Cost-sensitive stacked auto-encoders for intrusion detection in the Internet of Things

Abstract

Intrusion Detection System (IDS) is an important tool for protecting the Internet of Things (IoT) networks against cyber-attacks. Traditional IDSs can only distinguish between normal and abnormal behaviors. On the other hand, modern techniques can identify the kind of attack so that the appropriate reactions can be carried out against each type of attack. However, these techniques always suffer from the class-imbalance which affects the performance of IDS. In this paper, we propose a cost-sensitive stacked auto-encoder, CSSAE, to deal with class imbalance problem in IDS. CSSAE generates a cost matrix in which a unique cost is assigned to each class based on the distribution of different classes. This matrix is created in the first stage of CSSAE. In the second phase, a two-layer stacked auto-encoder is applied to learn features with better distinguish between the minority and the majority classes. These costs are used in the feature learning of deep learning, where the parameters of the neural network are modified by applying the corresponding costs in the cost function layer. The proposed method is able to perform on both binary-class data and multiclass data. Two well-known KDD CUP 99 and NSL-KDD datasets are used to evaluate the performance of CSSAE. Compared with other IDSs that have not considered class imbalance problem, CSSAE shows better performance in the detection of low-frequency attacks.

Anomaly-Based Intrusion Detection Systems in IoT Using Deep Learning: A Systematic Literature Review

“…For example, in the IC_VAE model proposed by Lopez-Martin et al [48], using the NSL-KDD dataset, the types of attacks detected by this model are Probing, Remote to Local (R2L), User to Root (U2R), and Denial of Service (DoS) Attacks. Similarly, studies proposed by [13,18,36,44,47] detected the same types of attacks, using NSL-KDD and KDD Cup 1999 datasets. Moreover, in [15,38], by adapting the NSL-KDD and UNSW-NB15, they extended the range of attack by detecting modern attacks, such as Fuzzer and worm, back door, analysis, exploits, generic, seel-code, and recionnary.…”

“…We found that the trend goes to AE techniques. The studies [18,[41][42][43][44]48] used AE techniques because of the ability of AE to take advantage of the linear and nonlinear dimensionality reduction to detect the anomalies. The AE training phase involves the reconstruction of clean input data from a partially destroyed one as well as the ability of AE to deal with heterogeneity, unstructured and high dimensional data that generated from IoT device.…”

Internet of Things: Evolution, Concerns and Security Challenges

“…In another work, Telikani et al [ 106 ] proposed a CSSAE technique for intrusion detection, especially in IoT networks. The main focus of the paper is the class imbalance problem in the datasets, which tends to bias the results towards the majority class.…”

A Multi-Stage Classification Approach for IoT Intrusion Detection Based on Clustering with Oversampling

“…Consequently, some researchers have tried to solve this problem. Telikani and Gandomi suggested a cost-sensitive stacked auto-encoder (CSSAE) approach to handle the imbalance problem in IoT intrusion detection systems [53]. CSSAE produced a cost for each class that depends on the distribution of the classes.…”