IEEE https:\/\/doi.org\/10.23919\/icact.2018.8323687.","DOI":"10.23919\/ICACT.2018.8323688"},{"key":"e_1_2_9_5_2","doi-asserted-by":"crossref","unstructured":"VinayakumarR. SomanK. P. andPoornachandranP. Applying convolutional neural network for network intrusion detection Proceedings of the 2017 International Conference on Advances in Computing Communications and Informatics (ICACCI) September 2017 Udupi India IEEE https:\/\/doi.org\/10.1109\/icacci.2017.8126009 2-s2.0-85042795027.","DOI":"10.1109\/ICACCI.2017.8126009"},{"key":"e_1_2_9_6_2","doi-asserted-by":"crossref","unstructured":"MirzaA. H.andCosanS. Computer network intrusion detection using sequential LSTM neural networks autoencoders Proceedings of the 2018 26th Signal Processing and Communications Applications Conference (SIU) May 2018 Izmir Turkey IEEE.","DOI":"10.1109\/SIU.2018.8404689"},{"key":"e_1_2_9_7_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2016.10.015"},{"key":"e_1_2_9_8_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2017.09.014"},{"key":"e_1_2_9_9_2","doi-asserted-by":"publisher","DOI":"10.3233\/ida-173493"},{"key":"e_1_2_9_10_2","doi-asserted-by":"publisher","DOI":"10.1145\/3178582"},{"key":"e_1_2_9_11_2","doi-asserted-by":"crossref","unstructured":"SuP. LiuY. andSongX. Research on intrusion detection method based on improved smote and XGBoost Proceedings of the 8th International Conference on Communication and Network Security November 2018 Qingdao China https:\/\/doi.org\/10.1145\/3290480.3290505 2-s2.0-85059888172.","DOI":"10.1145\/3290480.3290505"},{"key":"e_1_2_9_12_2","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/5593435"},{"key":"e_1_2_9_13_2","doi-asserted-by":"publisher","DOI":"10.1002\/sec.564"},{"key":"e_1_2_9_14_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2020.107315"},{"key":"e_1_2_9_15_2","doi-asserted-by":"publisher","DOI":"10.1155\/2017\/8501683"},{"key":"e_1_2_9_16_2","doi-asserted-by":"crossref","unstructured":"ChowdhuryM. M. U. HammondF. KonowiczG. XinC. WuH. andLiJ. A few-shot deep learning approach for improved intrusion detection Proceedings of the 2017 IEEE 8th Annual Ubiquitous Computing Electronics and Mobile Communication Conference (UEMCON) October 2017 New York NY USA IEEE https:\/\/doi.org\/10.1109\/uemcon.2017.8249084 2-s2.0-85046255378.","DOI":"10.1109\/UEMCON.2017.8249084"},{"key":"e_1_2_9_17_2","doi-asserted-by":"publisher","DOI":"10.1109\/access.2020.2980136"},{"key":"e_1_2_9_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/tifs.2020.2991876"},{"key":"e_1_2_9_19_2","unstructured":"WanZ. ChenD. LiY. YanX. ZhangJ. YuY. andLiaoJ. Transductive zero-shot learning with visual structure constraint Proceedings of the 33rd Conference on Neural Information Processing Systems December 2019 Vancouver Canada NeurIPS."},{"key":"e_1_2_9_20_2","doi-asserted-by":"publisher","DOI":"10.3233\/jifs-18350"},{"key":"e_1_2_9_21_2","doi-asserted-by":"publisher","DOI":"10.1145\/3168446"},{"key":"e_1_2_9_22_2","doi-asserted-by":"publisher","DOI":"10.1109\/access.2018.2868993"},{"key":"e_1_2_9_23_2","doi-asserted-by":"publisher","DOI":"10.1155\/2018\/6026878"},{"key":"e_1_2_9_24_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2017.2780250"},{"key":"e_1_2_9_25_2","doi-asserted-by":"crossref","unstructured":"MirskyY. DoitshmanT. EloviciY. andShabtaiA. Kitsune: an ensemble of autoencoders for online network intrusion detection Proceedings f the 2018 Network and Distributed System Security Symposium February 2018 San Diego CA USA https:\/\/doi.org\/10.14722\/ndss.2018.23204.","DOI":"10.14722\/ndss.2018.23204"},{"key":"e_1_2_9_26_2","doi-asserted-by":"crossref","unstructured":"BovenziG. AcetoG. CiuonzoD. PersicoV. andPescap\u00e9A. A