Dependable Intrusion Detection System for IoT: A Deep Transfer Learning-based Approach

I. INTRODUCTION

• Traditional security mechanisms may not suit IoT devices' limited compute and storage, and can miss internal attacks amid evolving threats.The paper also describes targeted attacks and associated anomalies as difficult for these mechanisms to address.Source: §I · p. 1
• Traditional machine- and deep-learning IDSs often require substantial training data, making dependable models difficult to train with small target-domain datasets.The introduction notes that training-set size affects accuracy when data is insufficient.Source: §I · p. 1
• The proposed deep transfer learning-based P-ResNet targets dependable intrusion detection for heterogeneous IoT, including a range of attack types.Listed threats include DoS, DDoS, data injection, MITM, backdoor, password cracking, scanning, XSS, and ransomware.Source: §I · p. 2
• 87% overall accuracy, 88% precision, 86% recall, and 86% F1-score exceed benchmark models with low computational complexity.The paper reports that the model can classify normal and attack scenarios without failure or repair actions, maintaining availability.Source: §I · p. 2
• The experiments use empirical IoT stream data from seven heterogeneous sensors to identify features suited to supervised learning.The stated aims are faster training and improved performance metrics while ensuring dependability.Source: §I · p. 2

II. RELATED WORK

• 23% improved detection accuracy was reported for a transfer-learning approach to Internet of Vehicles attacks; prior work also explored transfer learning for intrusion detection.The related-work discussion describes knowledge reuse, TrAdaBoost, and approaches for large-scale IoT attack detection.Source: §II · p. 2
• Transfer-learning IDS updates still require some labeled data; TON_IoT telemetry data was proposed as suitable for deep transfer learning, which had performed well in time-series classification.The discussion also states that further analysis of complex cyber-attacks across categories is needed.Source: §II · p. 3

III. PROPOSED METHODOLOGY

• The methodology section introduces P-ResNet and says it will explain the model structure and its adaptation for deep transfer learning.Source: §III · p. 3

A. Problem Statement

• The problem statement targets efficient identification and classification of a wide range of attacks, including DoS, data injection, MITM, backdoor, password cracking, scanning, and ransomware.It notes that these attacks are challenging to detect at low computational complexity.Source: A. Problem Statement · p. 3
• To address limited device profiling, the study considers seven IoT devices, including a fridge, GPS tracker, motion light, garage door, modbus, thermostat, and weather sensor.Source: A. Problem Statement · p. 3
• The proposed model is intended to classify attack scenarios automatically and account for dependability, which prior IDSs often did not address.Source: A. Problem Statement · p. 3
• The paper identifies insufficient training data and limited IoT computational resources as challenges for conventional machine- and deep-learning IDSs.It also notes that traditional security mechanisms may be less scalable, inefficient, and focused on external attacks.Source: A. Problem Statement · p. 3
• P-ResNet transfers source-domain knowledge to target-domain data and bypasses input data directly to the output layer, allowing access to raw data.The paper also analyzes availability, efficiency, and scalability as dependability features.Source: A. Problem Statement · p. 3

B. ResNet with Deep Transfer Learning

• Table I summarizes recent IoT IDS research by marking topics as covered, not covered, or partially covered.Source: Table I · p. 4
• Residual blocks combine an identity mapping with the input, a design used to address degradation as networks become deeper.The passage notes that deeper networks may extract more complex features but can also become saturated.Source: B. ResNet with Deep Transfer Learning · pp. 3–4
• Maximum Mean Discrepancy measures the difference between source and target domains, whose labels share normal and attack classes even when attackers differ.The source and target domains are described as having the same feature space but different performance on specific features.Source: B. ResNet with Deep Transfer Learning · p. 4
• Weights learned on source attack-classification problems are transferred to a target DNN for a distinct task, making the method an inductive transfer.The target dataset and task are assumed to be accessible.Source: B. ResNet with Deep Transfer Learning · p. 4
• The source dataset combines multiple IoT datasets by splitting their channels into fixed-length segments, which are then joined as training examples.The source task classifies different attacks, and its labels are defined separately.Source: B. ResNet with Deep Transfer Learning · p. 4
• A single-channel DNN learns the source prediction function, and its hidden-layer weights and biases initialize corresponding branches in a multi-channel target DNN.The target network separates sensor channels into branches, concatenates their outputs, and is fine-tuned on labeled target data.Source: B. ResNet with Deep Transfer Learning · pp. 4–5

