Autoencoder-based feature construction for IoT attacks clustering

Haseeb, Junaid; Mansoori, Masood; Hirose, Yuichi; Al-Sahaf, Harith; Welch, Ian

doi:10.1016/j.future.2021.09.025

Cited by 20 publications

(6 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Several studies have utilized autoencoders for cyberattack detection by training them on network tra c data to learn normal tra c patterns and detect anomalies. Haseeb et al (2022)[18] proposed an autoencoder-based approach for detecting cyberattacks in an IoT environment. They used network tra c features, including source IP address, destination IP address, port number, and packet size, as input to the autoencoder.…”

Section: Literature Reviewmentioning

confidence: 99%

Cyberattack Detection Using Unsupervised Learning Techniques

Islam,

Rashid

2024

Preprint

View full text Add to dashboard Cite

Cybersecurity threats are becoming increasingly sophisticated and challenging to detect, making it critical to develop effective and robust detection mechanisms. Unsupervised learning techniques offer a promising approach for cyberattack detection, particularly in scenarios where labeled data is scarce or not available. In this research, we propose a novel approach for cyberattack detection using adversarial autoencoders, which combine the traditional autoencoder architecture with an additional adversarial component. The proposed approach involves data collection and preprocessing, training an adversarial autoencoder model using unsupervised learning with adversarial training, detecting anomalies, and evaluating the performance of the approach. The proposed approach offers several benefits, including the ability to capture complex relationships in the data and generate realistic reconstructions of normal data. The effectiveness and potential of the proposed approach will be evaluated through extensive experiments and comparisons with existing unsupervised learning techniques or other benchmark methods.

show abstract

Section: Literature Reviewmentioning

confidence: 99%

Cyberattack Detection Using Unsupervised Learning Techniques

Islam,

Rashid

2024

Preprint

View full text Add to dashboard Cite

show abstract

“…(1) all of the available features, (2) a manually selected feature subset which is comprised of the 'immediate suspects,' namely octet delta count, avg packet size, flow duration milliseconds, same dest ip count pool, and same dest port count pool (see Appendix A for feature descriptions), (3) a PCA transformation of the original features, and (4) the hidden layer of the AE underlying F ilter m 1 , as in [82] and [83]. 5) In F ilter m 2 , the distance of a flow f from the cluster to which it is assigned is used as a measure of abnormality.…”

Section: E Hyperparameter Tuningmentioning

confidence: 99%

CADeSH: Collaborative Anomaly Detection for Smart Homes

Avraham

Libhaber

Shabtai

2023

IEEE Internet Things J.

View full text Add to dashboard Cite

Although home IoT (Internet of Things) devices are typically plain and task oriented, the context of their daily use may affect their traffic patterns. That is, a given IoT device will probably not generate the exact same traffic data when operated by different people in different environments and when connected to different networks with different topologies and communication components. For this reason, anomaly-based intrusion detection systems tend to suffer from a high false positive rate (FPR). To overcome this, we propose a two-step collaborative anomaly detection method which first uses an autoencoder to differentiate frequent ('benign') and infrequent (possibly 'malicious') traffic flows. Clustering is then used to analyze only the infrequent flows and classify them as either known ('rare yet benign') or unknown ('malicious'). Our method is collaborative, in that (1) normal behaviors are characterized more robustly, as they take into account a variety of user interactions and network topologies, and (2) several features are computed based on a pool of identical devices rather than just the inspected device.We evaluated our method empirically, using 21 days of real-world traffic data that emanated from eight identical IoT devices deployed on various networks, one of which was located in our controlled lab where we implemented two popular IoT-related cyber-attacks. Our collaborative anomaly detection method achieved a macro-average area under the precision-recall curve of 0.841, an F1 score of 0.929, and an FPR of only 0.014. These promising results were obtained by using labeled traffic data from our lab as the test set, while training the models on the traffic of devices deployed outside the lab, and thus demonstrate a high level of generalizability. In addition to its high generalizability and promising performance, our proposed method also offers benefits such as privacy preservation, resource savings, and model poisoning mitigation. On top of that, as a contribution to the scientific community, our novel dataset is available online.

show abstract

“…The effective analysis and mining around these huge amounts of data have gradually become an important requirement to enhance the value of IoT data [1]. As a typical data mining technology, clustering analysis plays an important role in many IoT data analysis scenarios, such as network energy saving [2,3], privacy protection [4], attack detection [5,6], service computing [7], and pattern discovery [8,9]. The goal of clustering analysis is to divide the unknown data into a set of clusters based on a certain similarity measurement between data samples, so that samples in the same cluster are close to each other, and those in different clusters are different from each other.…”

Section: Introductionmentioning

confidence: 99%

A Generative Clustering Ensemble Model and Its Application in IoT Data Analysis

Wang

Bai

et al. 2022

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

Data analysis is the foundation of Internet of Things (IoT) based applications, and clustering is an effective technology of data analysis. Clustering ensemble integrates multiple base clustering results to obtain a consensus result and thus improves the clustering performance in stability and robustness. However, it is difficult for existing clustering ensemble algorithms to achieve a satisfying ensemble result, when the base clustering results are unreliable. Concerning this problem, we develop a new clustering ensemble model in this paper, which has several advantages compared with traditional algorithms: (i) structure information about the data is effectively extracted from the base clusterings; (ii) data characteristics and structure information are integrated in an elegant fashion, in the production of the consensus clustering result; and (iii) our model has the generative ability that makes the model achieve outstanding performance when training samples are insufficient. In our model, the structural information is extracted by explicating the coupling relationships between base clusterings and between samples in clustering members. Then, data characteristics and structure information are combined in a generative graph representation learning framework. And the objectives of representation learning and consensus clustering are integrated into a unified optimization model, in which the prior distribution of the data is approximated by a Gaussian mixture model (GMM). Extensive experiments are conducted on multiple IoT datasets; the results prove that our model not only performs better than the conventional clustering ensemble algorithms but also outperforms the state-of-the-art deep clustering methods.

show abstract

Autoencoder-based feature construction for IoT attacks clustering

Cited by 20 publications

References 10 publications

Cyberattack Detection Using Unsupervised Learning Techniques

Cyberattack Detection Using Unsupervised Learning Techniques

CADeSH: Collaborative Anomaly Detection for Smart Homes

A Generative Clustering Ensemble Model and Its Application in IoT Data Analysis

Contact Info

Product

Resources

About