Using Autoencoders for Anomaly Detection and Transfer Learning in IoT

Abstract

With the development of Internet of Things (IoT) technologies, more and more smart devices are connected to the Internet. Since these devices were designed for better connections with each other, very limited security mechanisms have been considered. It would be costly to develop separate security mechanisms for the diverse behaviors in different devices. Given new and changing devices and attacks, it would be helpful if the characteristics of diverse device types could be dynamically learned for better protection. In this paper, we propose a machine learning approach to device type identification through network traffic analysis for anomaly detection in IoT. Firstly, the characteristics of different device types are learned from their generated network packets using supervised learning methods. Secondly, by learning important features from selected device types, we further compare the effects of unsupervised learning methods including One-class SVM, Isolation forest, and autoencoders for dimensionality reduction. Finally, we evaluate the performance of anomaly detection by transfer learning with autoencoders. In our experiments on real data in the target factory, the best performance of device type identification can be achieved by XGBoost with an accuracy of 97.6%. When adopting autoencoders for learning features from the network packets in Modbus TCP protocol, the best F1 score of 98.36% can be achieved. Comparable performance of anomaly detection can be achieved when using autoencoders for transfer learning from the reference dataset in the literature to our target site. This shows the potential of the proposed approach for automatic anomaly detection in smart factories. Further investigation is needed to verify the proposed approach using different types of devices in different IoT environments.

A Transferable Deep Learning Framework for Improving the Accuracy of Internet of Things Intrusion Detection

“…Our framework embodies a complete process, starting from a proper source data set selection appropriate for the target domain to conventional instance-based transfer learning. We note that the state-of-the-art transfer learning techniques [29] and improved models [6,30] are applicable in the transfer learning phase of our proposed framework (see Section 4.3). In summary, our ultimate goal is to surpass the mere utilization of transfer learning and strive for efficient adaptation to new IoT environments.…”

MTGAE: Graph Autoencoder with Mirror TCN for Traffic Anomaly Detection

“…Autoencoder, an unsupervised Neural Network (NN), has achieved much success in many fields, and due to its better discrimination power of abnormal input than regular input, it is now widely used in the field of anomaly detection [33][34][35][36][37][38] . Meanwhile, in the field of GCN, GCN-based autoencoders are also used in anomaly detection [39][40][41] .…”

A Comprehensive Survey of Machine Learning Methods for Surveillance Videos Anomaly Detection

“…Tien and Huang [197] present a method based on supervised learning and AE for device type identification and detect anomalies in Internet of Things (IoT) devices. Anomalies are spotted within the packets emitted by the devices, and the identification of the devices is achieved via supervised learning on the collected packets.…”