Abstract

The high heterogeneity of Internet of Things (IoT) devices causes severe imbalance in network traffic data, and the cost of collecting and labeling sufficient intrusion samples is high or impossible, resulting in data
scarcity in IoT security. Therefore, this paper proposes a domain adaptive IoT intrusion detection algorithm based on AEC-GAT feature extraction and joint domain adversary, which leverages abundant data resources from traditional network intrusion detection to improve the detection accuracy
in IoT environments. Firstly, a feature extraction method combining a causal embedding autoencoder and a graph attention network (AEC-GAT) is designed. The AEC uses causal inference to uncover deep semantic links between domains, while GAT captures device interaction patterns to enhance semantic relevance and structure awareness in the features. Secondly, to address the pronounced class imbalance in IoT datasets, Focal Loss is introduced to replace the traditional cross entropy loss. This formulation dynamically adjusts the sample weight through the scaling factor to guide the algorithm to focus on the minority samples that are difficult to classify. Meanwhile, a class adaptive independent domain discriminator method is proposed, which incorporates a class-level alignment mechanism within a joint adversarial training method. This
method dynamically adjusts both the training intensity and the loss weight of each class specific domain discriminator. The experimental results show that the algorithm in this paper significantly improves the detection performance of IoT intrusion detection by migrating traditional network
intrusion detection domain knowledge, and has superior performance in various indicators compared to existing algorithms.