Fast few-shot intrusion detection via depthwise meta-learning

Network intrusion detection systems (NIDS) increasingly rely on deep learning to cope with evolving cyber attacks, yet they typically require large amounts of labeled data per attack type and exhibit poor generalization to novel threats. Recent advances in meta-learning and few-shot learning have shown promise for alleviating data scarcity, while depthwise separable convolutions (DSC) offer a computationally efficient means of extracting fine-grained spatial–temporal features from network traffic. In this paper, we propose a meta-learning framework for few-shot network intrusion detection that combines a model-agnostic meta-learning (MAML) objective with a one-dimensional DSC backbone. Tasks are defined episodically across attack families and datasets, enabling the meta-learner to acquire an initialization that rapidly adapts to unseen attack types using only a handful of labeled flows. We derive the corresponding bilevel optimization problem, analyze the computational benefits of DSC compared with standard convolutions, and present an end-to-end architecture tailored for flow-based NIDS. Experiments on CICIDS2017, NSL-KDD and UNSW-NB15 under challenging 5-shot and 10-shot settings demonstrate consistent improvements in accuracy and macro- F₁ over strong convolutional, metric-based and attention-enhanced baselines inspired by recent literature. The proposed approach reduces parameters by up to 65% relative to conventional convolutions while maintaining or improving detection performance. We conclude with a discussion of limitations and directions for integrating cross-domain adaptation and self-attention into meta-learned DSC architectures.