A Novel Semantic Driven Meta-Learning Model for Rare Attack Detection

Accurate network intrusion detection requires extracting relevant semantic features to minimize mis-classification and identify various kinds of attacks. Traditional models often struggle with uncertain traffic patterns, reducing their reliability. This work presents a Novel Semantic-Driven Meta-Learning Model - a hybrid framework that systematically refines categorization decisions. It uses advanced learning techniques to improve detection through a two-stage verification process. Our approach enhances intrusion detection by integrating an attention-based model for semantic feature extraction and the Simple Neural Attentive Meta-Learner (SNAIL) for rare attack class detection. In the first phase, machine learning classifiers perform macro-classification to distinguish between normal and attack traffic. To reduce mis-classification, an additional classifier verifies the predicted class label using a refined subset of features. In the second phase, the SNAIL model conducts micro-classification, further differentiating attack classes with high precision. This dual-phase strategy is particularly effective in addressing the challenge of detecting rare classes in highly imbalanced network intrusion datasets. Using the NSL-KDD, CSE-CIC-IDS 2018, and CIC-ToN-IoT datasets, we assess our model, showing its better performance in precisely detecting unusual attack types while preserving a low false alarm rate with semantic characteristics. The proposed model demonstrates a higher detection rate for most of the rare classes considered in our study compared to state-of-the-art methods.