Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The paper introduces SiamXBERT, a Siamese meta-learning framework leveraging a transformer-based language model, to address the challenge of detecting unknown (zero-day) attacks in IoT networks under data scarcity and encrypted traffic conditions. SiamXBERT constructs a dual-modality feature representation from flow and packet-level information and uses meta-learning for rapid adaptation to new attack types with limited labeled data. Experiments on IoT intrusion datasets demonstrate that SiamXBERT outperforms state-of-the-art baselines, achieving up to 78.8% improvement in unknown F1-score, showcasing its robustness and data efficiency.
Achieve near state-of-the-art zero-day IoT attack detection with 78% better F1 score using a Siamese meta-learning approach that requires significantly less training data.
The rapid evolution of cyberattacks continues to drive the emergence of unknown (zero-day) threats, posing significant challenges for network intrusion detection systems in Internet of Things (IoT) networks. Existing machine learning and deep learning approaches typically rely on large labeled datasets, payload inspection, or closed-set classification, limiting their effectiveness under data scarcity, encrypted traffic, and distribution shifts. Consequently, detecting unknown attacks in realistic IoT deployments remains difficult. To address these limitations, we propose SiamXBERT, a robust and data-efficient Siamese meta-learning framework empowered by a transformer-based language model for unknown attack detection. The proposed approach constructs a dual-modality feature representation by integrating flow-level and packet-level information, enabling richer behavioral modeling while remaining compatible with encrypted traffic. Through meta-learning, the model rapidly adapts to new attack types using only a small number of labeled samples and generalizes to previously unseen behaviors. Extensive experiments on representative IoT intrusion datasets demonstrate that SiamXBERT consistently outperforms state-of-the-art baselines under both within-dataset and cross-dataset settings while requiring significantly less training data, achieving up to \num{78.8}\% improvement in unknown F1-score. These results highlight the practicality of SiamXBERT for robust unknown attack detection in real-world IoT environments.