Heterogeneous Domain Adaptation for IoT Intrusion Detection: A Geometric Graph Alignment Approach

TL;DR

This paper introduces a novel Geometric Graph Alignment method to improve IoT intrusion detection by transferring knowledge from data-rich network intrusion domains, effectively addressing data scarcity issues.

Contribution

The paper proposes a new geometric graph alignment approach that masks heterogeneities between domains and enhances intrusion detection accuracy in IoT environments.

Findings

Achieves state-of-the-art performance on multiple intrusion datasets.

Effectively transfers knowledge from network intrusion to IoT intrusion detection.

Demonstrates the robustness of the GGA approach through comprehensive experiments.

Abstract

Data scarcity hinders the usability of data-dependent algorithms when tackling IoT intrusion detection (IID). To address this, we utilise the data rich network intrusion detection (NID) domain to facilitate more accurate intrusion detection for IID domains. In this paper, a Geometric Graph Alignment (GGA) approach is leveraged to mask the geometric heterogeneities between domains for better intrusion knowledge transfer. Specifically, each intrusion domain is formulated as a graph where vertices and edges represent intrusion categories and category-wise interrelationships, respectively. The overall shape is preserved via a confused discriminator incapable to identify adjacency matrices between different intrusion domain graphs. A rotation avoidance mechanism and a centre point matching mechanism is used to avoid graph misalignment due to rotation and symmetry, respectively. Besides, category-wise semantic knowledge is transferred to act as vertex-level alignment. To exploit the target data, a pseudo-label election mechanism that jointly considers network prediction, geometric property and neighbourhood information is used to produce fine-grained pseudo-label assignment. Upon aligning the intrusion graphs geometrically from different granularities, the transferred intrusion knowledge can boost IID performance. Comprehensive experiments on several intrusion datasets demonstrate state-of-the-art performance of the GGA approach and validate the usefulness of GGA constituting components.