A cross-dataset based zero-day intrusion detection system by integrating siamese network and reinforcement learning

Zero-day attacks threaten IoT security as signature-based detection fails against novel exploits. This paper proposes a hybrid Intrusion Detection System integrating unsupervised anomaly detection, non-parametric Siamese-based cross-dataset dissimilarity filtering, and Proximal Policy Optimization (PPO)-based adaptive defense. Unsupervised models isolate anomalous traffic, Siamese-based correlation extracts structurally rare zero-day candidates, and the PPO agent learns optimal defense policies via environmental feedback. Evaluations on CIC-IoT-2023 and CIC-BCCC-NRC-TabularIoTAttacks-2024 demonstrate 99.28% training accuracy, 99.07% unseen attack accuracy, and 93.94% zero-day detection rate with 0.50 ms latency and 2.21% false-positive rate, providing a scalable, proactive, self-learning defense architecture for autonomous IoT cybersecurity.