{"id":"https://openalex.org/W7161714845","doi":"https://doi.org/10.48550/arxiv.2605.17530","title":"Few-Shot Network Intrusion Detection Using Online Triplet Mining","display_name":"Few-Shot Network Intrusion Detection Using Online Triplet Mining","publication_year":2026,"publication_date":"2026-05-17","ids":{"openalex":"https://openalex.org/W7161714845","doi":"https://doi.org/10.48550/arxiv.2605.17530"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.17530","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.17530","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.17530","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5111368944","display_name":"Jack Wilkie","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wilkie, Jack","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5031720352","display_name":"Hanan Hindy","orcid":"https://orcid.org/0000-0002-5195-8193"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hindy, Hanan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043208465","display_name":"Christos Tachtatzis","orcid":"https://orcid.org/0000-0001-9150-6805"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tachtatzis, Christos","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025223600","display_name":"Miroslav Bure\u0161","orcid":"https://orcid.org/0000-0002-2994-7826"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Bures, Miroslav","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5005039825","display_name":"Robert Atkinson","orcid":"https://orcid.org/0000-0002-6206-2229"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Atkinson, Robert","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9247999787330627,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9247999787330627,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.012600000016391277,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.00930000003427267,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6492999792098999},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5776000022888184},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.5722000002861023},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.512499988079071},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.3783000111579895},{"id":"https://openalex.org/keywords/rendering","display_name":"Rendering (computer graphics)","score":0.36800000071525574},{"id":"https://openalex.org/keywords/traffic-analysis","display_name":"Traffic analysis","score":0.3467999994754791},{"id":"https://openalex.org/keywords/class","display_name":"Class (philosophy)","score":0.3400999903678894},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.33489999175071716}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6966000199317932},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6492999792098999},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5776000022888184},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.5722000002861023},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.545199990272522},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.512499988079071},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4700999855995178},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4546999931335449},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3783000111579895},{"id":"https://openalex.org/C205711294","wikidata":"https://www.wikidata.org/wiki/Q176953","display_name":"Rendering (computer graphics)","level":2,"score":0.36800000071525574},{"id":"https://openalex.org/C2781317605","wikidata":"https://www.wikidata.org/wiki/Q7832483","display_name":"Traffic analysis","level":2,"score":0.3467999994754791},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.3400999903678894},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.33489999175071716},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.322299987077713},{"id":"https://openalex.org/C123860398","wikidata":"https://www.wikidata.org/wiki/Q6934605","display_name":"Multiclass classification","level":3,"score":0.3179999887943268},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.29750001430511475},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.29580000042915344},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.29120001196861267},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.289900004863739},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.28519999980926514},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.2777999937534332},{"id":"https://openalex.org/C169988225","wikidata":"https://www.wikidata.org/wiki/Q7832484","display_name":"Traffic classification","level":3,"score":0.27390000224113464},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.2678000032901764},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2605000138282776},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.2574000060558319}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.17530","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.17530","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.17530","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.17530","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.4700796902179718,"id":"https://metadata.un.org/sdg/1","display_name":"No poverty"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Network":[0],"intrusion":[1,171],"detection":[2,69,172],"systems":[3],"play":[4],"a":[5,22,35,46,103,117,151,159,177,208],"vital":[6],"role":[7],"in":[8,129,222],"protecting":[9],"networks":[10,105,132],"by":[11,21],"detecting":[12],"malicious":[13,89,181,247],"network":[14],"traffic":[15,76,80],"which":[16,162],"can":[17],"then":[18],"be":[19,107,235],"investigated":[20],"cybersecurity":[23],"operations":[24],"centre.":[25],"State-of-the-art":[26],"approaches":[27,221],"utilise":[28],"supervised":[29],"machine":[30],"learning":[31],"methods":[32,85,239],"to":[33,38,50,64,91,121,165,234],"train":[34,51,122],"classification":[36],"model":[37,191,215],"recognise":[39],"known":[40],"cyberattacks;":[41],"however,":[42],"these":[43,84],"models":[44,70],"require":[45,88],"large":[47],"labelled":[48,114],"dataset":[49],"and":[52,77,158,190,199,205,225],"show":[53],"poor":[54],"performance":[55],"when":[56,110,134,240],"trained":[57,175,241],"on":[58,176,242],"smaller":[59],"datasets.":[60],"In":[61],"an":[62,123],"attempt":[63],"address":[65,142],"this":[66,143,145],"shortcoming,":[67],"anomaly":[68],"learn":[71],"the":[72,148,196,229],"distribution":[73],"of":[74,116,138,150,180,210,249],"benign":[75],"flag":[78],"non-conforming":[79],"as":[81,195,243,245],"malicious.":[82],"While":[83],"do":[86],"not":[87],"examples":[90],"train,":[92],"they":[93],"suffer":[94],"from":[95],"high":[96],"false-positive":[97],"rates":[98],"rendering":[99],"them":[100],"impractical.":[101],"As":[102],"result,":[104],"may":[106],"particularly":[108],"vulnerable":[109],"there":[111],"are":[112],"insufficient":[113],"instances":[115],"specific":[118],"attack":[119],"class":[120],"effective":[124,170],"classifier.":[125],"This":[126],"often":[127],"occurs":[128],"newly":[130],"established":[131],"or":[133],"previously":[135],"unseen":[136],"types":[137],"attacks":[139],"emerge.":[140],"To":[141],"challenge,":[144],"work":[146],"proposes":[147],"use":[149],"triplet":[152,156,185],"network,":[153],"utilising":[154],"online":[155,184],"mining":[157,186],"KNN":[160],"classifier,":[161],"is":[163],"able":[164],"perform":[166],"few-shot":[167,223],"classification,":[168,227],"enabling":[169],"after":[173],"being":[174],"limited":[178],"number":[179],"examples.":[182],"Various":[183],"algorithms":[187],"were":[188,203],"explored":[189],"design":[192],"choices,":[193],"such":[194],"inference":[197],"algorithm":[198],"optimised":[200],"distance":[201],"metrics,":[202],"compared":[204,217],"evaluated":[206],"through":[207],"series":[209],"ablation":[211],"studies.":[212],"The":[213],"final":[214],"was":[216,232],"against":[218],"other":[219],"state-of-the-art":[220],"binary":[224],"multiclass":[226],"where":[228],"proposed":[230],"approach":[231],"found":[233],"competitive":[236],"with":[237],"existing":[238],"little":[244],"10":[246],"samples":[248],"each":[250],"class.":[251]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-20T00:00:00"}