CLU-ID: Contrastive learning based unsupervised intrusion detection for low-power IoT devices

The proliferation of Internet of Things (IoT) devices raises significant security concerns, yet existing anomaly detection methods often overlook the data scarcity of low-power devices and the computational constraints of IoT gateways. This paper addresses these challenges by first analyzing traffic samples with t-SNE and Kernel Density Estimation, revealing that samples from other devices exhibit similarity to attack samples of a target device. Based on this observation, a novel contrastive learning-based unsupervised intrusion detection method named CLU-ID is proposed, which operates in two stages: contrastive pre-training and centroid-centered training. The contrastive pre-training stage employs a contrastive loss to distinguish target device flows from others, directing the model to focus on distinctive features of the target device rather than common features shared across devices. The centroid-centered training stage models the normal distribution of each device within a single neural network, generating central vectors that represent typical flow features and enabling anomaly detection as distribution outliers. Experimental results demonstrate that CLU-ID achieves state-of-the-art performance with limited training samples, outperforming Autoencoder (AE), Deep SVDD (DSVDD), Kitsune, and six traditional methods across both shared and individual model scenarios. Furthermore, the model significantly reduces parameter volume compared to AE and DSVDD, enhancing suitability for resource-constrained gateways, while also exhibiting effective detection capability for unseen attacks. • Addresses data scarcity and computational constraints in low-power IoT intrusion detection. • Proposes CLU-ID, a contrastive learning-based unsupervised intrusion detection method. • Employs contrastive pre-training to extract device-specific distinguishing features. • Uses centroid-centered training to model normal distributions and detect outliers as anomalies. • Achieves up to 30% performance improvement over AE and DSVDD with over 90% parameter reduction.