Zero-day attack detection in Internet of Things networks using deep transductive transfer learning

Abstract

Cyberattacks targeting Internet of Things (IoT) systems, particularly zero-day exploits, are escalating due to inherent vulnerabilities in IoT networks. Traditional intrusion detection systems (IDSs) use machine learning, such as deep learning (DL), to improve cyberattack detection. Nevertheless, DL-based IDSs require well-balanced datasets with abundant labeled data, which is often not available in IoT networks. In this article, we propose an efficient IDS that incorporates transfer learning (TL), knowledge transfer, and model refinement to accurately identify zero-day attacks. The TL model is based on deep convolutional neural networks adapted to 5G IoT environments with unbalanced and limited labeled datasets. The proposed framework employed three specialized datasets: the University of New South Wales Network-Based 2015 dataset (UNSW-NB15)-Basic for model training, UNSW-NB15-Test+ for evaluating zero-day attack detection, and UNSW-NB15-Test for comprehensive evaluation involving both known and zero-day attacks. The experimental results validate the effectiveness of our approach, achieving high accuracy and low false-prediction rates. In particular, the introduced TL-oriented solution outperforms other DL-based IDSs in detecting various families of known and zero-day attacks, representing a significant step forward in protecting IoT devices against cyber threats.

Keywords

Cybersecurity / Convolutional neural network / Intrusion detection systems / Internet of Things networks / Transfer learning

References

[1] Aceto, G., Ciuonzo, D., Montieri, A., & Pescapé, A. (2020). Toward effective mobile encrypted traffic classification through deep learning. Neurocomputing, 409, 306-315. https://doi.org/10.1016/j.neucom.2020.05.036

[2] Bilge, L., & Dumitras, T. (2012). Before we knew it: An empirical study of zero—day attacks in the real world. In: Proceedings of the 2012 ACM Conference on Computer and Communications Security, October 16—18, 2012, Raleigh, NC. 833-844. https://doi.org/10.1145/2382196.2382284

[3] Bongu, S. R. (2025). Real—Time Behavioral Biometrics and Continuous Authentication Framework for Secure Financial Transaction Ecosystems. Journal of Applied Sciences and Modelling, 1(1), 40-50. https://doi.org/10.71426/jasm.v1.i1.pp40—50

[4] Buczak, A. L., & Guven, E. (2016). A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications Surveys & Tutorials, 18(2), 1153-1176. https://doi.org/10.1109/comst.2015.2494502

[5] Chapman, C. (2016). Chapter 1—Introduction to Practical Security and Performance Testing. In Chapman, C. (Ed.) Network Performance and Security. Boston, MA: Syngress. (pp. 1-14). https://doi.org/10.1016/B978—0—12—803584—9.00001—9

[6] Chawla, N. V., Bowyer, K. W., Hall, L. O., & Kegelmeyer, W. P. (2002). SMOTE: Synthetic Minority Over—sampling technique. Journal of Artificial Intelligence Research, 16, 321-357. https://doi.org/10.1613/jair.953

[7] Fadlullah, Z. M., Tang, F., Mao, B., Kato, N., Akashi, O., Inoue, T., & Mizutani, K. (2017). State—of—the—Art Deep Learning: Evolving machine intelligence toward tomorrow’s intelligent network traffic control systems. IEEE Communications Surveys & Tutorials, 19(4), 2432-2455. https://doi.org/10.1109/comst.2017.2707140

[8] Fan, Y., Li, Y., Zhan, M., Cui, H., & Zhang, Y. (2020). IoTDefender: A Federated Transfer Learning Intrusion Detection Framework for 5G IoT. In: Proceedings of the 2020 IEEE International Conference on Big Data Science and Engineering (BigDataSE), December 29, 2020—January 1, 2021, Guangdong, China. 88-95. https://doi.org/10.1109/BigDataSE50710.2020.00020

[9] Ficke, E., Schweitzer, K., Bateman, R., & Xu, S. (2019). Analyzing Root Causes of Intrusion Detection False—Negatives: Methodology and Case Study. In: Proceedings of the 2019 IEEE Military Communications Conference (MILCOM), November 12—14, 2019, Norfolk, VA. 1-6. https://doi.org/10.1109/MILCOM47813.2019.9020860

[10] Gopalakrishnan, K., Khaitan, S. K., Choudhary, A., & Agrawal, A. (2017). Deep Convolutional Neural Networks with transfer learning for computer vision—based data—driven pavement distress detection. Construction and Building Materials, 157, 322-330. https://doi.org/10.1016/j.conbuildmat.2017.09.110

[11] Guan, J., Cai, J., Bai, H., & You, I. (2021). Deep transfer learning—based network traffic classification for scarce dataset in 5G IoT systems. International Journal of Machine Learning and Cybernetics, 12(11), 3351-3365. https://doi.org/10.1007/s13042—021—01415—4

