🤖 AI Summary
To address the challenges of scarce labeled data, stringent real-time requirements, and insufficient model interpretability in IoT/IIoT intrusion detection, this paper proposes a real-time semi-supervised contrastive learning framework. Methodologically, it replaces conventional MLPs with Kolmogorov–Arnold Networks (KANs) featuring learnable activation functions to capture complex feature interactions; introduces a lightweight contrastive learning mechanism enabling fine-grained multi-class attack identification under extremely low labeling ratios (1.28%–8%); and integrates feature visualization and rule extraction modules to enhance model transparency and interpretability. Extensive experiments on UNSW-NB15, BoT-IoT, and Gas Pipeline datasets demonstrate that the proposed method significantly outperforms existing semi-supervised contrastive learning approaches in detection accuracy, robustness, and inference efficiency—making it particularly suitable for safety-critical IoT/IIoT applications.
📝 Abstract
In the era of the Fourth Industrial Revolution, cybersecurity and intrusion detection systems are vital for the secure and reliable operation of IoT and IIoT environments. A key challenge in this domain is the scarcity of labeled cyber-attack data, as most industrial systems operate under normal conditions. This data imbalance, combined with the high cost of annotation, hinders the effective training of machine learning models. Moreover, rapid detection of attacks is essential, especially in critical infrastructure, to prevent large-scale disruptions. To address these challenges, we propose a real-time intrusion detection system based on a semi-supervised contrastive learning framework using the Kolmogorov-Arnold Network (KAN). Our method leverages abundant unlabeled data to distinguish between normal and attack behaviors effectively. We validate our approach on three benchmark datasets: UNSW-NB15, BoT-IoT, and Gas Pipeline, using only 2.20 percent, 1.28 percent, and 8 percent of labeled samples, respectively, to simulate real-world conditions. Experimental results show that our method outperforms existing contrastive learning-based approaches. We further compare KAN with a traditional multilayer perceptron (MLP), demonstrating KAN's superior performance in both detection accuracy and robustness under limited supervision. KAN's ability to model complex relationships and its learnable activation functions are also explored and visualized, offering interpretability and potential for rule extraction. The method supports multi-class classification and proves effective in safety-critical environments where reliability is paramount.