Abstract:As IoT devices become widely, it is crucial to protect them from malicious intrusions. However, the data scarcity of IoT limits the applicability of traditional intrusion detection methods, which are highly data-dependent. To address this, in this paper we propose the Open-Set Dandelion Network (OSDN) based on unsupervised heterogeneous domain adaptation in an open-set manner. The OSDN model performs intrusion knowledge transfer from the knowledge-rich source network intrusion domain to facilitate more accurate intrusion detection for the data-scarce target IoT intrusion domain. Under the open-set setting, it can also detect newly-emerged target domain intrusions that are not observed in the source domain. To achieve this, the OSDN model forms the source domain into a dandelion-like feature space in which each intrusion category is compactly grouped and different intrusion categories are separated, i.e., simultaneously emphasising inter-category separability and intra-category compactness. The dandelion-based target membership mechanism then forms the target dandelion. Then, the dandelion angular separation mechanism achieves better inter-category separability, and the dandelion embedding alignment mechanism further aligns both dandelions in a finer manner. To promote intra-category compactness, the discriminating sampled dandelion mechanism is used. Assisted by the intrusion classifier trained using both known and generated unknown intrusion knowledge, a semantic dandelion correction mechanism emphasises easily-confused categories and guides better inter-category separability. Holistically, these mechanisms form the OSDN model that effectively performs intrusion knowledge transfer to benefit IoT intrusion detection. Comprehensive experiments on several intrusion datasets verify the effectiveness of the OSDN model, outperforming three state-of-the-art baseline methods by 16.9%.

Industrial network intrusion detection in open-set scenarios

An industrial network intrusion detection algorithm based on IGWO-GRU

Real-Time Intrusion Detection Based on Decision Fusion in Industrial Control Systems

A Real-time Intrusion Detection Method for Industrial Control Network Based on Heterogeneous Feature Extractor

: Towards Fine-Grained Unknown Class Detection Against the Open-Set Attack Spectrum with Variable Legitimate Traffic

A Network Traffic Intrusion Detection Method for Industrial Control Systems Based on Deep Learning

Self-Learning Spatial Distribution-Based Intrusion Detection for Industrial Cyber-Physical Systems

Intrusion Detection of Industrial Internet-of-Things Based on Reconstructed Graph Neural Networks

A Hierarchical Intrusion Detection System for Industrial Control Networks based on EtherNet/IP

An Industrial Network Intrusion Detection Algorithm Based on Multifeature Data Clustering Optimization Model

A Hierarchical Hybrid Intrusion Detection Model for Industrial Internet of Things

An improved intrusion detection method for IIoT using attention mechanisms, BiGRU, and Inception-CNN

A Deep One-Class Intrusion Detection Scheme in Software-Defined Industrial Networks

Detecting Cyberattacks in Industrial Control Systems Using Online Learning Algorithms

A New Industrial Intrusion Detection Method Based on CNN-BiLSTM

Open-Set Intrusion Detection with MinMax Autoencoder and Pseudo Extreme Value Machine

Intrusion detection algorithm of industrial control network based on improved one-class support vector machine

A Two Stage Intrusion Detection System for Industrial Control Networks Based on Ethernet/IP

Industrial Control Intrusion Detection Approach Based on Multiclassification GoogLeNet-LSTM Model.

Open Set Dandelion Network for IoT Intrusion Detection

KCC Method: Unknown Intrusion Detection Based on Open Set Recognition