A Novel Transfer Learning Model for Intrusion Detection Systems in IoT Networks

Internet of Things, or IoT has been playing an important part in human’s lives. Nonetheless, the rapid growth of IoT-based services may lead to an increase in IoT-based attacks that compromise sensitive user data. IoT-based attack detection and prevention is thus essential for the development of IoT-based network technologies. However, this is a difficult task because the data transmitted between IoT devices is often complex and heterogeneous while IoT-based threats/attacks change rapidly over time. Machine learning-based threat detection methods, which are trained with old/existing labelled data, may become less effective in the future. For that, it is critical to develop effective learning models that can leverage both labelled and unlabelled data to timely adapt with the fast-varying attack methods. To this end, this chapter proposes a Deep Transfer Learning (DTL) model to build an effective IoT attack detection model from both labelled and unlabelled data collected from multiple IoT devices. The proposed solution combines the Multi-Maximum Mean Discrepancy (M2D) distance and two AutoEncoder (AE) networks named as Multi-Maximum Mean Discrepancy AutoEncoder (M2DA). The first AE is trained on labelled IoT data, while the second AE is trained on unlabelled IoT data. The purpose of the training process is to transfer the learned label information from the first AE to the second AE by the M2D distance. As a result, the second AE can efficiently classify and detect anomaly (attacks) even on unlabelled IoT network data. We further study the performance of the proposed M2DA framework using nine well-known commercial IoT datasets with different botnet families and attacks. © The Editor(s)(if applicable)and The Author(s), under exclusive license to Springer Nature Switzerland AG 2023.