A web-based Network Intrusion Detection System (NIDS) that uses Few-Shot Learning (FSL) via a Siamese Neural Network to classify network traffic with minimal labelled examples.
Built on the CICIDS2017 dataset and presented through a FastAPI backend + Next.js dashboard.
This project accompanies the peer-reviewed paper:
Few-Shot Intrusion Detection Using Siamese Networks for Zero-Day Threats Presented at the 2025 IEEE World Forum on Public Safety Technology (WF-PST).
@inproceedings{nids_fsl_siamese_2025,
title = {Few-Shot Intrusion Detection Using Siamese Networks for Zero-Day Threats},
booktitle = {2025 IEEE World Forum on Public Safety Technology (WF-PST)},
year = {2025},
doi = {10.1109/WF-PST65083.2025.00029},
publisher = {IEEE}
}Modern Network Intrusion Detection Systems (NIDS) struggle with zero-day and low-frequency attacks because supervised deep-learning models require large, balanced, labelled datasets — a condition rarely met in real-world traffic. This work reframes intrusion detection as a similarity-learning problem: instead of classifying each flow independently, a Siamese neural network learns an embedding space in which flows of the same class cluster together and flows of different classes are pushed apart. At inference time, a previously-unseen attack class can be recognised from only a handful of labelled examples, without retraining the model.
The approach is validated on the CICIDS2017 benchmark under an extreme few-shot regime (90% of flow pairs withheld from training), and achieves high precision on DoS-family attacks while keeping the model small enough to serve from a standard web API.
- Similarity-based detection. A Siamese twin-network architecture is used to learn a metric over CICFlowMeter features, enabling classification of new attack families from very few labelled samples.
- Aggressive feature selection. The original 78-feature CICIDS2017 flow representation is reduced to 49 features by dropping low-signal TCP-flag counts, bulk-rate statistics, and redundant forward-packet-length statistics.
- Extreme few-shot evaluation. The model is trained on only 10% of generated flow pairs and evaluated on the remaining 90%, simulating operationally realistic data scarcity.
- End-to-end deployment. The trained model is wrapped in a FastAPI service and a Next.js dashboard, demonstrating that a few-shot NIDS can be operationalised as a lightweight web application.
| Component | Technology |
|---|---|
| ML Model | Siamese Neural Network (TensorFlow/Keras) |
| Dataset | CICIDS2017 (Wednesday capture) |
| Backend API | FastAPI + Uvicorn |
| Frontend | Next.js 15 + TypeScript + Tailwind CSS |
| Containerisation | Docker + Docker Compose |
The Siamese network consists of two identical shared-weight branches (the twin encoders) that map each input flow into a 64-dimensional embedding. The absolute difference of the two embeddings is passed through a sigmoid-activated dense layer to produce a similarity score.
Flow A ──► [Dense 64 → BatchNorm → Dense 128 → Dense 64] ──►│
├─► |A - B| ──► Dense 1 (sigmoid)
Flow B ──► [Dense 64 → BatchNorm → Dense 128 → Dense 64] ──►│
| Parameter | Value |
|---|---|
| Input dimensionality | 49 flow features |
| Encoder hidden layers | Dense(64) → BatchNorm → Dense(128) → Dense(64), ReLU |
| Distance function | L1 (absolute difference) |
| Output | Similarity score in [0, 1] (1 = same class) |
| Loss | Binary cross-entropy |
| Optimiser | Adam |
| Batch size | 16 |
| Epochs | 50 |
| Train / test split | 10% / 90% (few-shot regime) |
For each flow in the training set, one positive pair (same-class) and one negative pair (different-class) are generated by uniform sampling, producing a balanced contrastive training set before the 10/90 split.
After dropping 29 low-signal features (TCP flag counts, bulk-rate averages, redundant forward-packet-length statistics, and initial window bytes), the model retains:
Destination Port, Flow Duration, Total Fwd/Bwd Packets, Total Length of Bwd Packets, Bwd Packet Length (Max/Min/Mean/Std), Flow Bytes/s, Flow Packets/s, Flow IAT (Mean/Std/Max), Fwd IAT (Total/Mean/Std/Max/Min), Bwd IAT (Total/Mean/Std/Max), Fwd/Bwd Header Length, Fwd Packets/s, Packet Length (Min/Max/Mean/Std/Variance), Average Packet Size, Avg Fwd/Bwd Segment Size, Subflow Fwd/Bwd (Packets/Bytes),
act_data_pkt_fwd,min_seg_size_forward, Active (Mean/Std/Max/Min), Idle (Mean/Std/Max/Min).