[12] Gunupusala, S., & Kaila, S. C. (2024). Multi—Class network anomaly detection using machine learning techniques. Contemporary Mathematics, 5(2), 37-49. https://doi.org/10.37256/cm.5220243723

[13] Hamed, T., Ernst, J. B., & Kremer, S. C. (2018). A survey and taxonomy of classifiers of intrusion detection systems. In Beyah, B., Chang, R., Li, Y., & Zhu, S. (Eds.) Computer and Network Security Essentials. Cham, Switzerland: Springer. (pp. 21-69). https://doi.org/10.1007/978—3—319—58424—9_2

[14] Hindy, H., Hodo, E., Bayne, E., Seeam, A., Atkinson, R., & Bellekens, X. (2018). A taxonomy of malicious traffic for intrusion detection systems. arXiv. arXiv:1806.03516. https://doi.org/10.48550/arXiv.1806.03516

[15] Hindy, H., Brosset, D., Bayne, E., Seeam, A. K., Tachtatzis, C., Atkinson, R., & Bellekens, X. (2020). A taxonomy of network threats and the effect of current datasets on intrusion detection systems. IEEE Access, 8, 104650-104675. https://doi.org/10.1109/ACCESS.2020.3000179

[16] Hodo, E., Bellekens, X., Hamilton, A., Tachtatzis, C., & Atkinson, R. (2017). Shallow and deep networks intrusion detection system: A taxonomy and survey. arXiv. arXiv:1701.02145. https://doi.org/10.48550/arXiv.1701.02145

[17] Idrissi, I., Azizi, M., & Moussaoui, O. (2021). Accelerating the update of a DL—based IDS for IoT using deep transfer learning. Indonesian Journal of Electrical Engineering and Computer Science, 23(2), 1059-1067. https://doi.org/10.11591/ijeecs.v23.i2.pp1059—1067

[18] Kaloudi, N., & Li, J. (2021). The AI—Based cyber threat landscape. ACM Computing Surveys, 53(1), 1-34. https://doi.org/10.1145/3372823

[19] Khraisat, A., Gondal, I., Vamplew, P., & Kamruzzaman, J. (2019). Survey of intrusion detection systems: techniques, datasets and challenges. Cybersecurity, 2(1), 1-22. https://doi.org/10.1186/s42400—019—0038—7

[20] Kilincer, I. F., Ertam, F., & Sengur, A. (2021). Machine learning methods for cyber security intrusion detection: Datasets and comparative study. Computer Networks, 188, 107840. https://doi.org/10.1016/j.comnet.2021.107840

[21] Koroniotis, N., Moustafa, N., Sitnikova, E., & Turnbull, B. (2019). Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot—IoT dataset. Future Generation Computer Systems, 100, 779-796. https://doi.org/10.1016/j.future.2019.05.041

[22] LeCun, Y., Bengio, Y., & Hinton, G. (2015). Deep learning. Nature, 521(7553), 436-444. https://doi.org/10.1038/nature14539

[23] Masum, M., & Shahriar, H. (2020, December 8—10). TL—NID: Deep Neural Network with Transfer Learning for Network Intrusion Detection. In: Proceedings of the 2020 15th International Conference for Internet Technology and Secured Transactions (ICITST), Online. 1-7. https://doi.org/10.23919/ICITST51030.2020.9351317

[24] Maz, Y. A., Anbar, M., Manickam, S., Abualhaj, M. M., Almalki, S. A., & Alabsi, B. A. (2025). Transfer Learning—Based Approach with an Ensemble Classifier for Detecting Keylogging Attack on the Internet of Things. Computers, Materials & Continua, 85(3), 5287-5307. https://doi.org/10.32604/cmc.2025.068257

[25] Mehedi, S. T., Anwar, A., Rahman, Z., & Ahmed, K. (2021). Deep Transfer learning based intrusion detection system for electric vehicular networks. Sensors, 21(14), 4736. https://doi.org/10.3390/s21144736

[26] Mehedi, S. T., Anwar, A., Rahman, Z., Ahmed, K., & Islam, R. (2023). Dependable Intrusion Detection System for IoT: A Deep Transfer Learning Based Approach. IEEE Transactions on Industrial Informatics, 19(1), 1006-1017. https://doi.org/10.1109/tii.2022.3164770

[27] Metrick, K., Najafi, P., & Semrau, J. (2020). Zero—Day Exploitation Increasingly Demonstrates Access to Money, Rather than Skill—Intelligence for Vulnerability Management (Part One). Technical Report, FireEye Technical Report. Accessed 10 June 2021: https://www.fireeye.com/blog/threat—research/2020/04/zero—day—exploitation—demonstrates—access—to—money—not—skill.

