Cross-Domain Deep Transfer Learning Framework for Intrusion Detection in Data-Constrained and Resource-Limited IoT Environments
TL;DR
Experimental results demonstrate that the proposed DTL framework outperforms conventional DL-based IDS models, achieving improvements in accuracy, recall, F1-score, and area under the receiver operating characteristic curve (AUC).
Abstract
The rapid expansion of the Internet of Things (IoT) has led to the widespread deployment of interconnected smart devices and wireless sensor systems in critical applications, significantly increasing the attack surface for cyber threats. Deep learning (DL)-based intrusion detection systems (IDSs) have demonstrated considerable potential for enhancing IoT security through their ability to automatically learn complex attack patterns and detect anomalous behavior. However, the effectiveness of these approaches often depends on the availability of large volumes of labeled training data, which are difficult to obtain in many IoT environments due to device heterogeneity, evolving attack patterns, privacy constraints, and the limited availability of domain-specific intrusion datasets. Consequently, conventional DL-based IDSs often exhibit reduced performance under data-constrained conditions. To address these challenges, this paper proposes a deep transfer learning (DTL)-based intrusion detection framework for data-constrained and resource-limited IoT environments. The proposed approach leverages knowledge acquired from large-scale computer network intrusion datasets by pre-training deep neural network (DNN) models on source-domain data and subsequently fine-tuning them using smaller IoT intrusion datasets. In addition, pruning and quantization techniques are incorporated to reduce model complexity and enable efficient deployment on resource-constrained IoT edge devices. Experimental results demonstrate that the proposed DTL framework outperforms conventional DL-based IDS models, achieving improvements in accuracy, recall, F1-score, and area under the receiver operating characteristic curve (AUC). Furthermore, the compressed models achieve substantial reductions in model size and improved inference latency. These findings demonstrate the effectiveness of cross-domain knowledge transfer for addressing intrusion detection in data-constrained IoT environments.