TransferEdge: Transfer learning approach to detect evolving DDoS threats in Edge-IIoT

The rapid proliferation of edge IoT systems in critical infrastructures, from smart cities to industrial IoT (IIoT) environments, has introduced significant security challenges, particularly Distributed Denial-of-Service (DDoS) attacks. These attacks can degrade service quality and compromise the availability and integrity of services. Although deep learning (DL) models have shown promise in detecting DDoS attacks, their reliance on large, high-quality labeled datasets limits their adaptability in dynamic IoT environments. Transfer learning offers a potential solution; however, existing methods often struggle with domain adaptation and effective knowledge transfer across heterogeneous datasets, leading to suboptimal performance against evolving attack patterns. To address these challenges, we propose TransferEdge, a novel transfer learning-based approach to detect evolving DDoS attacks in industrial IoT edge systems. TransferEdge leverages pre-trained models and describes a novel approach to optimize fine-tuning strategies tailored for DDoS attack detection, so as to align feature spaces and bridge the distributional gap between source and target domains. Experimental evaluations on the UNSW-NB15 and BoT-IoT datasets demonstrate that TransferEdge improves detection accuracy and decreases training time compared to conventional DL methods and current transfer learning approaches.