 ICACT20220392 Slide.01
[Big Slide]
|
Chrome  Click!! |
 |
Hi everybody, my name is Hanji SHEN. For ICACT 2022, I have cooperated with two partners from CAS Dr. Jun LEE and BSFSTIC, Dr. Xiang FU. Our presentation today is about a Meta Learning Model for Few-Shot Logs Classification. |
| ICACT20220392 Slide.02
[Big Slide]
|
Chrome Click!! |
 |
Back Ground |
| ICACT20220392 Slide.03
[Big Slide]
|
Chrome Click!! |
 |
High-threat attacks,taking Oday attacking for example,Log data samples of are scarce,the sample features are not obvious and
Weak generalization ability.
Why not learn to be a “network security engineer”
|
| ICACT20220392 Slide.04
[Big Slide]
|
Chrome Click!! |
 |
Method and Model |
| ICACT20220392 Slide.05
[Big Slide]
|
Chrome Click!! |
 |
Due to these limitations in high-threat attacking logs,We proposed a Meta learning classification method which included source data set processing,meta knowledge learner,sample representation,meta learning,and meta training.
|
| ICACT20220392 Slide.06
[Big Slide]
|
Chrome Click!! |
 |
Meta-training and Meta-testing
Meta-training
N classes are extracted from the training data Mtrain. For each of these n classes, two subset examples are sampled as the support set MSupport and the query set Mquery. Next, input the support set MSupport and the query set Mquery into the model, and update the parameters by minimizing the loss in the query set Mquery. The above process is called Meta training and will be repeated many times.
Meta-testing
After Meta training, the performance of the model will be evaluated through the same event based mechanism. In one test, n new classes will be extracted from Mtest, which does not intersect Mtrain. Then, the support set and test set are extracted from N classes. Model parameters can be fine-tuned through small support sets.
|
| ICACT20220392 Slide.07
[Big Slide]
|
Chrome Click!! |
 |
6 modules
|
| ICACT20220392 Slide.08
[Big Slide]
|
Chrome Click!! |
 |
Algorithm: BILSTM-Ridge Meta Learning
Input: meta training set: Mtrain{(MSupport , Mquery)} ; meta testing set : Mtest{MSupport, Mtest} ; number of meta training iterations:eptrain ; number of meta testing iterations : eptest ; learner parameters: β ; classifier parameters : θ
Output: trained parameters: θ ; average classification accuracy : accright
|
| ICACT20220392 Slide.09
[Big Slide]
|
Chrome Click!! |
 |
Meta knowledge learner aims to make the final classification result better. The module is mainly composed of a bidirectional LSTM (BiLSTM) and a full connection layer. We use BiLSTM to encode context embedding for each time step. The input of the module is a series of word vectors Q: [q1, ..., qm], where M represents the number of words in the sentence.
|
| ICACT20220392 Slide.10
[Big Slide]
|
Chrome Click!! |
 |
Loss Function
|
| ICACT20220392 Slide.11
[Big Slide]
|
Chrome Click!! |
 |
Taking the attack log of a site of China Science and technology network from October 20 to November 19, 2021 as the data set.
|
| ICACT20220392 Slide.12
[Big Slide]
|
Chrome Click!! |
 |
DataSet Processing and Enhancement |
| ICACT20220392 Slide.13
[Big Slide]
|
Chrome Click!! |
 |
Experiment and Analysis
|
| ICACT20220392 Slide.14
[Big Slide]
|
Chrome Click!! |
 |
Select 7 categories as the training set and 7 categories as the test set, and take the calculated mean of 10 experimental results as the final result. The results are compared with LSTM Meta learning model, model independent MAML Meta learning model, relational network and other mainstream methods.
|
| ICACT20220392 Slide.15
[Big Slide]
|
Chrome Click!! |
 |
Conclusion
|
| ICACT20220392 Slide.16
[Big Slide]
|
Chrome Click!! |
 |
This paper proposed a Meta learning classification method based on few-shot samples, called BiLSTM-Ridge regression model, which can recognize and learn the characteristics of high threat log samples through less sample learning, and has better generalization detection ability in new unknown test tasks.
we design a Meta knowledge learner in the Meta training scenario to extract the sample features of high threat logs and improve the adaptability of Meta learners in new tasks. We prove that our method achieves good results on the 5-way 1-shot and 5-way 3-shot problems on the real 335 high threat log data sets.
|
| ICACT20220392 Slide.17
[Big Slide]
|
Chrome Click!! |
 |
Reference
|
| ICACT20220392 Slide.18
[Big Slide]
|
Chrome Click!! |
 |
Reference
|
| ICACT20220392 Slide.19
[Big Slide]
|
Chrome Click!! |
 |
Thanks. |
