  The rapid expansion of the Internet of Things (IoT) has raised increasing
concern about targeted cyber attacks. Previous research primarily focused on
static Intrusion Detection Systems (IDSs), which employ offline training to
safeguard IoT systems. However, such static IDSs struggle with real-world
scenarios where IoT system behaviors and attack strategies can undergo rapid
evolution, necessitating dynamic and adaptable IDSs. In response to this
challenge, we propose AOC-IDS, a novel online IDS that features an autonomous
anomaly detection module (ADM) and a labor-free online framework for continual
adaptation. In order to enhance data comprehension, the ADM employs an
Autoencoder (AE) with a tailored Cluster Repelling Contrastive (CRC) loss
function to generate distinctive representation from limited or incrementally
incoming data in the online setting. Moreover, to reduce the burden of manual
labeling, our online framework leverages pseudo-labels automatically generated
from the decision-making process in the ADM to facilitate periodic updates of
the ADM. The elimination of human intervention for labeling and decision-making
boosts the system's compatibility and adaptability in the online setting to
remain synchronized with dynamic environments. Experimental validation using
the NSL-KDD and UNSW-NB15 datasets demonstrates the superior performance and
adaptability of AOC-IDS, surpassing the state-of-the-art solutions. The code is
released at https://github.com/xinchen930/AOC-IDS.