[28] Morid, M. A., Borjali, A., & Del Fiol, G. (2021). A scoping review of transfer learning research on medical image analysis using ImageNet. Computers in Biology and Medicine, 128, 104115. https://doi.org/10.1016/j.compbiomed.2020.104115

[29] Moustafa, N., & Slay, J. (2015). UNSW—NB15: a comprehensive data set for network intrusion detection systems (UNSW—NB15 network data set). In: Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), November 10—12, 2015, Canberra, Australia. 1-6. https://doi.org/10.1109/MilCIS.2015.7348942

[30] Nguyen, T. T., & Reddi, V. J. (2023). Deep reinforcement learning for cyber security. IEEE Transactions on Neural Networks and Learning Systems, 34(8), 3779-3795. https://doi.org/10.1109/TNNLS.2021.3121870

[31] Pan, S. J., & Yang, Q. (2010). A survey on transfer learning. IEEE Transactions on Knowledge and Data Engineering, 22(10), 1345-1359. https://doi.org/10.1109/tkde.2009.191

[32] Penaganti, R. (2025). Graph Neural Network—Based Framework for Real—Time Financial Fraud Detection in Digital Payment Ecosystems. Journal of Computing and Data Technology, 1(2), 91-97. https://doi.org/10.71426/jcdt.v1.i2.pp91—97

[33] Rodriguez, E., Otero, B., Gutierrez, N., & Canal, R. (2021). A survey of deep learning techniques for cybersecurity in mobile networks. IEEE Communications Surveys & Tutorials, 23(3), 1920-1955. https://doi.org/10.1109/comst.2021.3086296

[34] Ruder, S., Peters, M E., Swayamdipta, S., & Wolf, T. (2021). Transfer Learning in Natural Language Processing. In: Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Tutorials (NAACL—HLT Tutorials), June 2—7, 2021, Minneapolis, MN. 15-18. https://doi.org/10.18653/v1/N19—5004

[35] Sameera, N., & Shashi, M. (2019). Transfer Learning Based Prototype for Zero—Day Attack Detection. International Journal of Engineering and Advanced Technology, 8(4), 1326-1329.

[36] Satyanarayana, E. A. G. (2023). Efficient Inductive Transfer Learning based Framework for Zero—Day Attack Detection. International Journal on Recent and Innovation Trends in Computing and Communication, 11(9), 552-559. https://doi.org/10.17762/ijritcc.v11i9.8843

[37] Satyanarayana, G., & Chatrapathi, K. S. (2025). Enhancing intrusion detection in the BoT—IoT dataset through genetic algorithms—based feature extraction and ensemble machine learning approaches. In: Lecture Notes in Networks and Systems. Singapore: Springer Nature. (pp. 381-392). https://doi.org/10.1007/978—981—96—3939—7_33

[38] Shao, S., McAleer, S., Yan, R., & Baldi, P. (2019). Highly accurate machine fault diagnosis using deep transfer learning. IEEE Transactions on Industrial Informatics, 15(4), 2446-2455. https://doi.org/10.1109/tii.2018.2864759

[39] Singla, A., Bertino, E., & Verma, D. (2019). Overcoming the Lack of Labeled Data: Training Intrusion Detection Models Using Transfer Learning. In: Proceedings of the 2019 IEEE International Conference on Smart Computing (SMARTCOMP), June 12—15, 2019, Washington, DC. 69-74. https://doi.org/10.1109/SMARTCOMP.2019.00031

[40] Song, H. M., Woo, J., & Kim, H. K. (2020). In—vehicle network intrusion detection using deep convolutional neural network. Vehicular Communications, 21, 100198. https://doi.org/10.1016/j.vehcom.2019.100198

[41] Thamilarasu, G., & Chawla, S. (2019). Towards Deep—Learning—Driven intrusion detection for the internet of things. Sensors, 19(9), 1977. https://doi.org/10.3390/s19091977

[42] Wu, P., Guo, H., & Buckland, R. (2019). A transfer learning approach for network intrusion detection. arXiv. arXiv:1909.02352. https://doi.org/10.48550/arXiv.1909.02352

[43] Yosinski, J., Clune, J., Bengio, Y., & Lipson, H. (2014). How transferable are features in deep neural networks? arXiv. arXiv:1411.1792. https://doi.org/10.48550/ARXIV.1411.1792

[44] Zhuang, F., Qi, Z., Duan, K., Xi, D., Zhu, Y., Zhu, H., Xiong, H., & He, Q. (2020). A comprehensive survey on transfer learning. Proceedings of the IEEE, 109(1), 43-76. https://doi.org/10.1109/jproc.2020.3004555