|
Description
|
While ensemble methods have dominated tabular intrusion detection systems (IDS), recent advances in foundation models present new opportunities for enhanced cybersecurity applications. This paper presents the first comprehensive evaluation of foundation models - specifically TabPFN (a probabilistic transformer for tabular data) and large language models (LLMs) using few-shot in-context learning - against traditional machine learning and deep learning approaches for IoT network intrusion detection. We conduct rigorous experiments on the CIC-IDS2017 and N-BaIoT datasets using a unified evaluation framework that addresses critical methodological issues: methodological rigor through appropriate train/test splits, severe class imbalance via stratified sampling up to 20,000 instances per class, and comprehensive evaluation across four data variants (raw vs. incremental PCA-compressed features with 95% variance retention, original vs. semantically grouped attack classes). Our results demonstrate that TabPFN achieves superior performance on CIC-IDS2017, by being the only model capable of detecting all attack classes including rare ones like Heartbleed, while using only up to 3,000 examples per class and requiring no traditional training or hyperparameter tuning. In contrast, traditional ensemble methods like Random Forest and K-NN, while achieving high overall accuracy (>99%), fail to detect several minority attack classes. TabNet shows competitive performance only when augmented with SMOTE-based synthetic data generation, highlighting the importance of data augmentation strategies for deep learning approaches on imbalanced cybersecurity datasets. LLM-based few-shot classifiers demonstrate surprising effectiveness in identifying rare attack classes like Heartbleed and Infiltration and provide inherent explainability, though they remain limited by context size and inference latency for large-scale deployment. These findings challenge the assumption that tree-based ensembles are optimal for tabular IDS applications and suggest that foundation models, particularly TabPFN, offer a promising paradigm shift toward training-free, generalizable intrusion detection systems capable of handling zero-day threats in IoT environments. (2025-01-01)
***This entry has been automatically imported via Infodoc(ASO) CSV by LIST harvest scripts. Please refer to https://doi.org/10.1109/FLLM67465.2025.11391169 for the original and latest version of the dataset and data downloads*** (2026-06-15)
|
|
Keyword
|
class imbalance, cybersecurity, few-shot learning, foundation models, intrusion detection systems, IoT security, large language models, probabilistic inference, TabPFN, tabular transformers |