hierarchical hybrid intrusion detection approach in IoT scenarios Proceedings of the GLOBECOM 2020-2020 IEEE Global Communications Conference December 2020 Taipei Taiwan IEEE https:\/\/doi.org\/10.1109\/globecom42002.2020.9348167.","DOI":"10.1109\/GLOBECOM42002.2020.9348167"},{"key":"e_1_2_9_27_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2019.112963"},{"key":"e_1_2_9_28_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2020.107247"},{"key":"e_1_2_9_29_2","doi-asserted-by":"publisher","DOI":"10.3390\/electronics8030322"},{"key":"e_1_2_9_30_2","unstructured":"IbrahimY. MasumR. andSirajA. Addressing imbalanced data problem with generative adversarial network for intrusion detection Proceedings of the 2020 IEEE 21st International Conference on Information Reuse and Integration for Data Science (IRI) August 2020 Las Vegas NV USA IEEE."},{"key":"e_1_2_9_31_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2019.05.013"},{"key":"e_1_2_9_32_2","doi-asserted-by":"crossref","unstructured":"EnglyA. H. LarsenA. R. andMengW. Evaluation of anomaly-based intrusion detection with combined imbalance correction and feature selection Proceedings of the International Conference on Network and System Security November 2020 Melbourne Australia Springer https:\/\/doi.org\/10.1007\/978-3-030-65745-1_16.","DOI":"10.1007\/978-3-030-65745-1_16"},{"key":"e_1_2_9_33_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10115-018-1306-7"},{"key":"e_1_2_9_34_2","doi-asserted-by":"publisher","DOI":"10.3390\/app9020238"},{"key":"e_1_2_9_35_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2016.03.038"},{"key":"e_1_2_9_36_2","unstructured":"FinnC. Learning to learn with gradients 2018 University of California Berkeley CA USA UCB\/EECS-2018-105."},{"key":"e_1_2_9_37_2","unstructured":"SnellJ. SwerskyK. andZemelR. Prototypical networks for few-shot learning 2017 https:\/\/arxiv.org\/abs\/1703.05175."},{"key":"e_1_2_9_38_2","doi-asserted-by":"crossref","unstructured":"SungF. YangY. ZhangL. XiangT. TorrP. H. S. andHospedalesT. M. Learning to compare: relation network for few-shot learning 2018 https:\/\/arxiv.org\/abs\/1711.06025.","DOI":"10.1109\/CVPR.2018.00131"},{"key":"e_1_2_9_39_2","unstructured":"VinyalsO. BlundellC. LillicrapT. KavukcuogluK. andWierstraD. Matching networks for one shot learning 2016 https:\/\/arxiv.org\/abs\/1606.04080."},{"key":"e_1_2_9_40_2","volume-title":"Siamese Neural Networks for One-Shot Image Recognition","author":"Koch G.","year":"2015"},{"key":"e_1_2_9_41_2","unstructured":"MirzaM.andSimonO. Conditional generative adversarial nets 2014 https:\/\/arxiv.org\/abs\/1411.1784."},{"key":"e_1_2_9_42_2","doi-asserted-by":"crossref","unstructured":"HuangS.-W. LinC.-T. ChenS.-P. WuY.-Y. HsuP.-H. andLaiS.-H. AugGAN: cross domain adaptation with GAN-based data augmentation Proceedings of the European Conference on Computer Vision (ECCV) September 2018 Munich Germany https:\/\/doi.org\/10.1007\/978-3-030-01240-3_44 2-s2.0-85055081385.","DOI":"10.1007\/978-3-030-01240-3_44"},{"key":"e_1_2_9_43_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2019.05.080"},{"key":"e_1_2_9_44_2","doi-asserted-by":"crossref","unstructured":"SharafaldinI. LashkariA. H. andGhorbaniA. A. Toward generating a new intrusion detection dataset and intrusion traffic characterization Proceedings of the 4th International Conference on Information Systems Security and Privacy January 2018 Funchal Portugal https:\/\/doi.org\/10.5220\/0006639801080116.","DOI":"10.5220\/0006639801080116"},{"key":"e_1_2_9_45_2","doi-asserted-by":"publisher","DOI":"10.3390\/j2020016"},{"key":"e_1_2_9_46_2","doi-asserted-by":"crossref","unstructured":"AranganayagiS.andThangavelK. Clustering