Abstract:To address the insufficient generalization and degraded detection performance in intrusion detection models caused by scarce samples during the early stages of novel network attacks, this study proposes a few-shot intrusion detection method based on diffusion models. At the data augmentation level, the proposed method introduces a noise-aware conditional diffusion model that employs cosine noise scheduling to balance generation efficiency and sample fidelity, while residual connections are incorporated to enhance feature propagation stability and improve the distribution fidelity of synthesized traffic data. At the feature metric level, a dynamic prototype network is designed, leveraging multi-head attention to optimize class prototype representations and mitigate feature sparsity in few-shot scenarios. Simultaneously, a joint optimization strategy combining cross-entropy loss with an orthogonal regularization term is adopted to enhance intra-class compactness and increase inter-class separability. Experimental results on two public datasets demonstrate that the proposed model outperforms other detection methods in terms of accuracy and generalization capability under few-shot scenarios, providing a novel solution approach for few-shot intrusion detection.