AdaGUM: An Adaptive Graph Updating Model-Based Anomaly Detection Method for Edge Computing Environment

Abstract

With the rapid development of Internet of Things (IoT), massive sensor data are being generated by the sensors deployed everywhere at an unprecedented rate. As the number of Internet of Things devices is estimated to grow to 25 billion by 2021, when facing the explicit or implicit anomalies in the real-time sensor data collected from Internet of Things devices, it is necessary to develop an effective and efficient anomaly detection method for IoT devices. Recent advances in the edge computing have significant impacts on the solution of anomaly detection in IoT. In this study, an adaptive graph updating model is first presented, based on which a novel anomaly detection method for edge computing environment is then proposed. At the cloud center, the unknown patterns are classified by a deep leaning model, based on the classification results, the feature graphs are updated periodically, and the classification results are constantly transmitted to each edge node where a cache is employed to keep the newly emerging anomalies or normal patterns temporarily until the edge node receives a newly updated feature graph. Finally, a series of comparison experiments are conducted to demonstrate the effectiveness of the proposed anomaly detection method for edge computing. And the results show that the proposed method can detect the anomalies in the real-time sensor data efficiently and accurately. More than that, the proposed method performs well when there exist newly emerging patterns, no matter they are anomalous or normal.

A Survey of AI-Based Anomaly Detection in IoT and Sensor Networks

“…Application Primary Focus Secondary Focus [38] malicious actor IDS - [39] malicious actor IDS - [40] malicious actor DDoS - [41] malicious actor SYN attack - [11] malicious actor botnet - [42] malicious actor -- [14] malicious actor -time series data [43] malicious actor malware detection - [46] malicious actor feature selection - [12] malicious actor -- [44] malicious actor IDS - [10] malicious actor IDS - [45] malicious actor IDS - [47] sensor performance water systems time series data [48] sensor performance charging system - [49] sensor performance nuclear power plant - [51] sensor performance edge connection fault detection - [15] sensor performance emergency detection - [54] time series data IIoT sensor drift - [7] time series data -- [13] time series data multivariate time series data - [55] time series data -- [57] general AD time series data multi-class detection [56] general AD automated vehicles - [58] general AD time series data energy efficiency [52] distributed AD -- [53] distributed AD time series data -…”

“…Table A4 lists all the data-sets used in the works surveyed here. IEEE Xplore 2020 [3] IEEE Xplore 2020 [44] IEEE Xplore 2021 NN and logistic regression (ensemble) 5 [2] IEEE Xplore 2021 STGNN, GCN 3+N (max) [14] IEEE Xplore 2021 GTA l5 [43] IEEE Xplore 2021 GraphSAGE, MLP K+1 [23] Journal of Physics 2021 [24] Nature 2021 GCN (encoder) [10] Science Direct 2019 MLP [45] Wiley 2021 MLP 6 (max) [52] Wiley 2021 CNN, MLP Table A2. Breakdown of hyperparameters in surveyed works.…”

“…Training Epochs [39] 24 h of data [12] 128 Leaky ReLU 50 [48] 5 threshold [54] 40 sigmoid and tanh [40] 14 ReLU 100 [49] 256 [7] sigmoid, ReLU, softplus GRU [11] 12 SeLU [42] 60 ReLU LSTM, sigmoid, softmax [41] 50 [57] 8 softmax/regression 8 [58] 50-100 leaky ReLU (AE), ReLU+Lin (VAE enc), ReLU+Sig (VAE dec) Regression 100 [13] 128 leaky ReLU, max, ReLU max, softmax, sigmoid 150 (trn), 50 (f-t) [15] 15 logarithmic 7 [51] 10 tanh, sigmoid 5-80 [28] 500 [56] 64 ReLU, tanh 200 [55] varies sigmoid, tanh [44] 40 ReLU sigmoid 100 [2] ReLU softmax [14] 128 50 (5x mean) [43] varies avg pooling, ReLU, max pooling Softmax [23] [24] sigmoid, ReLU [10] sigmoid, ReLU, Leaky ReLU, tanh softmax [45] 35 ReLU softmax 300 [52] ReLU linear 1-class Table A2. Cont.…”

“…Learning Rate Batch Size Regularization Loss Function Optimizer [12] 0.001 MSE Adam [48] 0.005 [54] 0.0005 0.02 dropout min avg pred err [40] keras default 32 MSE Adam [49] 0.0001 0.35, 0.3 dropout cross-entropy Adam [7] Kullback-Leibler loss negative reconstruction err + reg [42] grid search opt dropout (grid search opt) MAE, cross-entropy (binary, categorical) Adam [41] MSE Adam [57] 0.005 modified log (TCN), reconstruction loss with KLD (VAE) Adam [58] mini batch reconstruction loss using MSE and KLD Adam [13] 0.0005, 0.0001 64, 32(trn), 32(f-t) 0.2 dropout cross-entropy, squared error SGD, Adam [15] 0.1 MSE MATLAB trainlm [28] KL-divergence+ MSE [56] 0.025 200 L2 w/ 0.2 dropout Adam [55] varies varies dropout, varies MSE GD [44] log log GD [2] batch GD [14] 0.0001 window size = 6 0.05 dropout MSE Adam [43] 0.001 cross-entropy Adam [24] D-value (anomaly score) [10] cross-entropy coordinate descent, GD [45] 0.4 dropout negative log likelihood Adam [52] batch norm w/ rand dropout Table A3. Breakdown of data-sets and metrics used by surveyed works.…”

“…Data-Set(s) Metrics [38] IP camera amperage amperage [39] 24 h of data from custom smart home TN, FN, TP, FP counts and associated TPR [12] SWaT, WaDI precision, recall, F1 [48] charging station logs accuracy, F1 [54] NAB, and yahoo variants, real-world server job AUC [40] benign IoT traffic, generated DDoS precision, recall, F1 [49] nuclear power plant data (from SIMULATE-3K) weighted accuracy [7] SMAP, MSL, SMD, custom (server dataset) precision, recall, F1 [11] IoTPOT, VirusShare, custom GitHub (benign), IoT ELF files (benign) accuracy, FNR, FPR [42] proprietary real-world set, UNB2018, UNB2019, UNB2012 precision, recall, F1 [41] custom SYN attack for virtual IoT network accuracy, FPR [57] DS2OS F1, class-based average F1 [58] SECOM, wafer manufacturing, APS failure precision, recall, F1, FPR, wall clock time (for energy consumption) [13] DSADS, HAR, Turbofan classification error, RMSE [15] coal mine data (private) [51] custom fault location rate [28] air conditioning (private) [47] custom water meter accuracy, AUC, sensitivity, specificity [56] Wyk et al 2020 reference accuracy, precision, F1, sensitivity [55] power, loop sensor, land sensor accuracy, precision, recall, F1, ROC, AUC [3] many, including KDDCup99 [44] BaIoT accuracy, recall, F1, FPR, TPR, specificity [2] multiple [14] SWAT, WaDI, SMAP, MSL recall, precision, F1 [43] IoT malware/benignware accuracy, recall, ROC, AUC, classification time per sample [23] WaDI, SWaT, MSL precision, recall, F1 [24] accuracy, precision,AUC, FPR [10] DS2OS accuracy, precision, recall, F1, ROC [45] DS2OS (distributed smart space orchestration system) accuracy, precision, recall, F1, FPR, specificity, ROC-AUC [52] BaIoT, El Niño FPR, TPR…”