Zero-Day Attack Detection Based on BERT and Incremental Learning in IoT

The rapid proliferation of Internet of Things (IoT) devices has introduced significant security challenges, particularly in detecting zero-day attacks. The zero-day attack is a terminology used to indicate the unknown attack type. Standard intrusion detection systems (IDS) often struggle to identify such novel threats due to their reliance on static models and predefined signatures. In this paper, we propose a novel approach to zero-day attack detection by leveraging BERT and incremental learning. In particular, expressive deep feature representations are extracted by leveraging BERT for network traffic analysis. A successive exclusion strategy is then used to identify novel attacks within the unlabeled data. Finally, incremental learning is applied to enable the model to adapt to new threats while maintaining its efficacy against known ones. To evaluate the effectiveness of the proposed method, experiments are conducted on the Edge-IIoT dataset. The results indicate that our method dynamically adapts to new attack patterns by continuously updating the model with incoming data, thereby enhancing detection accuracy over time. These findings demonstrate the effectiveness of our approach in identifying zero-day attacks.