Joint Semantic Transfer Network for IoT Intrusion Detection

Abstract

In this paper, we propose a Joint Semantic Transfer Network (JSTN) towards effective intrusion detection for large-scale scarcely labelled IoT domain. As a multi-source heterogeneous domain adaptation (MS-HDA) method, the JSTN integrates a knowledge rich network intrusion (NI) domain and another small-scale IoT intrusion (II) domain as source domains, and preserves intrinsic semantic properties to assist target II domain intrusion detection. The JSTN jointly transfers the following three semantics to learn a domain-invariant and discriminative feature representation. The scenario semantic endows source NI and II domain with characteristics from each other to ease the knowledge transfer process via a confused domain discriminator and categorical distribution knowledge preservation. It also reduces the source-target discrepancy to make the shared feature space domain-invariant. Meanwhile, the weighted implicit semantic transfer boosts discriminability via a fine-grained knowledge preservation, which transfers the source categorical distribution to the target domain. The source-target divergence guides the importance weighting during knowledge preservation to reflect the degree of knowledge learning. Additionally, the hierarchical explicit semantic alignment performs centroid-level and representative-level alignment with the help of a geometric similarity-aware pseudo-label refiner, which exploits the value of unlabelled target II domain and explicitly aligns feature representations from a global and local perspective in a concentrated manner. Comprehensive experiments on various tasks verify the superiority of the JSTN against state-of-the-art comparing methods, on average a 10.3% of accuracy boost is achieved. The statistical soundness of each constituting component and the computational efficiency are also verified.

Heterogeneous Domain Adaptation for IoT Intrusion Detection: A Geometric Graph Alignment Approach

“…The ABRSI model works under the unsupervised heterogeneous DA setting. We follow common notations [10], [25] to define the source NI domain D S as follows:…”

“…We use the deep learning framework PyTorch to implement the ABRSI model. We follow [10], [25] to implement the feature projectors as two-layer neural networks with LeakyRelu activation function, and implement both the shared classifier C and EKL discriminator D as single-layer neural networks. All experiments use a single set of hyperparameters, which are as follows: ρ max = 0.1, δ = 1, τ = 0.005, γ = 0.1, T opN = 3, #PL SR neighbour = 3, α max = 8, α min = 4, ψ = −0.3 and φ = −0.05.…”

“…We denote multi-class intrusion detection with superscript (*) on the target domain. Following [35], [42] and [10], we utilise unlabelled target domain prediction accuracy, category-weighted precision (P), recall (R), F1-Score (F) and Area under the ROC Curve (A) as the evaluation metrics.…”

“…Moreover, the limited storage and communication capability and the involvement of user privacy make IoT data hard to be obtained and publicly released. Together with the cost of expertise and manual annotation, IoT tends to be data scarce [10], hindering the usefulness of rule and ML-based methods under IoT scenarios.…”

Heterogeneous Domain Adaptation for IoT Intrusion Detection: A Geometric Graph Alignment Approach

“…I Nternet of Things (IoT) devices become indispensable for various real world applications and innovatively transform several fields such as healthcare [1], [2], etc. However, limited power and computational capability of IoT devices hinder the applicability of powerful security mechanisms, together with relatively infrequent maintenance, making IoT vulnerable to malicious intrusions.…”