aDisRAE: ADAPTIVE DISCRIMINATIVE REPRESENTATION AUTOENCODER FOR FEW-SHOT CYBERATTACK DETECTION

Abstract

Due to the scarcity of labeled anomalous data, few-shot learning has emerged as a
critical paradigm for detecting novel and rare cyberattacks. The Discriminative Representation
Autoencoder (DisRAE) framework learns a latent space where anomalies are pushed away
from a central cluster of normal data, but it struggles with advanced attacks that closely mimic
benign behavior. These subtle anomalies are often mapped too close to the normal cluster,
leading to detection evasion. To address this limitation, this paper proposes the Adaptive
Discriminative Representation Autoencoder (aDisRAE). The framework enhances the training
objective by incorporating a prior outlier score that quantifies the subtlety of each anomaly.
This score guides an adaptive repulsion mechanism, applying a stronger force to anomalies
that most resemble normal data, ensuring a more effective separation in the latent space. The
experiments evaluate aDisRAE on three public benchmark datasets: NSL-KDD, CIC-IDS2017
and UNSW-NB15. The results show a notable improvement, raising AUC by up to 10% and
boosting robustness, especially against evasive attacks.