## 3 Our Proposed Few-Shot Intrusion Detection Method  
Supervised learning approaches for network intrusion detection require all categories of attacks to be known in advance, with a sufficient number of training examples available for each category. The basic task is to use a classifier, \(f\), to infer labels for network traffic samples, \(N\). The number of samples, \(N\), is often very large and is simply composed of two groups: a training set and a test set. Contrary to this, in real-world settings, new attacks frequently emerge, and only subset of categories are known beforehand, with few examples per category. Therefore, in such scenarios, where the number of samples, \(N\), is small, the problem is considered as a few-shot classification. Applying the conditions of a supervised learning method to this problem will encounter overfitting.  
Few-shot learning is popularly addressed based on the meta-learning paradigm, which is composed of meta-training and meta-testing. Each one of the meta stages consists of a number of classification tasks, where each task describes a pair: training (support) and testing (query). The meta-training set is described as \(T=\left\{\left(D_{i}^{train},D_{i}^{test}\right)\right\}_{t=1}^{I}\) and the meta-testing set is \(S=\left\{\left(D_{q}^{train},D_{q}^{test}\right)\right\}_{q=1}^{Q}\), with each dataset containing pairs of data points and their ground-truth labels, i.e., \(D^{train}=\left\{\left(x_{t},y_{t}\right)\right\}_{t=1}^{T}\) and \(D^{test}=\left\{\left(x_{q},y_{q}\right)\right\}_{q=1}^{Q}\), which are sampled from the same distribution. The objective is to leverage the meta-training stage to learn good representations, which will enable it to adapt quickly to unseen tasks in the meta-testing stage, using powerful optimization techniques.  
In a network intrusion detection context, a task, \(T\), can be simply defined as a binary classification between a normal network traffic sample and a category of malicious samples. Supposing that there are five different network traffic samples, \(O\), \(A\), \(B\), \(C\) and \(E\) such that, sample \(O\) is a benign network traffic, samples \(A\), \(B\), \(C\) indicate known categories of attacks with sufficient examples, while the remaining sample, \(E\), refers to a newly found category of attack with a few examples. The goal is to identify the new attack sample, \(S\), with as few examples as possible. Then, three different tasks can be constructed, \(T_{1}\), \(T_{2}\) and \(T_{3}\) where \(T_{1}\), \(T_{2}\) and \(T_{3}\) define a binary classification task between a normal sample \(O\) and attack categories \(A\), \(B\) and \(C\). \(T_{1}\), \(T_{2}\) and \(T_{3}\) constitute the meta-training set, while the meta-test set consists of a normal sample, \(O\), and the novel class, \(E\), which has few examples. The idea is to leverage the meta-training stage to learn transferable knowledge from \(T_{1}\), \(T_{2}\) and \(T_{3}\) that will enable a classifier to accomplish task \(T_{4}\) (a binary classification between normal sample \(O\) and attack category \(E\)) with as few examples as possible during the meta-testing phase. Thus, in our case, a discriminative autoencoder was employed to acquire such transferable knowledge.