Adversarial Machine Learning for Detection of Zero-Day Attacks on IoT Networks

Abstract

The Internet of Things (IoT) has dramatically expanded global connectivity, with billions of heterogeneous devices generating massive volumes of network traffic. This growth has significantly enlarged the attack surface for cyber threats, particularly synthetic unknown attacks that exploit vulnerabilities not yet captured in existing signature databases. Traditional intrusion detection systems (IDS), which rely on known attack signatures, fail to detect such novel threats. This study proposes a comprehensive Adversarial Machine Learning (AML) framework designed to detect synthetic unknown attacks in IoT networks through the integration of three complementary techniques: Generative Adversarial Networks (GANs) for synthesizing realistic attack samples, Adversarial Autoencoders (AAEs) for robust low-dimensional feature extraction, and Deep Neural Networks (DNNs) for real-time anomaly classification. The framework was evaluated on a controlled synthetic IoT dataset comprising 250,000 traffic samples. Results demonstrate detection accuracy of 94.8%, precision of 93.1%, recall of 92.7%, and F1-score of 92.9%, substantially outperforming signature-based IDS (63.5%), SVM (87.2%), and Random Forest (90.1%). The framework maintained detection rates of 90.2%, 87.5%, and 85.3% under FGSM, PGD, and Carlini-Wagner adversarial perturbations, respectively. Scalability testing across datasets up to 4 million samples confirmed sustained performance with inference latency below 0.021 seconds per sample. The proposed framework represents a scalable, adversarially resilient approach to IoT intrusion detection, with limitations regarding real-world generalization openly acknowledged.