Multi-Enhanced Model-Agnostic Meta-Learning Framework for Rapid Adaptation in Cybersecurity Threat Detection and Attack Mitigation

There has been an increase in the number of IoT devices and networked systems. There is a necessity of cybersecurity tools which can detect and mitigate the cyber threats. Traditional intrusion detection techniques might encounter problems like noisy data, limited amount of data and dynamically varying cyber attacks. Although research has made many improvements, there is a significant gap in research concerning developing adaptive and interpretable models for detection of evolving and complex cyberattacks. The purpose of this research is to develop highly accurate models that detect various types of cyber attacks using the minimum number of features by doing feature selection. In this paper, we propose a multi-improved model-agnostic meta-learning (MI-MAML) method for fast adaptation and classification in the field of cybersecurity. In the field of cybersecurity, Kalman filter technique is used for predicting and detecting any anomalies in the network traffic by checking the state of the system in real-time. The self-synchronization hop-end method based on the communication field can conceal the information of the station and the communication field from any third party and enhance the safety of SDN. Moreover, this method effectively prevents eavesdropping attack from affecting the performance of feature extraction. The BS-GAT can incorporate behavior-based edge weights to GAT. In other words, this technique uses behaviors for representing network flows and their behavioral similarities for intrusion detection in network security after segmentation. On the other hand, the classification process uses MIMAML model that was developed specifically for solving one-shot malware classification problem. To increase the efficiency of classification in this case, two data augmentation techniques are used, such as grayscale images and the lab's color space. Network security detection accuracy and efficiency are improved by using the PKPPO algorithm due to parameter modification with the help of the prior knowledge. Action Filtering rules are generated through attack graph knowledge and action mask vector is created for the alteration of the distribution of policy network output prior to sampling. NF-BoT-IoT-v2 and NF-ToN-IoT-v2 are NetFlowv2 datasets with 43 traffic features of IoT traffic. Both the datasets are classified according to their attack types and are used for training and evaluation of intrusion detection systems. The performance of the model was assessed through accuracy, precision, recall, F1 score, and specificity. The accuracy of the classifier was 99.64%, 98.84% precision, 98.88% recall, 98.85% F1-score, and 98.02% specificity for the NF-BoT-IoT-v2 dataset. The results of this study can contribute towards adaptive intrusion detection, cybersecurity monitoring, and attack mitigation in the IoT and software-defined networking environment.