Evaluation on CICIDS2017 Wednesday sample (Wednesday_200.csv, 200 flows, 49 features, 10/90 few-shot split):
| Metric | Score |
|---|---|
| Accuracy | 0.9750 |
| Precision | 1.0000 |
| Recall | 0.9500 |
| F1 Score | 0.9744 |
Confusion matrix (pair-similarity classification, threshold = 0.5):
| Pred. Negative | Pred. Positive | |
|---|---|---|
| Actual Negative | 20 | 0 |
| Actual Positive | 1 | 19 |
The perfect precision indicates that no benign pairs were mis-labelled as matching attack pairs (zero false positives), while the one missed positive pair accounts for the 5% recall gap. These results support the paper's claim that similarity learning can be effective even when only a small fraction of the data is available at training time.
CICIDS2017 — Canadian Institute for Cybersecurity Intrusion Detection Evaluation Dataset.
- Capture day used: Wednesday (DoS Slowloris, DoS Slowhttptest, DoS Hulk, DoS GoldenEye, Heartbleed)
- Sample used for baseline:
Wednesday_200.csv(200 flows) - Labels:
BENIGN+ various DoS attack types
Download the full dataset from the UNB CIC website.
Place the CSV in backend/data/ before training.
NIDS/
├── backend/
│ ├── main.py # FastAPI app + routes
│ ├── requirements.txt
│ ├── Dockerfile
│ └── .env.example
├── frontend/
│ ├── src/
│ │ ├── app/
│ │ │ ├── page.tsx # Dashboard homepage
│ │ │ └── layout.tsx
│ │ └── lib/
│ │ └── api.ts # API client
│ ├── package.json
│ ├── next.config.ts
│ └── Dockerfile
├── docker-compose.yml
└── TKNR_FSL_SIA_Baseline.ipynb # Training + evaluation notebook
- Python 3.11+
- Node.js 20+
- (Optional) Docker + Docker Compose
cd backend
python -m venv venv
venv\Scripts\activate # Windows
# source venv/bin/activate # macOS/Linux
pip install -r requirements.txt
uvicorn main:app --reloadAPI will be running at http://localhost:8000 Interactive docs at http://localhost:8000/docs
cd frontend
npm install
npm run devDashboard will be running at http://localhost:3000
docker-compose up --build| Method | Endpoint | Description |
|---|---|---|
GET |
/ |
Root / info |
GET |
/health |
Health check |
POST |
/predict |
Classify a network flow |
curl -X POST http://localhost:8000/predict \
-H "Content-Type: application/json" \
-d '{"Flow Duration": 1200, "Total Fwd Packets": 5, ...}'{
"predicted_class": "BENIGN",
"confidence": 0.87
}Open and run the notebook in Google Colab or Jupyter:
TKNR_FSL_SIA_Baseline.ipynb
The notebook handles:
- Loading
Wednesday_200.csv - Dropping the 29 low-signal features and scaling the remaining 49 with
MinMaxScaler - Encoding labels and generating balanced positive/negative flow pairs
- Splitting pairs 10% train / 90% test
- Training the Siamese network for 50 epochs with Adam + binary cross-entropy
- Reporting accuracy, precision, recall, F1, and the confusion matrix
After training, export and save:
backend/models/siamese_model.kerasbackend/models/scaler.joblib
- Wire up saved model to
/predictendpoint - Add support-set based few-shot classification endpoint
- Upload CSV for batch prediction in the dashboard
- Live traffic capture via CICFlowMeter integration
- Charts: confusion matrix, per-class confidence, training history
- Authentication for the dashboard
TKNR
Collaborator: Fahim Nafis
If you use this work, please cite the WF-PST 2025 paper (see Publication).
MIT