Joint Semantic Transfer Network for IoT Intrusion Detection

In this article, we propose a joint semantic transfer network (JSTN) toward effective intrusion detection (ID) for large-scale scarcely labeled Internet of Things (IoT) domain. As a multisource heterogeneous domain adaptation (MS-HDA) method, the JSTN integrates a knowledge-rich network intrusion (NI) domain and another small-scale IoT intrusion (II) domain as source domains and preserves intrinsic semantic properties to assist target II domain ID. The JSTN jointly transfers the following three semantics to learn a domain-invariant and discriminative feature representation. The scenario semantic endows source NI and II domains with characteristics from each other to ease the knowledge transfer process via a confused domain discriminator and categorical distribution knowledge preservation. It also reduces the source-target discrepancy to make the shared feature space domain invariant. Meanwhile, the weighted implicit semantic transfer boosts discriminability via a fine-grained knowledge preservation, which transfers the source categorical distribution to the target domain. The source-target divergence guides the importance weighting during knowledge preservation to reflect the degree of knowledge learning. Additionally, the hierarchical explicit semantic alignment performs centroid-level and representative-level alignment with the help of a geometric similarity-aware pseudo-label refiner, which exploits the value of the unlabeled target II domain and explicitly aligns feature representations from a global and local perspective in a concentrated manner. Comprehensive experiments on various tasks verify the superiority of the JSTN against state-of-the-art comparing methods, on average a 10.3% of accuracy boost is achieved. The statistical soundness of each constituting component and the computational efficiency is also verified.

Automated summary

In this research, a joint semantic transfer network (JSTN) is proposed for effective intrusion detection (ID) in the large-scale scarcely labeled Internet of Things (IoT) domain. The JSTN integrates a knowledge-rich network intrusion (NI) domain and a small-scale IoT intrusion (II) domain as source domains to assist target II domain ID. The JSTN transfers three semantics to learn a domain-invariant and discriminative feature representation. The experiments demonstrate the superiority of the JSTN, achieving an average accuracy boost of 10.3% compared to state-of-the-art methods. The statistical soundness of each component and the computational efficiency are also verified.