A Few-Shot-Based Model-Agnostic Meta-Learning for Intrusion Detection in Security of Internet of Things

Currently, the effective technologies used to protect the security of the Internet of Things (IoT) include blockchain and intrusion detection systems (IDSs). The traditional IoT IDSs based on supervised learning usually requires a large amount of data for training, with high costs, and most of them can only work in several specific types of attacks. Faced with the variability of current IoT attack methods and the complexity of the network environment, they are usually unable to play a role in a short time. Especially in dealing with new security problems such as Zero-day attacks, which have a small number of learnable samples. Therefore, this article proposed an IoT intrusion detection model to deal with the situation where learnable samples are insufficient. The model adopts the idea of meta-learning and divides the training process into two layers based on model-agnostic meta-learning. Its purpose is to train a relatively general model using the malicious network flow data of various known attack modes. To this end, a few-shot IoT intrusion detection data set, FSIDS-IoT, is constructed based on five data sets, namely, CIC-DDoS2019, CIC-IDS2017, CSE-CIC-IDS2018, NSL-KDD, and UNSW-NB15. Experiments show that our proposed approach, using only a few gradient steps and a small amount of training data from the new attack type, can perform well to protect cyber security. In the test of identifying unknown attacks, the optimal accuracy under the 5-way 1-shot setting reached 78.26%, 90.09% under the 5-way 5-shot setting, and 92.19% under the 5-way 10-shot setting.

I. Introduction

With the commercial development of cyber-attack crime, the attack methods against various networks are constantly iterating. Hacker organizations use different protocols and development vulnerabilities to attack the hierarchical structure of the network, which poses a huge threat to the network access party [1]. Internet of Things (IoT) nodes often work in scenarios that are not monitored by people, vulnerable to attacks, and have limited security protection resources [2]. With the advent of the IoT era, the security of massive terminal devices and sensor networks in the IoT is also under threat. Technologies like intrusion detection system (IDS) and blockchain can effectively protect the security of IoT. Unlike blockchain, the research on IDS often combines with machine learning (ML). IDS, as a research hotspot in the field of IoT security in recent years, has emerged many outstanding research results [3], [4], [5]. Most of these studies combine the ML algorithm. They input the processed intrusion detection data sets into the different models for training, and then, obtain the models with application value through data validation and optimization of models’ parameters and structure, to form advanced IDS. From traditional algorithms, such as support vector machine (SVM), decision tree (DT), and Naive Bayes (NB) to cutting-edge algorithms, such as deep learning and reinforcement learning [6], [7], [8], the implementation of these models has gradually improved the effect of network intrusion detection. Although ML has been widely used in intrusion detection, using machine and human intelligence to detect intrusion toward IoT is still in its infancy [9], [10].