  As Internet of Things devices become prevalent, using intrusion detection to
protect IoT from malicious intrusions is of vital importance. However, the data
scarcity of IoT hinders the effectiveness of traditional intrusion detection
methods. To tackle this issue, in this paper, we propose the Adaptive
Bi-Recommendation and Self-Improving Network (ABRSI) based on unsupervised
heterogeneous domain adaptation (HDA). The ABRSI transfers enrich intrusion
knowledge from a data-rich network intrusion source domain to facilitate
effective intrusion detection for data-scarce IoT target domains. The ABRSI
achieves fine-grained intrusion knowledge transfer via adaptive
bi-recommendation matching. Matching the bi-recommendation interests of two
recommender systems and the alignment of intrusion categories in the shared
feature space form a mutual-benefit loop. Besides, the ABRSI uses a
self-improving mechanism, autonomously improving the intrusion knowledge
transfer from four ways. A hard pseudo label voting mechanism jointly considers
recommender system decision and label relationship information to promote more
accurate hard pseudo label assignment. To promote diversity and target data
participation during intrusion knowledge transfer, target instances failing to
be assigned with a hard pseudo label will be assigned with a probabilistic soft
pseudo label, forming a hybrid pseudo-labelling strategy. Meanwhile, the ABRSI
also makes soft pseudo-labels globally diverse and individually certain.
Finally, an error knowledge learning mechanism is utilised to adversarially
exploit factors that causes detection ambiguity and learns through both current
and previous error knowledge, preventing error knowledge forgetfulness.
Holistically, these mechanisms form the ABRSI model that boosts IoT intrusion
detection accuracy via HDA-assisted intrusion knowledge transfer.
