A Real-Time Label-Free Self-Supervised Deep Learning Intrusion Detection for Handling New Type and Few-Shot Attacks in IoT Networks

Internet of Things (IoT) security is a guarantee for the rapid development of IoT. Traditional supervised deep learning-based intrusion detection systems (IDSs) need to label all traffic data, but the number of labeled records is always insufficient. The current intrusion detection algorithms are relatively inefficient in detecting new attacks as well as a small number of attacks. In this paper, we proposed a self-supervised deep learning method combining supervised learning which is Improved Residual Temporal Convolution Neural Network Adversarial Autoencoder with Efficient Channel Attention (IResTAE2A), our proposed model is trained without any labeled attack information, in which we proposed an Improved Residual Temporal Convolution Neural Network (TCN) module to enhance the spatio-temporal characterization of neural network learning traffic data. An Improved Adversarial Autoencoder (AAE) was introduced to enhance the encoder’s representation learning ability to better extract the hidden information of normal traffic. In addition, an Efficient Channel Attention (ECA) mechanism was introduced, which performs feature extraction on the useful part of the data before training to improve the efficiency of training afterwards. We utilized the NSL-KDD dataset, the CIC-IDS2017 dataset and the CIC-IDS2018 dataset to simulate and evaluate the model, and the experimental results show that the proposed method is able to more effectively improve the accuracy of IoT’s detection of new samples or even small samples of attacks under the condition of no-sample-labeling. IResTAE2A maintains the monitoring accuracy while significantly reduces the training time i.e., it is able to process the intrusion detection dynamically and in real time.