Zero-day attack detection in Internet of Things networks using deep transductive transfer learning
Cyberattacks targeting Internet of Things (IoT) systems, particularly zero-day exploits, are escalating due to inherent vulnerabilities in IoT networks. Traditional intrusion detection systems (IDSs) use machine learning, such as deep learning (DL), to improve cyberattack detection. Nevertheless, DL-based IDSs require well-balanced datasets with abundant labeled data, which is often not available in IoT networks. In this article, we propose an efficient IDS that incorporates transfer learning (TL), knowledge transfer, and model refinement to accurately identify zero-day attacks. The TL model is based on deep convolutional neural networks adapted to 5G IoT environments with unbalanced and limited labeled datasets. The proposed framework employed three specialized datasets: the University of New South Wales Network-Based 2015 dataset (UNSW-NB15)-Basic for model training, UNSW-NB15-Test+ for evaluating zero-day attack detection, and UNSW-NB15-Test for comprehensive evaluation involving both known and zero-day attacks. The experimental results validate the effectiveness of our approach, achieving high accuracy and low false-prediction rates. In particular, the introduced TL-oriented solution outperforms other DL-based IDSs in detecting various families of known and zero-day attacks, representing a significant step forward in protecting IoT devices against cyber threats.
Aceto, G., Ciuonzo, D., Montieri, A., & Pescapé, A. (2020). Toward effective mobile encrypted traffic classification through deep learning. Neurocomputing, 409, 306–315. https://doi.org/10.1016/j.neucom.2020.05.036
Bilge, L., & Dumitras, T. (2012). Before we knew it: An empirical study of zero-day attacks in the real world. In: Proceedings of the 2012 ACM Conference on Computer and Communications Security, October 16-18, 2012, Raleigh, NC. 833–844. https://doi.org/10.1145/2382196.2382284
Bongu, S. R. (2025). Real-Time Behavioral Biometrics and Continuous Authentication Framework for Secure Financial Transaction Ecosystems. Journal of Applied Sciences and Modelling, 1(1), 40–50. https://doi.org/10.71426/jasm.v1.i1.pp40-50
Buczak, A. L., & Guven, E. (2016). A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications Surveys & Tutorials, 18(2), 1153–1176. https://doi.org/10.1109/comst.2015.2494502
Chapman, C. (2016). Chapter 1—Introduction to Practical Security and Performance Testing. In Chapman, C. (Ed.) Network Performance and Security. Boston, MA: Syngress. (pp. 1–14). https://doi.org/10.1016/B978-0-12-803584-9.00001-9
Chawla, N. V., Bowyer, K. W., Hall, L. O., & Kegelmeyer, W. P. (2002). SMOTE: Synthetic Minority Over-sampling technique. Journal of Artificial Intelligence Research, 16, 321–357. https://doi.org/10.1613/jair.953
Fadlullah, Z. M., Tang, F., Mao, B., Kato, N., Akashi, O., Inoue, T., & Mizutani, K. (2017). State-of-the-Art Deep Learning: Evolving machine intelligence toward tomorrow’s intelligent network traffic control systems. IEEE Communications Surveys & Tutorials, 19(4), 2432–2455. https://doi.org/10.1109/comst.2017.2707140
Fan, Y., Li, Y., Zhan, M., Cui, H., & Zhang, Y. (2020). IoTDefender: A Federated Transfer Learning Intrusion Detection Framework for 5G IoT. In: Proceedings of the 2020 IEEE International Conference on Big Data Science and Engineering (BigDataSE), December 29, 2020-January 1, 2021, Guangdong, China. 88-95. https://doi.org/10.1109/BigDataSE50710.2020.00020
Ficke, E., Schweitzer, K., Bateman, R., & Xu, S. (2019). Analyzing Root Causes of Intrusion Detection False-Negatives: Methodology and Case Study. In: Proceedings of the 2019 IEEE Military Communications Conference (MILCOM), November 12-14, 2019, Norfolk, VA. 1-6. https://doi.org/10.1109/MILCOM47813.2019.9020860
Gopalakrishnan, K., Khaitan, S. K., Choudhary, A., & Agrawal, A. (2017). Deep Convolutional Neural Networks with transfer learning for computer vision-based data-driven pavement distress detection. Construction and Building Materials, 157, 322–330. https://doi.org/10.1016/j.conbuildmat.2017.09.110
