CBL-ISL: A CNN and Bi-LSTM-Based Incremental Few-Shot Learning Approach for Real-Time Intrusion Detection in Industrial Internet of Things (IIoT) Systems

In the industrial Internet environment, attack types are increasingly diverse and stealthy. This requires not only responding to evolving external threats but also detecting complex internal anomalies, making behavior-based intrusion detection crucial. However, the industrial Internet faces challenges such as dynamic network changes, complex architectures, high real-time demands, and limited data and resources. Thus, intrusion detection systems must achieve efficient, stable attack detection with minimal resources and small sample sizes. Few-shot incremental learning methods can continuously update models in resource-constrained environments, adapting to dynamic network conditions. However, incremental learning is prone to catastrophic forgetting, which can degrade model performance. To address this, we propose an incremental learning method combining Convolutional Neural Networks (CNN) and Bidirectional Long Short-Term Memory Networks (Bi-LSTM) with a focus on feature retention. This method leverages CNN and attention mechanisms to efficiently extract spatial features and uses Bi-LSTM to capture temporal information. It enhances the model's adaptability and detection accuracy under data scarcity, significantly mitigating catastrophic forgetting and allowing continuous adaptation to new attacks. Experimental results show that the CBL-ISL method outperforms traditional machine learning algorithms on the UNSW-NB15 and NSL-KDD datasets, with real-time performance and robustness validated through time analysis and error testing. Notably, when faced with evolving attack patterns, the method can update in real-time, maintaining effective protection capabilities.