A Few-Shot Network Flow Attack Classification via Graph Contrastive Learning

Accurately identifying network attacks is crucial for maintaining network security. However, these attacks are often hide within massive volumes of network traffic, posing significant challenges for traditional detection methods. Supervised learning approaches require substantial labeled data and struggle to adapt to unknown attack types, while unsupervised methods face difficulties in accurately pinpointing specific attack categories. To address these limitations, we propose a novel fewshot learning model for network flow attack classification based on graph contrastive learning. Our model leverages contrastive learning to enhance feature representation and generalization capabilities, enabling high-accuracy attack detection even with limited training data. Specifically, we first construct a multi- graph representation of network traffic and segment the data into snapshots. Then, we perform graph data augmentation within each snapshot to generate augmented sample pairs, which are used to pre-train the model via contrastive learning. Finally, we fine-tune the model parameters to achieve multi-class attack classification, leveraging the learned feature representations to identify various attack types, even those unseen during training. Experimental results demonstrate that our model exhibits excellent generalization ability and achieves high attack detection performance, even with limited training data.