Guan, J., Cai, J., Bai, H., & You, I. (2021). Deep transfer learning-based network traffic classification for scarce dataset in 5G IoT systems. International Journal of Machine Learning and Cybernetics, 12(11), 3351–3365. https://doi.org/10.1007/s13042-021-01415-4
Gunupusala, S., & Kaila, S. C. (2024). Multi-Class network anomaly detection using machine learning techniques. Contemporary Mathematics, 5(2), 37-49. https://doi.org/10.37256/cm.5220243723
Hamed, T., Ernst, J. B., & Kremer, S. C. (2018). A survey and taxonomy of classifiers of intrusion detection systems. In Beyah, B., Chang, R., Li, Y., & Zhu, S. (Eds.) Computer and Network Security Essentials. Cham, Switzerland: Springer. (pp. 21–69). https://doi.org/10.1007/978-3-319-58424-9_2
Hindy, H., Hodo, E., Bayne, E., Seeam, A., Atkinson, R., & Bellekens, X. (2018). A taxonomy of malicious traffic for intrusion detection systems. arXiv. arXiv:1806.03516. https://doi.org/10.48550/arXiv.1806.03516
Hindy, H., Brosset, D., Bayne, E., Seeam, A. K., Tachtatzis, C., Atkinson, R., & Bellekens, X. (2020). A taxonomy of network threats and the effect of current datasets on intrusion detection systems. IEEE Access, 8, 104650–104675. https://doi.org/10.1109/ACCESS.2020.3000179
Hodo, E., Bellekens, X., Hamilton, A., Tachtatzis, C., & Atkinson, R. (2017). Shallow and deep networks intrusion detection system: A taxonomy and survey. arXiv. arXiv:1701.02145. https://doi.org/10.48550/arXiv.1701.02145
Idrissi, I., Azizi, M., & Moussaoui, O. (2021). Accelerating the update of a DL-based IDS for IoT using deep transfer learning. Indonesian Journal of Electrical Engineering and Computer Science, 23(2), 1059–1067. https://doi.org/10.11591/ijeecs.v23.i2.pp1059-1067
Kaloudi, N., & Li, J. (2021). The AI-Based cyber threat landscape. ACM Computing Surveys, 53(1), 1–34. https://doi.org/10.1145/3372823
Khraisat, A., Gondal, I., Vamplew, P., & Kamruzzaman, J. (2019). Survey of intrusion detection systems: techniques, datasets and challenges. Cybersecurity, 2(1), 1–22. https://doi.org/10.1186/s42400-019-0038-7
Kilincer, I. F., Ertam, F., & Sengur, A. (2021). Machine learning methods for cyber security intrusion detection: Datasets and comparative study. Computer Networks, 188, 107840. https://doi.org/10.1016/j.comnet.2021.107840
Koroniotis, N., Moustafa, N., Sitnikova, E., & Turnbull, B. (2019). Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset. Future Generation Computer Systems, 100, 779–796. https://doi.org/10.1016/j.future.2019.05.041
LeCun, Y., Bengio, Y., & Hinton, G. (2015). Deep learning. Nature, 521(7553), 436–444. https://doi.org/10.1038/nature14539
Masum, M., & Shahriar, H. (2020, December 8-10). TL-NID: Deep Neural Network with Transfer Learning for Network Intrusion Detection. In: Proceedings of the 2020 15th International Conference for Internet Technology and Secured Transactions (ICITST), Online. 1-7. https://doi.org/10.23919/ICITST51030.2020.9351317
Maz, Y. A., Anbar, M., Manickam, S., Abualhaj, M. M., Almalki, S. A., & Alabsi, B. A. (2025). Transfer Learning-Based Approach with an Ensemble Classifier for Detecting Keylogging Attack on the Internet of Things. Computers, Materials & Continua, 85(3), 5287–5307. https://doi.org/10.32604/cmc.2025.068257
Mehedi, S. T., Anwar, A., Rahman, Z., & Ahmed, K. (2021). Deep Transfer learning based intrusion detection system for electric vehicular networks. Sensors, 21(14), 4736. https://doi.org/10.3390/s21144736
Mehedi, S. T., Anwar, A., Rahman, Z., Ahmed, K., & Islam, R. (2023). Dependable Intrusion Detection System for IoT: A Deep Transfer Learning Based Approach. IEEE Transactions on Industrial Informatics, 19(1), 1006–1017. https://doi.org/10.1109/tii.2022.3164770
Metrick, K., Najafi, P., & Semrau, J. (2020). Zero-Day Exploitation Increasingly Demonstrates Access to Money, Rather than Skill—Intelligence for Vulnerability Management (Part One). Technical Report, FireEye Technical Report. Accessed 10 June 2021: https://www. fireeye. com/blog/threat-research/2020/04/zero-day-exploitation-demonstrates-access-to-money-not-skill.
