Deep Transfer Learning for IoT Attack Detection

Abstract

The digital revolution has substantially changed our lives in which Internet-of-Things (IoT) plays a prominent role. The rapid development of IoT to most corners of life, however, leads to various emerging cybersecurity threats. Therefore, detecting and preventing potential attacks in IoT networks have recently attracted paramount interest from both academia and industry. Among various attack detection approaches, machine learning-based methods, especially deep learning, have demonstrated great potential thanks to their early detecting capability. However, these machine learning techniques only work well when a huge volume of data from IoT devices with label information can be collected. Nevertheless, the labeling process is usually time consuming and expensive, thus, it may not be able to adapt with quick evolving IoT attacks in reality. In this paper, we propose a novel deep transfer learning (DTL) method that allows to learn from data collected from multiple IoT devices in which not all of them are labeled. Specifically, we develop a DTL model based on two AutoEncoders (AEs). The first AE (AE 1) is trained on the source datasets (source domains) in the supervised mode using the label information and the second AE (AE 2) is trained on the target datasets (target domains) in an unsupervised manner without label information. The transfer learning process attempts to force the latent representation (the bottleneck layer) of AE 2 similarly to the latent representation of AE 1. After that, the latent representation of AE 2 is used to detect attacks in the incoming samples in the target domain. We carry out intensive experiments on nine recent IoT datasets to evaluate the performance of the proposed model. The experimental results demonstrate that the proposed DTL model significantly improves the accuracy in detecting IoT attacks compared to the baseline deep learning technique and two recent DTL approaches. INDEX TERMS Deep transfer learning, IoT, cyberattack detection, AutoEncoder. I. INTRODUCTION T HE Internet-of-Things (IoT) refers to connected devices, sensors, an actuators used in vehicles, electronic appliances, buildings, and structures. As the sensors, data storage, and the Internet become cheaper, faster, and more integrated together, IoT devices will find more and more applications [1] (e.g., in smart buildings, smart city, intelligent transportation systems, and healthcare). The rapid development of IoT to most corners of life, however, leads to various emerging cybersecurity threats. This is because IoT devices are often limited in computing capability and energy, making them particularly vulnerable to adversaries. IoT devices are more exposed to and unfortunately more difficult to be protected from cyber attacks than computers [2], [3]. Consequently, detecting attacks to protect IoT devices from malicious behaviors is critical to broadening the applications of IoT [4]-[7].

Deep Cybersecurity: A Comprehensive Overview from Neural Network and Deep Learning Perspective

“…Their experimental findings on a sample indicate the efficacy of 98.62% accuracy in classifying malware groups. In [120] the authors present deep transfer learning for IoT attack detection with significant accuracy compared to the baseline deep learning technique. Overall, the transfer learning system significantly accelerates the training of very deep neural networks while retaining high efficiency in the field of cybersecurity, even…”

Deep Cybersecurity: A Comprehensive Overview from Neural Network and Deep Learning Perspective

“…Their experimental findings on a sample indicate the efficacy of 98.62 percent accuracy in classifying malware groups. In [127] the authors present deep transfer learning for IoT attack detection with significant accuracy compared to the baseline deep learning technique. Overall, the transfer learning system significantly accelerates the training of very deep neural networks while retaining high efficiency in the field of cybersecurity, even on smaller datasets.…”

Challenges, Opportunities, and Future Prospects

“…The central objective of transfer learning revolves around reducing the workload and time needed for the new learning operation [54]. The major interest in transfer learning consider the amount of domain expertise that could be transported in form of common knowledge between different data domains [55]. Consequently, it is effective to exploit this transferred knowledge during the design of a new security solution.…”