  In the encrypted network traffic intrusion detection, deep learning based
schemes have attracted lots of attention. However, in real-world scenarios,
data is often insufficient (few-shot), which leads to various deviations
between the models prediction and the ground truth. Consequently, downstream
tasks such as unknown attack detection based on few-shot will be limited by
insufficient data. In this paper, we propose a novel unknown attack detection
method based on Intra Categories Generation in Embedding Space, namely
SFE-GACN, which might be the solution of few-shot problem. Concretely, we first
proposed Session Feature Embedding (SFE) to summarize the context of sessions
(session is the basic granularity of network traffic), bring the insufficient
data to the pre-trained embedding space. In this way, we achieve the goal of
preliminary information extension in the few-shot case. Second, we further
propose the Generative Adversarial Cooperative Network (GACN), which improves
the conventional Generative Adversarial Network by supervising the generated
sample to avoid falling into similar categories, and thus enables samples to
generate intra categories. Our proposed SFE-GACN can accurately generate
session samples in the case of few-shot, and ensure the difference between
categories during data augmentation. The detection results show that, compared
to the state-of-the-art method, the average TPR is 8.38% higher, and the
average FPR is 12.77% lower. In addition, we evaluated the graphics generation
capabilities of GACN on the graphics dataset, the result shows our proposed
GACN can be popularized for generating easy-confused multi-categories graphics.
