TY  - EJOU
AU  - Revell, Liam 
AU  - Kang, Hyunjae 
AU  - Seo, Jung Taek 
AU  - Kim, Dan Dongseong 

TI  - Systematic Evaluation of Few-Shot Learning for Unseen IoT Network Attack Detection
T2  - Computer Modeling in Engineering \& Sciences

PY  - 2026
VL  - 147
IS  - 1
SN  - 1526-1506

AB  - The rapid proliferation of Internet of Things (IoT) devices has increased the importance of network intrusion detection systems (NIDS) for protecting modern networks. However, many machine learning and deep learning based NIDS rely on large volumes of labeled attack data, which is often impractical to obtain for newly emerging or rare attacks. This paper presents a benchmark-style systematic evaluation of meta-learning-based Few-Shot Learning (FSL) classifiers for detecting previously unseen intrusions with limited labeled data. We investigate three representative FSL models, namely Prototypical Networks, Relation Networks, and MetaOptNet, and further examine two decision-level ensemble strategies based on majority voting and probability averaging. Experiments are conducted on the UQ-IoT-IDS-2021 dataset under four attack distributions and five <i>K</i>-shot settings (<mml:math id="mml-ieqn-1"><mml:mi>K</mml:mi><mml:mo>∈</mml:mo><mml:mo fence="false" stretchy="false">{</mml:mo><mml:mn>3</mml:mn><mml:mo>,</mml:mo><mml:mn>5</mml:mn><mml:mo>,</mml:mo><mml:mn>7</mml:mn><mml:mo>,</mml:mo><mml:mn>10</mml:mn><mml:mo>,</mml:mo><mml:mn>15</mml:mn><mml:mo fence="false" stretchy="false">}</mml:mo></mml:math>), with performance reported separately for seen and unseen attacks using class-balanced macro-averaged F1 score. The experimental results show that MetaOptNet consistently provides the strongest and most stable performance on unseen attacks. Furthermore, investigating decision-level ensembling reveals that probability averaging frequently matches or marginally outperforms the best base model by successfully mitigating weaker predictions, whereas majority voting demonstrates slight performance degradation due to strict consensus requirements. We also highlight prominent error modes, such as benign-attack ambiguity and cross-device attack correlations, alongside an analysis of model complexity and inference latency. These findings highlight the potential of few-shot learning for data-scarce intrusion detection and provide insights into model selection and architectural trade-offs under varying support set sizes and attack compositions.
KW  - Few-shot learning; IoT security; network intrusion detection; meta-learning

DO  - 10.32604/cmes.2026.078467