Few-shot IoT attack detection based on RFP-CNN and adversarial unsupervised domain-adaptive regularization

Abstract

The Internet of things (IoT) has attracted extensive research attention in recent years. Cyber-attack protection for IoT devices has become critically important. Malicious users or attackers can take control of IoT devices, thereby putting a wide range of IoT security and privacy data at risk. Thus, the detection and prevention of new attack types are critical in IoT environments. Big data samples are used to train current IoT attack detection models. In certain cases, only few-shot network attack samples can be intercepted. They are susceptible to malicious traffic in an IoT environment, with a reduction in their detection efficiency and accuracy. In this paper, we propose an adversarial unsupervised domain-adaptive regularization and an improved Cascade R-CNN (RFP-CNN) to detect IoT attacks more effectively. First, a feature extraction network (RFP-CNN) is designed. By employing recursive feature pyramids and neural architecture search, the Cascade R-CNN is optimized, and it can extract high-level attack features. Subsequently, an adversarial unsupervised domain-adaptive regularization model is developed, which is known as global cluster center structure regularization. Its purpose is to enable attacks with fewer samples to transfer from other attacks. The model is decoupled into a feature extractor and a domain discriminator using a Siamese network. Finally, our method is validated using four network intrusion datasets pertaining to the IoT. The results demonstrate that our method is capable of extracting time-frequency features. The proposed method exhibits the highest detection accuracy when only a few attack samples are available. It provides excellent anti-noise performance and a short running time when noise is added to the IoT environment. Furthermore, it can be used to detect few-shot IoT attacks in real time.