C. Proposed Architecture

• The IDS block diagram has a training part and an intrusion-detection part, and empirical experiments determine the model parameters and final selection.Table II presents the proposed model’s hyperparameters.Source: C. Proposed Architecture · p. 5, Table II · p. 5
• The P-ResNet uses four one-dimensional convolution layers with specified filter counts and kernel lengths, followed by batch normalization and ReLU in each feature-smoothing layer.The feature-smoothing layers retain tensor shape and smooth pretrained tensors for learning from new training data.Source: C. Proposed Architecture · p. 5
• A feature-extraction layer doubles channels and flattens the feature map, while global average pooling reduces parameters before softmax classification.Global average pooling also enables use of a class activation map to interpret learned features.Source: C. Proposed Architecture · pp. 5–6
• The model uses data augmentation, Gaussian noise, a smaller network, and early stopping to reduce overfitting, while skip connections support feature reuse and training stability.Skip connections are implemented through vector addition.Source: C. Proposed Architecture · p. 6

IV. MODEL IMPLEMENTATION AND EVALUATION

• The analyses used an Intel Core i7-6800K CPU and GeForce GTX 1080Ti, without changing the original combined dataset’s properties.The section also explains the training process and selected models.Source: §IV · p. 6

A. Dataset Description

• The dataset draws on seven sensors: fridge, GPS tracker, motion light, garage door, Modbus, thermostat, and weather.Their measurements include device-specific states and environmental readings such as temperature, pressure, and humidity.Source: A. Dataset Description · p. 6
• The combined dataset has 22 features including a binary label, with 0 and 1 indicating normal and attack scenarios, respectively.Figure 4(b) shows the combined dataset’s class distribution.Source: A. Dataset Description · p. 6
• The dataset considers nine cyber-attacks, and Figure 4(a) shows statistics for the abnormal dataset with attacks.The listed types are DoS, DDoS, data injection, MITM, backdoor, password cracking, scanning, XSS, and ransomware.Source: A. Dataset Description · p. 6, Figure 4 · p. 6

• Data preparation removes unnecessary features, checks variation in independent features, converts non-numerical features, removes outliers, and replaces missing values when present.Source: B. Data Preparation · p. 6
• The preparation process has two fundamental steps: data pre-processing and data transformation.Source: B. Data Preparation · p. 6
• These steps are intended to prepare the dataset before applying deep transfer learning methods.Source: B. Data Preparation · p. 6

1) Data Pre-processing:

• Cleaning removes noise and inconsistencies, imputes missing values, encodes qualitative values numerically, omits date/time fields, and reshapes inputs for the models.Source: 1) Data Pre-processing · p. 7
• Correlation analysis examines relationships among features from heterogeneous IoT sensors to reduce and avoid redundancy during data integration.Source: 1) Data Pre-processing · p. 7, Figure 5 · p. 7

2) Data Transformation:

• Minimum-maximum normalization scales selected feature values to [0.0, 1.0] without changing data characteristics.Source: 2) Data Transformation · p. 7

C. Training Process

• The combined dataset is split into 80% training data and 20% test data, with the test set used to assess trained classifiers.Source: C. Training Process · p. 7
• The training portion is further split into 80% for model training and 20% for validation and hyperparameter optimization.Source: C. Training Process · pp. 7–8
• Selected models include eight transfer-learning models, including P-ResNet, and four deep-learning algorithms; evaluation spans a wide range of tested hyperparameters.Source: Figure 6 · p. 7, C. Training Process · p. 8

V. RESULT ANALYSIS

• Performance analysis examines accuracy, precision, recall, ROC AUC, and F1-score, alongside hyperparameter optimization.Source: §V · p. 8

