DACL: Double-Anchor Contrastive Learning for IoT Network Intrusion Detection

In the Internet of Things, openness significantly increases security risks. Therefore, detecting such attacks through anomaly traffic monitoring is crucial for ensuring network security. Although existing Intrusion Detection Systems (IDS) have made some progress in detection performance using deep learning techniques (e.g., graph learning and meta-learning), the class imbalance problem remains a major challenge that needs to be addressed. To this end, we propose a Double-Anchor Contrastive Learning (DACL) framework. Firstly, we introduce a positive-negative sample construction module. Compared to traditional contrastive learning methods, this module directly constructs sample pairs, preserving more flow information and thereby enhancing the effectiveness. Secondly, we design a feature embedding and extraction module. By utilizing convolutional neural networks to extract spatial correlations among raw features, we generate more discriminative feature representations. Subsequently, we propose the double-anchor contrastive learning module, introducing a double-anchor mechanism to impose double constraints on inter-class distances, further enhancing feature representation capabilities and clustering effects. Finally, we map the learned features to a low-dimensional space via a classification network, achieving precise detection of abnormal traffic. Extensive experiments demonstrate that DACL outperforms existing works in terms of accuracy on datasets such as CIC-DDoS2017, CIC-IDS2018, and CIC-DDoS2019.