RT info:eu-repo/semantics/article
T1 Supervised contrastive learning over prototype-label embeddings for network intrusion detection
A1 López Martín, Manuel
A1 Sánchez Esguevillas, Antonio Javier
A1 Arribas Sánchez, Juan Ignacio
A1 Carro Martínez, Belén
K1 Label embedding
K1 Incrustación de etiquetas
K1 Contrastive learning
K1 Aprendizaje contrastivo
K1 Network intrusion detection
K1 Detección de intrusos en red
AB Contrastive learning makes it possible to establish similarities between samples by comparing their distances in an intermediate representation space (embedding space) and using loss functions designed to attract/repel similar/dissimilar samples. The distance comparison is based exclusively on the sample features. We propose a novel contrastive learning scheme by including the labels in the same embedding space as the features and performing the distance comparison between features and labels in this shared embedding space. Following this idea, the sample features should be close to its ground-truth (positive) label and away from the other labels (negative labels). This scheme allows to implement a supervised classification based on contrastive learning. Each embedded label will assume the role of a class prototype in embedding space, with sample features that share the label gathering around it. The aim is to separate the label prototypes while minimizing the distance between each prototype and its same-class samples. A novel set of loss functions is proposed with this objective. Loss minimization will drive the allocation of sample features and labels in embedding space. Loss functions and their associated training and prediction architectures are analyzed in detail, along with different strategies for label separation. The proposed scheme drastically reduces the number of pair-wise comparisons, thus improving model performance. In order to further reduce the number of pair-wise comparisons, this initial scheme is extended by replacing the set of negative labels by its best single representative: either the negative label nearest to the sample features or the centroid of the cluster of negative labels. This idea creates a new subset of models which are analyzed in detail.The outputs of the proposed models are the distances (in embedding space) between each sample and the label prototypes. These distances can be used to perform classification (minimum distance label), features dimensionality reduction (using the distances and the embeddings instead of the original features) and data visualization (with 2 or 3D embeddings).Although the proposed models are generic, their application and performance evaluation is done here for network intrusion detection, characterized by noisy and unbalanced labels and a challenging classification of the various types of attacks. Empirical results of the model applied to intrusion detection are presented in detail for two well-known intrusion detection datasets, and a thorough set of classification and clustering performance evaluation metrics are included.
PB Elsevier
SN 1566-2535
YR 2022
FD 2022
LK https://uvadoc.uva.es/handle/10324/48972
UL https://uvadoc.uva.es/handle/10324/48972
LA eng
NO Information Fusion, 2022, vol. 79, p. 200-228
NO Producción Científica
DS UVaDOC
RD 28-abr-2024