A subspace-based few-shot intrusion detection system for the Internet of Things

Abstract

Deep learning-based intrusion detection systems rely on numerous training samples to achieve satisfactory detection rates. However, in the real-world Internet of Things (IoT) environments, the diversity of IoT devices and the subsequent fragmentation of attack types result in a limited number of training samples, which urgently requires researchers to develop few-shot intrusion detection systems. In this study, we propose a subspace-based approach for few-shot IoT intrusion detection systems to cope with the dilemma of insufficient learnable samples. The method is based on the principle of classifying metrics to identify network traffic. After feature extraction of samples, a subspace is constructed for each category. Next, the distance between the query samples and the subspace is calculated by the metric module, thus detecting malicious samples. Subsequently, based on the CICIoT2023 dataset we construct a few-shot IoT intrusion detection dataset and evaluate the proposed method. For the detection of unknown categories, the detection accuracy is 93.52% in the 5-way 1-shot setting, 92.99% in the 5-way 5-shot setting, and 93.65% in the 5-way 10-shot setting.

1. Introduction

The Internet of Things (IoT) is rapidly becoming a central aspect of our daily lives and industrial operations. As an increasing number of devices connect to networks, the amount of data they generate and the range of applications they can use expand significantly. However, this connectivity poses new security challenges because the diverse and distributed nature of IoT devices makes them new targets for cyber attacks. Thus, the IoT intrusion detection system has become the key to securing the IoT. In recent years, excellent algorithms for IoT intrusion detection systems have been developed, and they are effective in detecting abnormal traffic (Lu HM et al., 2022; He et al., 2024b). These studies have one thing in common: they train models from large datasets. Traditional intrusion detection methods based on a large number of samples face the challenge of data collection and labeling owing to the diversity of IoT devices and the dynamics of the network environment. In a diverse IoT environment, a discontinuity occurs in security measures due to device diversity, differences in operating system versions, inconsistent firmware updates, and other factors. This fragmentation makes it extremely difficult to maintain a unified security policy, thereby providing opportunities for attackers to exploit. Furthermore, when faced with zero-day attacks, researchers usually fail to collect sufficient samples and therefore may be unable to build timely datasets. At this point, machine learning-based IoT intrusion detection systems can fail, which in turn can cause irreparable damage to industrial production (Yan et al., 2024).

Researchers have shifted their focus to few-shot learning in the face of very few attack samples, such as zero-day attacks. As the name implies, IoT intrusion detection systems based on few-shot learning aim to develop efficient and accurate intrusion detection models for sparse and unbalanced data. However, the development of efficient few-shot models faces challenges, such as poor generalization and overfitting (Duan RX et al., 2021; Wang ZM et al., 2021). Research on IoT intrusion detection systems based on few-shot learning is still in its infancy, and more research needs to be made available for reference. However, the feasibility of using few-shot learning to address IoT intrusion detection has already been demonstrated.

In this study, a subspace-based few-shot IoT intrusion detection system is developed to solve these problems. We apply a subspace classifier to an IoT intrusion detection system. Unlike existing parameter optimization-based methods, we use metric learning to detect network traffic, which uses prior knowledge to detect unknown categories (Simon et al., 2020). The main contributions of this study are as follows: (1) To enhance the discriminability of traffic information from different classes, we propose a few-shot classifier that uses subspaces as a metric to fully learn the common representation of each traffic flow, while designing a four-layer feature extraction network based on channel attention mechanisms to enhance the feature representation of each traffic flow.