# Open Set Dandelion Network for IoT Intrusion Detection

arXiv: https://arxiv.org/abs/2311.11249 · HTML: https://mlsanity.com/paper/2311.11249/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 45 references that are in the map.
- First posted on arXiv 19 Nov 2023.

## Builds on (most cited first, 14 of 14)

- [Domain-Adversarial Training of Neural Networks](https://mlsanity.com/paper/1505.07818/) (2015)
- [Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection](https://mlsanity.com/paper/1802.09089/) (2018)
- [Characteristic Functions on Graphs: Birds of a Feather, from Statistical Descriptors to Parametric Models](https://mlsanity.com/paper/2005.07959/) (2020)
- [Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset](https://mlsanity.com/paper/1811.00701/) (2018)
- [Towards Inheritable Models for Open-Set Domain Adaptation](https://mlsanity.com/paper/2004.04388/) (2020)
- [Progressive Graph Learning for Open-Set Domain Adaptation](https://mlsanity.com/paper/2006.12087/) (2020)
- [Open Set Domain Adaptation: Theoretical Bound and Algorithm](https://mlsanity.com/paper/1907.08375/) (2019)
- [Simultaneous Semantic Alignment Network for Heterogeneous Domain Adaptation](https://mlsanity.com/paper/2008.01677/) (2020)
- [Pareto Domain Adaptation](https://mlsanity.com/paper/2112.04137/) (2021)
- [Towards Novel Target Discovery Through Open-Set Domain Adaptation](https://mlsanity.com/paper/2105.02432/) (2021)
- [Joint Semantic Transfer Network for IoT Intrusion Detection](https://mlsanity.com/paper/2210.15911/) (2022)
- [Heterogeneous Domain Adaptation for IoT Intrusion Detection: A Geometric Graph Alignment Approach](https://mlsanity.com/paper/2301.09801/) (2023)
- [PackCache: An Online Cost-driven Data Caching Algorithm in the Cloud](https://mlsanity.com/paper/2207.09035/) (2022)
- [Adaptive Bi-Recommendation and Self-Improving Network for Heterogeneous Domain Adaptation-Assisted IoT Intrusion Detection](https://mlsanity.com/paper/2303.14317/) (2023)

## Built on by (most cited first, 1 of 1)

- [Semantic Multi-Agent Intrusion Detection for IoT:Zero-Day and Adversarial Threats with Risk-Aware Reasoning](https://mlsanity.com/paper/2606.10323/) (2026)

## Abstract (arXiv)

As IoT devices become widely, it is crucial to protect them from malicious intrusions. However, the data scarcity of IoT limits the applicability of traditional intrusion detection methods, which are highly data-dependent. To address this, in this paper we propose the Open-Set Dandelion Network (OSDN) based on unsupervised heterogeneous domain adaptation in an open-set manner. The OSDN model performs intrusion knowledge transfer from the knowledge-rich source network intrusion domain to facilitate more accurate intrusion detection for the data-scarce target IoT intrusion domain. Under the open-set setting, it can also detect newly-emerged target domain intrusions that are not observed in the source domain. To achieve this, the OSDN model forms the source domain into a dandelion-like feature space in which each intrusion category is compactly grouped and different intrusion categories are separated, i.e., simultaneously emphasising inter-category separability and intra-category compactness. The dandelion-based target membership mechanism then forms the target dandelion. Then, the dandelion angular separation mechanism achieves better inter-category separability, and the dandelion embedding alignment mechanism further aligns both dandelions in a finer manner. To promote intra-category compactness, the discriminating sampled dandelion mechanism is used. Assisted by the intrusion classifier trained using both known and generated unknown intrusion knowledge, a semantic dandelion correction mechanism emphasises easily-confused categories and guides better inter-category separability. Holistically, these mechanisms form the OSDN model that effectively performs intrusion knowledge transfer to benefit IoT intrusion detection. Comprehensive experiments on several intrusion datasets verify the effectiveness of the OSDN model, outperforming three state-of-the-art baseline methods by 16.9%.