categorical data using silhouette coefficient as a relocating measure 2 Proceedings of the International Conference on Computational Intelligence and Multimedia Applications (ICCIMA 2007) December 2007 Sivakasi India IEEE https:\/\/doi.org\/10.1109\/iccima.2007.328 2-s2.0-41149156014.","DOI":"10.1109\/ICCIMA.2007.328"},{"key":"e_1_2_9_47_2","article-title":"Intrusion detection model of random attention capsule network based on variable fusion","volume":"41","author":"Zhang X.","year":"2020","journal-title":"Journal on Communications"},{"key":"e_1_2_9_48_2","unstructured":"SabourS. FrosstN. andHintonG. E. Dynamic routing between capsules 2017 https:\/\/arxiv.org\/abs\/1710.09829."},{"key":"e_1_2_9_49_2","unstructured":"BujaA. WernerS. andShenY. Loss functions for binary class probability estimation and classification: structure and applications 2005."},{"key":"e_1_2_9_50_2","unstructured":"KingmaD.andBaJ. Adam: a method for stochastic optimization 2014 https:\/\/arxiv.org\/abs\/1412.6980."},{"key":"e_1_2_9_51_2","doi-asserted-by":"crossref","unstructured":"MoustafaN.andSlayJ. UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set) Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS) November 2015 Canberra Australia IEEE https:\/\/doi.org\/10.1109\/milcis.2015.7348942 2-s2.0-84969651789.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"e_1_2_9_52_2","unstructured":"SimonyanK.andZissermanA. Very deep convolutional networks for large-scale image recognition 2014 https:\/\/arxiv.org\/abs\/1409.1556."},{"key":"e_1_2_9_53_2","doi-asserted-by":"crossref","unstructured":"HeK. ZhangX. RenS. andSunJ. Deep residual learning for image recognition 2016 https:\/\/arxiv.org\/abs\/1512.03385.","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_2_9_54_2","doi-asserted-by":"publisher","DOI":"10.1109\/lgrs.2019.2894399"},{"key":"e_1_2_9_55_2","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2020.3017882"},{"key":"e_1_2_9_56_2","doi-asserted-by":"publisher","DOI":"10.1109\/access.2021.3100087"},{"key":"e_1_2_9_57_2","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2020.3022432"},{"key":"e_1_2_9_58_2","doi-asserted-by":"publisher","DOI":"10.1002\/nem.2050"}],"container-title":["Computational Intelligence and Neuroscience"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/downloads.hindawi.com\/journals\/cin\/2021\/7126913.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/cin\/2021\/7126913.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1155\/2021\/7126913","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,8,6]],"date-time":"2024-08-06T12:05:41Z","timestamp":1722945941000},"score":1,"resource":{"primary":{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/10.1155\/2021\/7126913"}},"subtitle":[],"editor":[{"given":"Hubert","family":"Cecotti","sequence":"additional","affiliation":[],"role":[{"role":"editor","vocabulary":"crossref"}]}],"short-title":[],"issued":{"date-parts":[[2021,1]]},"references-count":58,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2021,1]]}},"alternative-id":["10.1155\/2021\/7126913"],"URL":"https:\/\/doi.org\/10.1155\/2021\/7126913","archive":["Portico"],"relation":{},"ISSN":["1687-5265","1687-5273"],"issn-type":[{"value":"1687-5265","type":"print"},{"value":"1687-5273","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,1]]},"assertion":[{"value":"2021-06-10","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2021-08-30","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2021-09-14","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"7126913"}}