  As IoT devices become widely, it is crucial to protect them from malicious
intrusions. However, the data scarcity of IoT limits the applicability of
traditional intrusion detection methods, which are highly data-dependent. To
address this, in this paper we propose the Open-Set Dandelion Network (OSDN)
based on unsupervised heterogeneous domain adaptation in an open-set manner.
The OSDN model performs intrusion knowledge transfer from the knowledge-rich
source network intrusion domain to facilitate more accurate intrusion detection
for the data-scarce target IoT intrusion domain. Under the open-set setting, it
can also detect newly-emerged target domain intrusions that are not observed in
the source domain. To achieve this, the OSDN model forms the source domain into
a dandelion-like feature space in which each intrusion category is compactly
grouped and different intrusion categories are separated, i.e., simultaneously
emphasising inter-category separability and intra-category compactness. The
dandelion-based target membership mechanism then forms the target dandelion.
Then, the dandelion angular separation mechanism achieves better inter-category
separability, and the dandelion embedding alignment mechanism further aligns
both dandelions in a finer manner. To promote intra-category compactness, the
discriminating sampled dandelion mechanism is used. Assisted by the intrusion
classifier trained using both known and generated unknown intrusion knowledge,
a semantic dandelion correction mechanism emphasises easily-confused categories
and guides better inter-category separability. Holistically, these mechanisms
form the OSDN model that effectively performs intrusion knowledge transfer to
benefit IoT intrusion detection. Comprehensive experiments on several intrusion
datasets verify the effectiveness of the OSDN model, outperforming three
state-of-the-art baseline methods by 16.9%.