A. DL Metrics Analysis

• LSTM and NN had the highest DL-baseline accuracy at 0.82, followed by RNN at 0.80 and CNN at 0.79; P-ResNet performed better in most cases.The reported comparison says P-ResNet's accuracy, precision, f1-score, and ROC AUC were better than the other experimental scenarios.Source: A. DL Metrics Analysis · p. 8, Figure 7 · p. 8

B. DTL Metrics Analysis

• P-ResNet is reported as optimal among the DTL models, with accuracy 0.87, precision 0.88, recall 0.86, f1-score 0.86, and ROC AUC 0.83.Table III summarizes the DTL performance comparison.Source: Table III · p. 8, B. DTL Metrics Analysis · p. 8
• Across 200 epochs, P-ResNet had the highest training and validation accuracy, while MLP had the lowest; the analysis used 200 epochs after curves flattened around epochs 170–200.P-ResNet accuracy rose rapidly at epoch 60, peaked near 0.87 at epoch 169, and remained almost stable up to early stopping.Source: B. DTL Metrics Analysis · p. 9, Figure 8 · p. 9, Figure 9 · p. 9
• MLP accuracy rose from about 0.67 training and 0.63 validation at epoch 10 to 0.78 and 0.74, respectively, then remained stable through epoch 200.LSTM and FCN accuracy rose from 0.82 to approximately 0.86 by epoch 160, while CNN, IncepNet, LeNet, and MCDCNN accuracy remained steady.Source: B. DTL Metrics Analysis · p. 9
• P-ResNet had the lowest loss across epochs 1–200, declining from about 0.41 training and 0.42 validation to 0.27 and 0.28, respectively.Training loss 0.27 remained stable from epoch 141 through the early-stopping checkpoint; MLP had the highest training and validation losses.Source: B. DTL Metrics Analysis · p. 9, Figure 10 · p. 9, Figure 11 · p. 9
• Handling concept drift is scoped for future work, although the authors argue transfer learning has potential for evolving IoT data streams.The passage describes concept drift as changing relationships between inputs and target outputs.Source: B. DTL Metrics Analysis · p. 10

C. Performance Analysis on Training and Testing Time

• Among DL models, NN required 2.660 seconds and had 50,985 trainable parameters, fewer parameters and less testing time than the other DL models.The passage contrasts NN with models described as lazy learners, which store data during training and use it during testing.Source: C. Performance Analysis on Training… · p. 10, Table IV · p. 10
• FCN had the longest training and testing times, 46,756.338 and 7.722 seconds, respectively, with 265,986 trainable parameters.CNN had the lowest testing time at 2.718 seconds and training time of 33,869.838 seconds, the third-lowest among DTL models.Source: C. Performance Analysis on Training… · p. 10, Table IV · p. 10
• P-ResNet required 24,401.586 seconds training, 3.014 seconds testing, and 511,002 trainable parameters, fewer than most selected DTL models.The authors describe it as a fast learner that trains efficiently and makes faster test-phase predictions.Source: C. Performance Analysis on Training… · p. 10, Table IV · p. 10

D. Dependability Performance Analysis

• The authors report classification of normal and attack scenarios without failure or repair, and better performance than several existing approaches with low computational loss.Figure 12 presents the model's efficiency and computational loss.Source: Figure 12 · p. 10, D. Dependability Performance Analysis · p. 10
• With heterogeneous trusted data sources from a wider range of IoT sensors, accuracy remained almost the same as epochs increased from 125 to 200.The authors interpret this as indicating scalability; Figure 13 shows the scalability analysis.Source: D. Dependability Performance Analysis · p. 10, Figure 13 · p. 11

VI. CONCLUSION AND FUTURE WORK

• The model reports 87% overall accuracy, precision of 88%, recall of 86%, and f1-score of 86%, higher than benchmark models.The conclusion states that P-ResNet can classify attack instances across heterogeneous IoT networks.Source: §VI · p. 11
• Future work will add IoT sensors, optimize hyperparameters, and explore implementation on privacy-preserving decentralized devices or servers.The conclusion frames the proposed mechanism as a guideline for future dependable intrusion-detection research.Source: §VI · p. 11