Developing a Siamese network for intrusion detection systems

Hanan Hindy, Christos Tachtatzis, Robert Atkinson, Ethan Bayne, Xavier Bellekens

Research output: Contribution to conferencePaperpeer-review

13 Downloads (Pure)


Machine Learning (ML) for developing Intrusion Detection Systems (IDS) is a fast-evolving research area that has many unsolved domain challenges. Current IDS models face two challenges that limit their performance and robustness. Firstly, they require large datasets to train and their performance is highly dependent on the dataset size. Secondly, zero-day attacks demand that machine learning models are retrained in order to identify future attacks of this type. However, the sophistication and increasing rate of cyber attacks make retraining time prohibitive for practical implementation.
This paper proposes a new IDS model that can learn from pair similarities rather than class discriminative features. Learning similarities requires less data for training and provides the ability to flexibly adapt to new cyber attacks, thus reducing the burden of retraining. The underlying model is based on Siamese Networks, therefore, given a number of instances, numerous similar and dissimilar pairs can be generated. The model is evaluated using three mainstream IDS datasets; CICIDS2017, KDD Cup'99, and NSL-KDD.
The evaluation results confirm the ability of the Siamese Network model to suit IDS purposes by classifying cyber attacks based on similarity-based learning. This opens a new research direction for building adaptable IDS models using non-conventional ML techniques.
Original languageEnglish
Publication statusAccepted/In press - 22 Mar 2021
EventWorkshop on Machine Learning and Systems - Virtually, Edinburgh, United Kingdom
Duration: 26 Apr 202126 Apr 2021
Conference number: 1


WorkshopWorkshop on Machine Learning and Systems
Abbreviated titleEuroMLSys
Country/TerritoryUnited Kingdom
Internet address


  • siamese network
  • intrusion detection
  • domain challanges


Dive into the research topics of 'Developing a Siamese network for intrusion detection systems'. Together they form a unique fingerprint.

Cite this