Unsupervised cross domain adaptive anomaly detection network for Internet of Things traffic

Abstract

The rapid growth of networks of connected devices demands robust methods for detecting anomalies in multivariate traffic. Traditional approaches often fail when data distributions shift across environments or when labeled anomalies are scarce. We introduce the Unsupervised Cross Domain Adaptive Anomaly Detection Network called CDA-ADN. This framework employs a conditional variational sequence encoder with temporal attention to learn domain invariant representations of traffic sequences. Domain specific adaptation layers align input and output distributions by applying transformations guided by latent features. A contrastive learning mechanism at both local time steps and global sequence levels separates normal patterns from anomalies. Training occurs in two stages. In the first stage the model learns general normal behavior on a source environment using only normal samples. In the second stage a very small number of unlabeled normal samples from the target environment are used for lightweight fine tuning of the adaptation layers, without requiring any labeled anomaly samples in the target domain. Experiments on two benchmark Internet of Things traffic datasets demonstrate that CDA-ADN outperforms auto encoder and variational auto encoder methods by a wide margin in accuracy Matthews correlation coefficient and sensitivity under label scarce conditions. These results confirm the efficacy of the unsupervised cross domain approach for real world IoT security.