OpenTriIDS: Confidence-Guided Open-Set Intrusion Triage for Unknown Attack Detection in IoT Devices.
- 1College of Air and Missile Defense, Air Force Engineering University, Xi'an 710051, China.
- 2Academy of Military Science, Beijing 100091, China.
Abstract
Open-set IoT intrusion detection must distinguish unfamiliar attacks from uncertain known traffic. OpenTriIDS implements a three-action policy: a random forest accepts high-confidence predictions, routes uncertain samples to a compact known-class prototype memory, and rejects routed samples beyond a standardized Euclidean distance boundary. At the representative S1 operating points on Edge-IIoTset and CIC-IoT-2023, the operational macro-F1 reaches 68.44% and 76.81%, with routing rates of 4.53% and 4.13%, respectively. The representative S1 analysis shows that the confidence gate defines the selected subset, while the three-prototype support rule improves macro-F1 and changes the balance between known-class retention and unknown rejection; the magnitude and direction depend on the dataset and operating point. The prototype-distance module records the matched label and distance for each routed sample. A complementary controlled protocol evaluates three seeds across multiple held-out-family settings, while a seven-method S1 comparison evaluates MSP, OpenMax, ORI open recognition, EFC, post hoc Energy OOD, single-layer Mahalanobis scoring, and OpenTriIDS at their documented operating points. OpenTriIDS achieves the highest macro-F1 among the evaluated methods in both datasets under this comparison. Together, the analyses characterize a selective open-set policy whose matched-gate macro-F1 advantage is accompanied by dataset- and holdout-dependent unknown-recall trade-offs, while distinguishing predictive performance from routing and computational cost.
Related
- MRCER-DR: Multi-Representation Confidence Entropy Rejection for IoT Open-Set Intrusion Detection
- Transformer-aided guard: A hybrid spatio-temporal framework for confidence-aware intrusion detection in cyber-physical systems
- CyberRoBERTa: A Lightweight Transformer-Based Language Model for IoT Intrusion Detection
- A multi-objective bayesian optimized neural network approach for intrusion detection
- Enhancing intrusion detection in IoT networks: CWInfoGAN based data augmentation approach
BibTeX
@article{wu2026opentriids,
title = {{OpenTriIDS: Confidence-Guided Open-Set Intrusion Triage for Unknown Attack Detection in IoT Devices.}},
author = {Xuan Wu and Peng Wang and Yafei Song and Xiaodan Wang},
journal = {Sensors (Basel, Switzerland)},
year = {2026},
month = oct,
doi = {10.3390/s26206369},
url = {https://europepmc.org/article/MED/42944230},
note = {CC BY},
}
RIS
TY - JOUR
TI - OpenTriIDS: Confidence-Guided Open-Set Intrusion Triage for Unknown Attack Detection in IoT Devices.
AU - Xuan Wu
AU - Peng Wang
AU - Yafei Song
AU - Xiaodan Wang
PY - 2026
DA - 2026/10/09
JO - Sensors (Basel, Switzerland)
DO - 10.3390/s26206369
UR - https://europepmc.org/article/MED/42944230
AB - Open-set IoT intrusion detection must distinguish unfamiliar attacks from uncertain known traffic. OpenTriIDS implements a three-action policy: a random forest accepts high-confidence predictions, routes uncertain samples to a compact known-class prototype memory, and rejects routed samples beyond a standardized Euclidean distance boundary. At the representative S1 operating points on Edge-IIoTset and CIC-IoT-2023, the operational macro-F1 reaches 68.44% and 76.81%, with routing rates of 4.53% and 4.13%, respectively. The representative S1 analysis shows that the confidence gate defines the selected subset, while the three-prototype support rule improves macro-F1 and changes the balance between known-class retention and unknown rejection; the magnitude and direction depend on the dataset and operating point. The prototype-distance module records the matched label and distance for each routed sample. A complementary controlled protocol evaluates three seeds across multiple held-out-family settings, while a seven-method S1 comparison evaluates MSP, OpenMax, ORI open recognition, EFC, post hoc Energy OOD, single-layer Mahalanobis scoring, and OpenTriIDS at their documented operating points. OpenTriIDS achieves the highest macro-F1 among the evaluated methods in both datasets under this comparison. Together, the analyses characterize a selective open-set policy whose matched-gate macro-F1 advantage is accompanied by dataset- and holdout-dependent unknown-recall trade-offs, while distinguishing predictive performance from routing and computational cost.
SN - 1424-8220
ER -