Abstract:As Internet of Things devices become prevalent, using intrusion detection to protect IoT from malicious intrusions is of vital importance. However, the data scarcity of IoT hinders the effectiveness of traditional intrusion detection methods. To tackle this issue, in this paper, we propose the Adaptive Bi-Recommendation and Self-Improving Network (ABRSI) based on unsupervised heterogeneous domain adaptation (HDA). The ABRSI transfers enrich intrusion knowledge from a data-rich network intrusion source domain to facilitate effective intrusion detection for data-scarce IoT target domains. The ABRSI achieves fine-grained intrusion knowledge transfer via adaptive bi-recommendation matching. Matching the bi-recommendation interests of two recommender systems and the alignment of intrusion categories in the shared feature space form a mutual-benefit loop. Besides, the ABRSI uses a self-improving mechanism, autonomously improving the intrusion knowledge transfer from four ways. A hard pseudo label voting mechanism jointly considers recommender system decision and label relationship information to promote more accurate hard pseudo label assignment. To promote diversity and target data participation during intrusion knowledge transfer, target instances failing to be assigned with a hard pseudo label will be assigned with a probabilistic soft pseudo label, forming a hybrid pseudo-labelling strategy. Meanwhile, the ABRSI also makes soft pseudo-labels globally diverse and individually certain. Finally, an error knowledge learning mechanism is utilised to adversarially exploit factors that causes detection ambiguity and learns through both current and previous error knowledge, preventing error knowledge forgetfulness. Holistically, these mechanisms form the ABRSI model that boosts IoT intrusion detection accuracy via HDA-assisted intrusion knowledge transfer. Comprehensive experiments on several intrusion datasets demonstrate the state-of-the-art performance of the ABRSI method, outperforming its counterparts by 9.2%, and also verify the effectiveness of ABRSI constituting components and ABRSI’s overall efficiency.

Automatically predicting cyber attack preference with attributed heterogeneous attention networks and transductive learning

A novel hierarchical attention-based triplet network with unsupervised domain adaptation for network intrusion detection

ALEAP: Attention-based LSTM with Event Embedding for Attack Projection

A Hierarchical Approach for Advanced Persistent Threat Detection with Attention-Based Graph Neural Networks

Adaptive Bi-Recommendation and Self-Improving Network for Heterogeneous Domain Adaptation-Assisted IoT Intrusion Detection

BAN: Predicting APT Attack Based on Bayesian Network With MITRE ATT&CK Framework

HDCBAN: Hybrid Neural Network for Network Intrusion Detection System

Campus Network Traffic Prediction and Anomaly Detection Based on Deep Learning

A Hybrid Visualizing Approach Based on Adaptive Neuro-fuzzy Inference System, Decision Tree, and K-means for Intrusion Detection

Cyber threat prediction using dynamic heterogeneous graph learning

A prospective approach to detect advanced persistent threats: Utilizing hybrid optimization technique

Model-agnostic generation-enhanced technology for few-shot intrusion detection

IPAttributor: Cyber Attacker Attribution with Threat Intelligence-Enriched Intrusion Data

HANDOM : Heterogeneous Attention Network Model for Malicious Domain Detection

Research on Network Security Situation Awareness Based on the LSTM-DT Model

Hybrid CNN-LSTM model combined with feature selection and SMOTE for detection of network attacks

Research on Key Technologies of Network Security Situational Awareness for Attack Tracking Prediction

A hybrid interpretable deep structure based on adaptive neuro-fuzzy inference system, decision tree, and K-means for intrusion detection

Designing a modified feature aggregation model with hybrid sampling techniques for network intrusion detection

A Network Intrusion Detection Model Based on BiLSTM with Multi-Head Attention Mechanism