Morid, M. A., Borjali, A., & Del Fiol, G. (2021). A scoping review of transfer learning research on medical image analysis using ImageNet. Computers in Biology and Medicine, 128, 104115. https://doi.org/10.1016/j.compbiomed.2020.104115
Moustafa, N., & Slay, J. (2015). UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In: Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), November 10-12, 2015, Canberra, Australia. 1-6. https://doi.org/10.1109/MilCIS.2015.7348942
Nguyen, T. T., & Reddi, V. J. (2023). Deep reinforcement learning for cyber security. IEEE Transactions on Neural Networks and Learning Systems, 34(8), 3779-3795. https://doi.org/10.1109/TNNLS.2021.3121870
Pan, S. J., & Yang, Q. (2010). A survey on transfer learning. IEEE Transactions on Knowledge and Data Engineering, 22(10), 1345–1359. https://doi.org/10.1109/tkde.2009.191
Penaganti, R. (2025). Graph Neural Network-Based Framework for Real-Time Financial Fraud Detection in Digital Payment Ecosystems. Journal of Computing and Data Technology, 1(2), 91–97. https://doi.org/10.71426/jcdt.v1.i2.pp91-97
Rodriguez, E., Otero, B., Gutierrez, N., & Canal, R. (2021). A survey of deep learning techniques for cybersecurity in mobile networks. IEEE Communications Surveys & Tutorials, 23(3), 1920–1955. https://doi.org/10.1109/comst.2021.3086296
Ruder, S., Peters, M E., Swayamdipta, S., & Wolf, T. (2021). Transfer Learning in Natural Language Processing. In: Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Tutorials (NAACL-HLT Tutorials), June 2-7, 2021, Minneapolis, MN. 15–18. https://doi.org/10.18653/v1/N19-5004
Sameera, N., & Shashi, M. (2019). Transfer Learning Based Prototype for Zero-Day Attack Detection. International Journal of Engineering and Advanced Technology, 8(4), 1326–1329.
Satyanarayana, E. A. G. (2023). Efficient Inductive Transfer Learning based Framework for Zero-Day Attack Detection. International Journal on Recent and Innovation Trends in Computing and Communication, 11(9), 552–559. https://doi.org/10.17762/ijritcc.v11i9.8843
Satyanarayana, G., & Chatrapathi, K. S. (2025). Enhancing intrusion detection in the BoT-IoT dataset through genetic algorithms-based feature extraction and ensemble machine learning approaches. In: Lecture Notes in Networks and Systems. Singapore: Springer Nature. (pp. 381–392). https://doi.org/10.1007/978-981-96-3939-7_33
Shao, S., McAleer, S., Yan, R., & Baldi, P. (2019). Highly accurate machine fault diagnosis using deep transfer learning. IEEE Transactions on Industrial Informatics, 15(4), 2446–2455. https://doi.org/10.1109/tii.2018.2864759
Singla, A., Bertino, E., & Verma, D. (2019). Overcoming the Lack of Labeled Data: Training Intrusion Detection Models Using Transfer Learning. In: Proceedings of the 2019 IEEE International Conference on Smart Computing (SMARTCOMP), June 12-15, 2019, Washington, DC. 69-74. https://doi.org/10.1109/SMARTCOMP.2019.00031
Song, H. M., Woo, J., & Kim, H. K. (2020). In-vehicle network intrusion detection using deep convolutional neural network. Vehicular Communications, 21, 100198. https://doi.org/10.1016/j.vehcom.2019.100198
Thamilarasu, G., & Chawla, S. (2019). Towards Deep-Learning-Driven intrusion detection for the internet of things. Sensors, 19(9), 1977. https://doi.org/10.3390/s19091977
Wu, P., Guo, H., & Buckland, R. (2019). A transfer learning approach for network intrusion detection. arXiv. arXiv:1909.02352. https://doi.org/10.48550/arXiv.1909.02352
Yosinski, J., Clune, J., Bengio, Y., & Lipson, H. (2014). How transferable are features in deep neural networks? arXiv. arXiv:1411.1792. https://doi.org/10.48550/ARXIV.1411.1792
Zhuang, F., Qi, Z., Duan, K., Xi, D., Zhu, Y., Zhu, H., Xiong, H., & He, Q. (2020). A comprehensive survey on transfer learning. Proceedings of the IEEE, 109(1), 43–76. https://doi.org/10.1109/jproc.2020.3004555