Deep Transfer Learning for Intrusion Detection in Edge Computing Scenarios

Abstract

The rapidly evolving landscape of cyber threats poses significant challenges to network security, particularly in decentralized environments, such as edge computing. This article proposes an enhanced intrusion detection system (IDS) architecture that integrates transfer learning (TL) to create a unified supermodel, enabling adaptability and scalability for detecting emerging threats across diverse datasets (DS). The key contributions of this study include: 1) leveraging bidirectional encoder representations from transformer (BERT)-based feature extraction to enhance the semantic understanding of intrusion patterns; 2) employing an multilayer perceptron (MLP) classifier refined through TL to improve classification performance; 3) addressing class imbalance using synthetic minority over-sampling technique (SMOTE); and 4) optimizing model deployment by distributing the heaviest computational tasks for the creation of the unified supermodel across the edge nodes with the available capacity, thereby reducing latency and enabling accurate real-time threat detection by resource constrained IoT devices. The proposed TL-enabled supermodel is periodically updated and shared with the IoT devices, ensuring robust and adaptive security mechanisms without the need for extensive local training. Our experimental evaluation on CIC-IDS 2017 and NSL-KDD 2009 DS demonstrates the effectiveness of the approach, achieving 99% accuracy, precision, recall, and F1-score. Our results highlight the scalability, efficiency, and real-world applicability of our IDS framework, reinforcing its role in fortifying network security within highly dynamic cyber threat landscapes.